UEFI Cyber Security Vulnerability
On Wednesday, March 1st, 2023, researchers announced the discovery of the first real-world malware that can hijack a computer’s boot process even when advanced protections, such as Secure Boot, are enabled and running on fully updated versions of Windows. Dubbed BlackLotus, this malware is a UEFI bootkit that targets the low-level and complex firmware responsible for booting up modern computers, known as the Unified Extensible Firmware Interface (UEFI). Because the UEFI is the first thing to run when a computer is turned on, it influences all other software that follows and is, therefore, the perfect place to launch malware. UEFI bootkits, including BlackLotus, disable OS security mechanisms and ensure that a computer remains infected with stealthy malware even after the operating system is reinstalled or a hard drive is replaced.
However, there are two significant hurdles that stand in the way of UEFI attacks. First, threat actors must gain administrator system rights by exploiting vulnerabilities in the OS or apps or tricking a user into installing trojanised software. Second, UEFI Secure Boot, an industry-wide standard that creates a chain of trust to prevent attackers from replacing the intended bootup firmware with malicious firmware, uses cryptographic signatures to ensure that each piece of software used during startup is trusted by a computer’s manufacturer. While Secure Boot vulnerabilities have been found in the past, there has been no indication that threat actors have ever been able to bypass the protection in the 12 years it has been in existence, until now.
To bypass Secure Boot, BlackLotus exploits CVE-2022-21894, a vulnerability in all supported versions of Windows that Microsoft patched in January 2022. The logic flaw can be exploited to remove Secure Boot functions from the boot sequence during startup, and attackers can also use the flaw to obtain keys for BitLocker, a Windows feature for encrypting hard drives. Despite Microsoft releasing new patched software, the vulnerable signed binaries have yet to be added to the UEFI revocation list that flags boot files that should no longer be trusted. If those signed binaries are revoked, millions of devices will no longer work, so fully updated devices remain vulnerable because attackers can simply replace patched software with the older, vulnerable software.
As BlackLotus first requires that threat actors gain administrator rights through existing vulnerabilities or attack methods, this latest vulnerability can already be stopped by using One2Call’s Endpoint Detection and Response Cyber Security Service to monitor for vulnerabilities, unusual activities and more. Stopping attacks before they can happen.
Latest News Stories
Minnesota Department of Education Falls Victim to MOVEit Data Breach
The Minnesota Department of Education (MDE) disclosed on Friday that it has been targeted in an extensive data breach which has been linked to the recent MOVEit Cyber Security Attack (read our news article), resulting in the hacking of certain departmental files. On...
“My Business has been Hacked, What do I do?”
In an era of increasing and ever evolving cyber crime, the experience of Karim Toubba, CEO of LastPass US LP, serves as a stark reminder of the reality of modern business. LastPass, a company that offers password storage and management, was which initially announced...
UPDATED June 26th, 2023: University of Manchester Targeted in Major Cyber Security Incident
Updated 26/06/2023: After Students and Saff of The University of Manchester received emails last week claiming to be from the attackers, stating that more than 7 Terabytes of data had been stolen in the attack, the university released a statement on Friday (June 23rd)...
Our Customers
Testimonials
Julia Wallace-Ross, Cornerstones Education
So grateful for Jordan coming out so quickly and helping me out.
John Cardy, Farmstar
Ryan was very helpful, I felt that I had wasted his time but he was very understanding.
Dawn Brown, V & P Solutions
Fast, efficient service – problem was quickly resolved.