BlackX Vulnerability: How did malware breach fully updated Windows devices?
Many organizations have been subjected to security breaches by a new malware known as BlackX, a UEFI bootkit that managed to bypass the "Secure Boot" feature in Windows 11 systems despite them being fully updated. This incident raises fundamental questions about Microsoft's strategy for managing complex security updates.
What is the nature of the threat?
BlackX operates in the same manner as the BlackLotus program that appeared in 2023, exploiting a logic vulnerability in the Windows Boot Manager known as "Baton Drop" (registered as CVE-2022-21894). The danger of this malware lies in the fact that it executes at a very early stage of the device boot process, allowing it to load malicious drivers into the operating system kernel before most security defenses begin to function. It is also characterized by persistence and difficulty in detection.
Why did the updates fail to provide protection?
Although Microsoft released updates to address this vulnerability in 2022, the protection was not fully automatic. Researchers from Kaspersky explained that the updates released by Microsoft in 2023 and 2024 did not automatically revoke trust in old digital certificates, for fear of causing millions of devices to fail to boot.
Instead, Microsoft left the responsibility of taking additional manual steps to system administrators to enable full protection, instructions that researchers described as "buried" in technical support documentation and difficult for average IT administrators to notice or implement.
What does this mean for users?
This incident highlights the gap between the release of a security patch and its actual implementation. While organizations believe they are protected once periodic updates are installed, protection against UEFI vulnerabilities requires additional manual procedures that are not clearly advertised. Experts believe that attackers have exploited this ambiguity, realizing that few organizations implement the required manual protection measures, making the cloning of BlackLotus techniques and the development of BlackX a successful investment for hackers.
To date, Microsoft has not provided an explicit warning to users that current updates alone do not provide full protection against "Baton Drop" attacks, leaving system administrators in a state of uncertainty about how to definitively secure their devices.