NSA Releases Guide to Combat Powerful BlackLotus Bootkit Targeting Windows Systems

The U.S. National Security Company (NSA) on Thursday launched advice to enable companies detect and stop bacterial infections of a Unified Extensible Firmware Interface (UEFI) bootkit known as BlackLotus.

To that finish, the company is recommending that “infrastructure house owners consider action by hardening consumer executable policies and monitoring the integrity of the boot partition.”

BlackLotus is an state-of-the-art crimeware resolution that was to start with spotlighted in Oct 2022 by Kaspersky. A UEFI bootkit able of bypassing Windows Protected Boot protections, samples of the malware have since emerged in the wild.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

This is achieved by using advantage of a identified Windows flaw known as Baton Fall (CVE-2022-21894, CVSS score: 4.4) learned in vulnerable boot loaders not included into the Protected Boot DBX revocation listing. The vulnerability was addressed by Microsoft in January 2022.

This loophole could be exploited by risk actors to swap thoroughly patched boot loaders with vulnerable variations and execute BlackLotus on compromised endpoints.

UEFI bootkits like BlackLotus grant a danger actor complete manage over the running technique booting procedure, therefore creating it feasible to interfere with security mechanisms and deploy additional payloads with elevated privileges.

It can be really worth noting that BlackLotus is not a firmware menace, and as a substitute hones in on the earliest software program stage of the boot process to achieve persistence and evasion. There is no proof that the malware targets Linux systems.

“UEFI bootkits may possibly shed on stealthiness when in contrast to firmware implants […] as bootkits are situated on an conveniently accessible Unwanted fat32 disk partition,” ESET researcher Martin Smolár said in an evaluation of BlackLotus in March 2023.

“Even so, operating as a bootloader presents them practically the very same capabilities as firmware implants, but without the need of acquiring to defeat the multilevel SPI flash defenses, these kinds of as the BWE, BLE, and PRx security bits, or the protections furnished by components (like Intel Boot Guard).

Other than applying the Might 2023 Patch Tuesday updates from Microsoft, which resolved a second Secure Boot bypass flaw (CVE-2023-24932, CVSS rating: 6.7) exploited by BlackLotus, companies are encouraged to carry out the adhering to mitigation steps –

• Update recovery media
• Configure defensive program to scrutinize changes to the EFI boot partition
• Keep track of machine integrity measurements and boot configuration for anomalous changes in the EFI boot partition
• Personalize UEFI Safe Boot to block more mature, signed Windows boot loaders
• Clear away the Microsoft Windows Output CA 2011 certificate on devices that completely boot Linux

Microsoft, for its section, is having a phased approach to totally close the attack vector. The fixes are expected to be normally offered in the to start with quarter of 2024.

Uncovered this article fascinating? Stick to us on Twitter  and LinkedIn to study more exclusive content we write-up.