Subj : Re: Unpatchable UEFI bootkit bypasses Secure Boot
To   : August Abolins
From : digimaus
Date : Mon Mar 06 2023 16:58:08

-=> August Abolins wrote to All <=-

 AA> While researchers have found Secure Boot vulnerabilities in the past,
 AA> there has been no indication that threat actors have ever been able to
 AA> bypass the protection in the 12 years it has been in existence. Until
 AA> now.

Yet Microsoft patched the issue but, as Microsoft is known to do, half-assed
its response:

"BlackLotus exploits a more than one-year-old vulnerability, CVE-2022-21894,
to bypass the secure boot process and establish persistence.  Microsoft
fixed this CVE in January 2022, but miscreants can still exploit it because
the affected signed binaries have not been added to the UEFI revocation
list, Smolar noted."

"Making it even more difficult to detect: BlackLotus can disable several OS
security tools including BitLocker, Hypervisor-protected Code Integrity
(HVCI) and Windows Defender, and bypass User Account Control (UAC),
according to the security shop."

(From: https://www.theregister.com/2023/03/01/blacklotus_malware_eset)

Glad I don't run Windows anymore.

-- Sean


.... "Software is like sex, it's better when it's free" - Linux Torvalds
--- MMail/FreeBSD
 * Origin: Outpost BBS * Johnson City, TN (618:618/1)

.