UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. With the industry-wide chain-of-trust mechanism subverted, the malware was able to run malicious code before Windows was fully loaded and many security defenses were operational.

2023年，一种被称为BlackLotus的恶意软件成为首个被公开记录的野外UEFI引导工具包，它能够绕过完全更新的Windows 11系统上的安全启动（Secure Boot）。由于行业范围内的信任链机制被破坏，该恶意软件能够在Windows完全加载且许多安全防御措施尚未运行之前执行恶意代码。

Microsoft had already patched the vulnerability that BlackLotus exploited in 2022. In 2023 and 2024, Microsoft issued additional updates. The first added a new certificate that no longer trusted the vulnerable boot managers. The second provided the means to revoke trust in the digital certificate used to sign older vulnerable Windows boot managers. The organizations infected by the new bootkit, which is tracked under the name BlackX, had installed all of these patches. So how did they fall victim?

微软早在2022年就修复了BlackLotus所利用的漏洞。在2023年和2024年，微软发布了额外的更新。第一次更新添加了一个新证书，不再信任易受攻击的引导管理器。第二次更新提供了撤销对用于签署旧版易受攻击Windows引导管理器的数字证书的信任的方法。被名为BlackX的新引导工具包感染的组织已经安装了所有这些补丁。那么，他们是如何受害的呢？

UEFI bootkit refresher. Before discussing the incident further, a brief review of BlackLotus and UEFI malware is in order. Short for Unified Extensible Firmware Interface, UEFI is firmware that runs immediately after a computer is turned on. One of its main jobs is to load system configuration settings, identify and initialize hardware components, and prepare the computer to start its OS.

UEFI引导工具包回顾。在进一步讨论该事件之前，有必要简要回顾一下BlackLotus和UEFI恶意软件。UEFI是统一可扩展固件接口的缩写，它是计算机开机后立即运行的固件。其主要工作之一是加载系统配置设置、识别并初始化硬件组件，并准备计算机以启动其操作系统。

Another important UEFI function is Secure Boot, a security feature that establishes a chain of trust by verifying the digital signatures of each piece of boot software before allowing it to execute. Its purpose is to prevent attackers who gain control of a device, either physically or through a malware compromise, from running unauthorized boot code in place of legitimate software.

UEFI的另一个重要功能是安全启动（Secure Boot），这是一种安全特性，通过在允许每段引导软件执行之前验证其数字签名来建立信任链。其目的是防止攻击者在通过物理方式或恶意软件入侵获得设备控制权后，运行未经授权的引导代码来代替合法软件。

One item that must be digitally signed is the boot manager, a component stored on a small dedicated partition on a drive. The boot manager is responsible for the initial loading of the OS. Both BlackLotus and BlackX exploit “Baton Drop,” a logic flaw in the Windows boot manager that allows attackers to bypass Secure Boot (and, under certain conditions, extract BitLocker encryption keys).

必须进行数字签名的项目之一是引导管理器，这是一个存储在驱动器上小型专用分区中的组件。引导管理器负责操作系统的初始加载。BlackLotus和BlackX都利用了“Baton Drop”，这是Windows引导管理器中的一个逻辑缺陷，允许攻击者绕过安全启动（并在特定条件下提取BitLocker加密密钥）。

The vulnerability, tracked as CVE-2022-21894, came to light in 2022. Microsoft fixed the vulnerability that same year, but it didn’t revoke trust in the certificate used to sign older vulnerable boot managers. BlackLotus exploited this gap and went on to load a malicious kernel-mode driver. What makes BlackLotus and BlackX so valuable to attackers is that they execute early in the boot process, allowing them to load malicious drivers into the Windows kernel before many OS and security defenses are running.

该漏洞被追踪为CVE-2022-21894，于2022年曝光。微软在同年修复了该漏洞，但并未撤销对用于签署旧版易受攻击引导管理器的证书的信任。BlackLotus利用了这一漏洞，并进而加载了一个恶意的内核模式驱动程序。BlackLotus和BlackX对攻击者如此有价值的原因在于，它们在引导过程的早期执行，使它们能够在许多操作系统和安全防御措施运行之前将恶意驱动程序加载到Windows内核中。

UEFI bootkits can be difficult to detect without specialized security tools and may survive an OS reinstallation if the infected boot partition remains intact. While bootkits require attackers to first compromise a device, they are particularly valuable because they combine stealth, persistence, and extensive control over the OS. The discovery of BlackLotus marked a major milestone because it transformed bootkits that bypassed Secure Boot from a theoretical threat to a real one. The ability of BlackX to achieve the same feat is similarly notable.

如果没有专门的安全工具，UEFI引导工具包可能难以检测，并且如果受感染的引导分区保持完整，它们可能会在操作系统重新安装后存活。虽然引导工具包要求攻击者首先入侵设备，但它们特别有价值，因为它们结合了隐蔽性、持久性和对操作系统的广泛控制。BlackLotus的发现是一个重要的里程碑，因为它将绕过安全启动的引导工具包从理论威胁转变为现实威胁。BlackX实现同样壮举的能力也同样值得注意。

Exploiting a lack of clarity. In May 2023—two months after the discovery of BlackLotus—Microsoft began a yearslong process aimed at closing the vulnerability once and for all. Having patched the underlying bootloader vulnerability in 2022, Microsoft’s May 2023 patch batch included security updates to prevent attackers from loading older vulnerable boot managers. The mitigation process included adding a new signing certificate, Windows UEFI CA 2023, to Secure Boot’s database of trusted certificates.

利用模糊性。2023年5月，即BlackLotus被发现两个月后，微软开始了一项旨在彻底消除该漏洞的多年计划。在2022年修补了底层引导加载程序漏洞后，微软2023年5月的补丁包包含了旨在防止攻击者加载旧版易受攻击引导管理器的安全更新。缓解过程包括将一个新的签名证书（Windows UEFI CA 2023）添加到安全启动的受信任证书数据库中。

In 2024, Microsoft introduced a broader mitigation that provided a way to add the old certificate, Windows Production PCA 2011, to Secure Boot’s forbidden-signatures database. The latter step would prevent older boot managers signed under the 2011 certificate from running. But as Ars reported at the time, this second patch didn’t revoke trust in the older vulnerable boot managers either. Fear of rendering potentially millions of devices unbootable if they hadn’t received the necessary updates prevented Microsoft from immediately enforcing the revocations.

2024年，微软引入了一种更广泛的缓解措施，提供了一种将旧证书（Windows Production PCA 2011）添加到安全启动的禁止签名数据库的方法。后一步骤将阻止使用2011年证书签署的旧版引导管理器运行。但正如Ars当时报道的那样，这第二个补丁也没有撤销对旧版易受攻击引导管理器的信任。由于担心如果数百万台设备未收到必要的更新而导致其无法启动，微软未能立即强制执行撤销。

Unlike most patches, the updates alone didn’t provide complete protection. This state of purgatory has existed ever since and is what allowed BlackX to bypass Secure Boot three years after BlackLotus. “This patch deployment practice creates a problem—as it is extremely unusual for a system administrator to take extra steps after installing an update,” a researcher from Kaspersky, the security firm that discovered the BlackX infections, wrote recently.

与大多数补丁不同，仅靠更新并不能提供完全的保护。这种“炼狱”状态一直存在，这也是BlackX能够在BlackLotus出现三年后绕过安全启动的原因。“这种补丁部署实践造成了一个问题——因为系统管理员在安装更新后采取额外步骤是非常罕见的，”发现BlackX感染的安全公司卡巴斯基的一名研究人员最近写道。

“Usually, when applying patches, system administrators take no further action unless an installation failure occurs. These instructions for activating the patch are buried deep on the Microsoft website, and we assess that they are quite hard for an average IT administrator to notice.” A Microsoft representative said in an email that the company is advising customers to follow guidance in this Knowledge Base post published two weeks ago.

“通常情况下，在应用补丁时，除非发生安装失败，否则系统管理员不会采取进一步行动。这些激活补丁的说明被埋在微软网站的深处，我们评估认为，普通IT管理员很难注意到它们。”微软的一位代表在电子邮件中表示，公司建议客户遵循两周前发布的知识库文章中的指导。

Nowhere in it, though, does Microsoft warn that the patches released to date do nothing to protect customers from Baton Drop attacks. As Kaspersky notes, Microsoft leaves out that after installing the patches, most administrators must take an additional action described in this 2023 Knowledge Base article. (It’s not clear from this article what the status is for home Windows users.)

然而，微软在文中任何地方都没有警告说，迄今为止发布的补丁并不能保护客户免受Baton Drop攻击。正如卡巴斯基所指出的，微软遗漏了一点，即在安装补丁后，大多数管理员必须采取这篇2023年知识库文章中所述的额外行动。（从这篇文章中尚不清楚家庭Windows用户的状况如何。）

The BlackX incident underscores the difficult balancing act Microsoft must perform. Revoke the key before the new one has been installed, and a machine becomes little more than an expensive paperweight. Allow the old patch to be trusted for four years and counting, and successful exploitation is almost inevitable. The middle ground, it would seem, would be for Microsoft to be more explicit about the risks that result when.

BlackX事件凸显了微软必须进行的艰难平衡。如果在安装新密钥之前撤销旧密钥，机器就会变成昂贵的镇纸。如果允许旧补丁持续被信任四年甚至更久，那么成功的攻击几乎是不可避免的。中间地带似乎是，微软应该更明确地说明由此产生的风险。