BlackLotus malware can bypass secure boot
theregister.com
BlackLotus malware can bypass secure boot
1–10 of 34 posts
Re: BlackLotus malware can bypass secure boot
#2How is that malware deployed to a machine?
Is that something attackers can install/activate remotely through some kind of RCE, or does it need me to run an executable manually?
In other words, is it still enough to be careful with social engineering, or are we more screwed than that?
Re: BlackLotus malware can bypass secure boot
#3By passing secure boot is pretty bad, but the article doesn't mention anything about the TPM. Even if you trick uefi to execute this exploit, surely the TPM will have different measurements and not release the encryption key.
The article says it can run on windows 11, which does imply it also tricks the TPM but I would love confirmation.
Re: BlackLotus malware can bypass secure boot
#4Re: BlackLotus malware can bypass secure boot
#5How is that malware deployed to a machine? Is that something attackers can install/activate remotely through some kind of RCE, or does it need me to run an executable manually? In other words, is it still enough to be careful with social engineering, or are we more screwed than that?
> At this point, we have not been able to identify, from our telemetry, the exact distribution channel used to deploy the bootkit to victims. The low number of BlackLotus samples we have been able to obtain, both from public sources and our telemetry, leads us to believe that not many threat actors have started using it yet. [0]
Right now, we don't know how it gets its way to the target.
But, we do know that it comes in the form of an installer, which then requires a system reboot to enable persistence, and then another reboot to do its actual job.
> In all subsequent boots, the self-signed UEFI bootkit is executed and deploys both its kernel driver and user-mode payload, the HTTP downloader. Together, these components are able to download and execute additional user-mode and driver components from the C&C server and protect the bootkit against removal
[0] https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bo...
Re: BlackLotus malware can bypass secure boot
#6By passing secure boot is pretty bad, but the article doesn't mention anything about the TPM. Even if you trick uefi to execute this exploit, surely the TPM will have different measurements and not release the encryption key. The article says it can run on windows 11, which does imply it also tricks the TPM but I would love confirmation.
From the official analysis [0]:
> The next feature deactivated by the installer is BitLocker Drive Encryption. The reason for this is that BitLocker can be used in a combination with Trusted Platform Module (TPM) to ensure that various boot files and configurations, including Secure Boot, haven’t been tampered with since BitLocker drive encryption was configured on the system. Considering that the installer modifies the Windows boot chain on a compromised machine, keeping BitLocker on for systems with TPM support would lead to a BitLocker recovery screen at the next bootup and would tip the victim off that the system had been compromised.
[0]: https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bo...
Re: BlackLotus malware can bypass secure boot
#7How is that malware deployed to a machine? Is that something attackers can install/activate remotely through some kind of RCE, or does it need me to run an executable manually? In other words, is it still enough to be careful with social engineering, or are we more screwed than that?
> At this point, we have not been able to identify, from our telemetry, the exact distribution channel used to deploy the bootkit to victims. The low number of BlackLotus samples we have been able to obtain, both from public sources and our telemetry, leads us to believe that not many threat actors have started using it yet. [0] Right now, we don't know how it gets its way to the target. But, we do know that it comes…
Thanks :)
Re: BlackLotus malware can bypass secure boot
#8By passing secure boot is pretty bad, but the article doesn't mention anything about the TPM. Even if you trick uefi to execute this exploit, surely the TPM will have different measurements and not release the encryption key. The article says it can run on windows 11, which does imply it also tricks the TPM but I would love confirmation.
It doesn't trick the TPM, but as mentioned in the other comment, it does disable Bitlocker before compromising the boot chain so that won't be obvious from an end-user perspective. Remote attestation would still demonstrate that the boot chain had changed, and something like https://www.osfc.io/2022/talks/user-friendly-lightweight-tpm... would let you use your phone to determine that before logging in.
Re: BlackLotus malware can bypass secure boot
#9How is that malware deployed to a machine? Is that something attackers can install/activate remotely through some kind of RCE, or does it need me to run an executable manually? In other words, is it still enough to be careful with social engineering, or are we more screwed than that?
The initial infection requires the ability to execute code as admin under Windows, but the writeup notes that it attempts to bypass UAC to gain that even as an unprivileged user (albeit one who is permitted to run code as admin). If you run as a user who doesn't have admin access you should be protected, even if we don't know the initial infection vector.
Re: BlackLotus malware can bypass secure boot
#10By passing secure boot is pretty bad, but the article doesn't mention anything about the TPM. Even if you trick uefi to execute this exploit, surely the TPM will have different measurements and not release the encryption key. The article says it can run on windows 11, which does imply it also tricks the TPM but I would love confirmation.
From the official analysis [0]: > The next feature deactivated by the installer is BitLocker Drive Encryption. The reason for this is that BitLocker can be used in a combination with Trusted Platform Module (TPM) to ensure that various boot files and configurations, including Secure Boot, haven’t been tampered with since BitLocker drive encryption was configured on the system. Considering that the installer modifies…
> [0]: https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bo...
So how do you remove it?