You mean the thousands of computers that have to be thrown away to use windows 11 are using it for profit and not security??
-shocked Pikachu face-
BlackLotus malware can bypass secure boot
21–30 of 34 posts
Re: BlackLotus malware can bypass secure boot
#22Very interesting, thanks for sharing
Re: BlackLotus malware can bypass secure boot
#23You mean the thousands of computers that have to be thrown away to use windows 11 are using it for profit and not security?? -shocked Pikachu face-
Not yet. You can still disable secure boot and install Linux.
At some point in the future, it may become the same as phones. Locked bootloader/UEFI and only able to boot Windows.
Re: BlackLotus malware can bypass secure boot
#24How is that malware deployed to a machine? Is that something attackers can install/activate remotely through some kind of RCE, or does it need me to run an executable manually? In other words, is it still enough to be careful with social engineering, or are we more screwed than that?
> Is that something attackers can install/activate remotely through some kind of RCE, or does it need me to run an executable manually?
This piece of malware is not related to distribution, and must be executed manually (or, more likely, executed by a different malware sample serving as a loader). So you can use it in a social engineering attack, deploy it org-wide after exploiting AD, install it using some kind of RCE, etc.
Re: BlackLotus malware can bypass secure boot
#25I'm glad we are locking down our machines and relinquishing control to Microsoft for singing so that we can still be owned.
Re: BlackLotus malware can bypass secure boot
#26You mean the thousands of computers that have to be thrown away to use windows 11 are using it for profit and not security?? -shocked Pikachu face-
Not yet. You can still disable secure boot and install Linux. At some point in the future, it may become the same as phones. Locked bootloader/UEFI and only able to boot Windows.
While true, this is going to be a tough topic to bring up at the clients office.
So far I am contemplating building a throne from them.
Re: BlackLotus malware can bypass secure boot
#27Oh wow, it installs its own legitimate but vunerable firmware. I don't know why this tickles me so much, but it does.
Re: BlackLotus malware can bypass secure boot
#28Earlier quoted context omitted.
> [0]: https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bo ... So how do you remove it?
Disable-Bitlocker should do the trick: https://learn.microsoft.com/en-us/powershell/module/bitlocke... Obviously requires admin permissions on a running host, but if you're injecting into the bootloader you're already admin (or you can get it easily).
So doesnt things like windows defender offline scans and other offline scans where the HD bitlocker codes is typed in manually not detect the rootkit?
Half the problem I find with these security products is knowing what their actual abilities are and inabilities. I've assumed wrongly in the past that some security products are doing things when in fact they are not, and thats obviously an area for exploitation.
Re: BlackLotus malware can bypass secure boot
#29I'm glad we are locking down our machines and relinquishing control to Microsoft for singing so that we can still be owned.
they sell you the tools you need to work, each day. Just sign in!
Re: BlackLotus malware can bypass secure boot
#30Oh wow, it installs its own legitimate but vunerable firmware . I don't know why this tickles me so much, but it does.
> Oh wow, it installs its own legitimate but vunerable firmware.
No it doesn't. It's using a legitimate but vulnerable version of the windows bootloader which hasn't been added to the UEFI revocation list yet. It's not doing anything with firmware.
Downgrading UEFI firmware would be far more complicated.