Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BlackLotus malware can bypass secure boot

theregister.com

Post reply on HN
Print view View original

11–20 of 34 posts

Re: BlackLotus malware can bypass secure boot

#11

Post by SCHiM »

It's quite a painful split that Microsoft is in given their commitment to backwards compatibility.

The exploit can still be deployed by malicious actors on patched devices because they can bring old vulnerable signed bootloaders. And roll back any applied patches.

These old signed bootloaders could technically by revoked, but if Microsoft does that then all old backups, possibly going back years, will no longer boot when restored. I can imagine there's many hundreds of thousands of backups that would then be silently broken. Imagine you find that out when you restore after a disaster...

Re: BlackLotus malware can bypass secure boot

#13

Post by mavhc »

moremetadata wrote: post #10
bayindirh wrote: post #6

Earlier quoted context omitted.

From the official analysis [0]: > The next feature deactivated by the installer is BitLocker Drive Encryption. The reason for this is that BitLocker can be used in a combination with Trusted Platform Module (TPM) to ensure that various boot files and configurations, including Secure Boot, haven’t been tampered with since BitLocker drive encryption was configured on the system. Considering that the installer modifies…

> [0]: https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bo ... So how do you remove it?

Bitlocker? If you're Admin in Windows you can just unencrypt your drive

Re: BlackLotus malware can bypass secure boot

#14

Post by jeroenhd »

moremetadata wrote: post #10
bayindirh wrote: post #6

Earlier quoted context omitted.

From the official analysis [0]: > The next feature deactivated by the installer is BitLocker Drive Encryption. The reason for this is that BitLocker can be used in a combination with Trusted Platform Module (TPM) to ensure that various boot files and configurations, including Secure Boot, haven’t been tampered with since BitLocker drive encryption was configured on the system. Considering that the installer modifies…

> [0]: https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bo ... So how do you remove it?

Disable-Bitlocker should do the trick: https://learn.microsoft.com/en-us/powershell/module/bitlocke...

Obviously requires admin permissions on a running host, but if you're injecting into the bootloader you're already admin (or you can get it easily).

Re: BlackLotus malware can bypass secure boot

#16

Post by formerly_proven »

SCHiM wrote: post #11

It's quite a painful split that Microsoft is in given their commitment to backwards compatibility. The exploit can still be deployed by malicious actors on patched devices because they can bring old vulnerable signed bootloaders. And roll back any applied patches. These old signed bootloaders could technically by revoked, but if Microsoft does that then all old backups, possibly going back years, will no longer boot…

Didn’t Microsoft do this already? I recall a Windows update blacklisting vulnerable Linux bootloaders in UEFI.

KB5012170

So if they don’t blacklist vulnerable ntldrs, it’d be clear evidence of unequal treatment.

Re: BlackLotus malware can bypass secure boot

#17

Post by wkat4242 »

formerly_proven wrote: post #16
SCHiM wrote: post #11

It's quite a painful split that Microsoft is in given their commitment to backwards compatibility. The exploit can still be deployed by malicious actors on patched devices because they can bring old vulnerable signed bootloaders. And roll back any applied patches. These old signed bootloaders could technically by revoked, but if Microsoft does that then all old backups, possibly going back years, will no longer boot…

Didn’t Microsoft do this already? I recall a Windows update blacklisting vulnerable Linux bootloaders in UEFI. KB5012170 So if they don’t blacklist vulnerable ntldrs, it’d be clear evidence of unequal treatment.

I bet they are a lot more inclined to blacklist old Linux bootloaders than Windows ones, precisely because of this backup restore thing that the OP mentioned. They'll get the support burden if nothing else.

Re: BlackLotus malware can bypass secure boot

#18

Post by wkat4242 »

gpderetta wrote: post #15
holdenc137 wrote: post #12

Perhaps we could ever so slightly dissuade malware actors by assigning less desirable names. E.g. instead of 'BlackLotus' => 'LameEffort-12'

'BlackLotus' => 'BlackerLotus', way less desirable.

Or BlackOrifice as a pun on the old rootkit.

Cybersecurity has become big business since then though, and as such a much more carefully PRed rubber tile community, sadly.

Re: BlackLotus malware can bypass secure boot

#19

Post by aaronmdjones »

SCHiM wrote: post #11

It's quite a painful split that Microsoft is in given their commitment to backwards compatibility. The exploit can still be deployed by malicious actors on patched devices because they can bring old vulnerable signed bootloaders. And roll back any applied patches. These old signed bootloaders could technically by revoked, but if Microsoft does that then all old backups, possibly going back years, will no longer boot…

They won't boot immediately, but they can be trivially made to boot again by simply updating the Microsoft bootloader files on the EFI System Partition. You can even script this for PXE execution.

Re: BlackLotus malware can bypass secure boot

#20

Post by 323 »

mjg59 wrote: post #9
aspyct wrote: post #2

How is that malware deployed to a machine? Is that something attackers can install/activate remotely through some kind of RCE, or does it need me to run an executable manually? In other words, is it still enough to be careful with social engineering, or are we more screwed than that?

The initial infection requires the ability to execute code as admin under Windows, but the writeup notes that it attempts to bypass UAC to gain that even as an unprivileged user (albeit one who is permitted to run code as admin). If you run as a user who doesn't have admin access you should be protected, even if we don't know the initial infection vector.

> If you run as a user who doesn't have admin access you should be protected,

That's not very reassuring. Privilege escalation on Windows is a well studied subject:

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/mas...

Post reply on HN