UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
ars ·
A new UEFI bootkit named BlackX has successfully infected fully patched Windows machines by exploiting a logic flaw known as 'Baton Drop.' This vulnerability, tracked as CVE-2022-21894, allows attackers to bypass Secure Boot protections and load malicious code before the operating system initializes. Although Microsoft patched the underlying issue in 2022, it delayed revoking trust in older digital certificates due to fears of rendering millions of devices unbootable. Consequently, systems remained vulnerable despite having installed subsequent security updates released in 2023 and 2024. Security researchers from Kaspersky discovered that Microsoft’s guidance for completing the mitigation process was buried deep within documentation and not clearly communicated to administrators. As a result, most IT professionals did not take the necessary manual steps to revoke the old certificate, leaving their networks exposed. The incident highlights a critical gap between patch availability and effective protection caused by ambiguous vendor instructions. This situation raises questions about whether Microsoft is partially to blame for the continued success of such sophisticated attacks.
ars