NSA: BlackLotus BootKit Patching Won't Prevent Compromise

The US National Security Agency (NSA) is urging systems administrators to go beyond patching in order to protect Windows 10 and 11 machines from the BlackLotus bootkit malware.

BlackLotus burst on the scene last fall when it was spotted for sale on the Dark Web for $5,000. It has the dubious distinction of being the first in-the-wild malware to successfully bypass to Microsoft's Unified Extensible Firmware Interface (UEFI) Secure Boot protections.

UEFI is the firmware that's responsible for the booting-up routine, so it loads before the operating system kernel and any other software. BlackLotus — a software, not a firmware threat, it should be noted — takes advantage of two vulnerabilities in the UEFI Secure Boot function to insert itself into the earliest phase of the software boot process initiated by UEFI: CVE-2022-21894, aka Baton Drop, CVSS score 4.4; and CVE-2023-24932, CVSS score 6.7. These were patched by Microsoft in January 2022 and May 2023 respectively.

But the country's top technology intelligence division warned that applying the available Windows 10 and Windows 11 patches is only a "a good first step."

"Patches were not issued to revoke trust in unpatched boot loaders via the Secure Boot Deny List Database (DBX)," according to a BlackLotus mitigation guide (PDF) released by the NSA this week. "Administrators should not consider the threat fully remediated as boot loaders vulnerable to Baton Drop are still trusted by Secure Boot."

That means that bad actors can simply replace fully patched boot loaders with legitimate but vulnerable versions in order to execute BlackLotus on compromised endpoints. It's an issue that Microsoft is addressing with a more comprehensive fix planned for release in early 2024, but until then, the NSA recommends that infrastructure owners take additional steps to harden their systems, such as tightening up user executable policies, and monitoring the integrity of the boot partition. An optional advanced mitigation is to customize the Secure Boot policy by adding DBX records to all Windows endpoints.

"Protecting systems against BlackLotus is not a simple fix," said NSA platform security analyst Zachary Blum, in the advisory.

And indeed, the advisory offers extensive hardening advice, but fully implementing the NSA's guidance is a process unto itself, notes John Gallagher, vice president of Viakoo Labs.

"Given the manual nature of NSA's guidance, many organizations will find that they don't have the resources needed to fully remediate this vulnerability. Additional measures like use of network access control and traffic analysis should also be used until Microsoft can provide a more complete fix," he says.

BlackLotus, A First-of-its-Kind Bootkit

Executing malware like BlackLotus does offer cyberattackers several significant advantages, including ensuring persistence even after OS reinstalls and hard drive replacements. And, because the bad code executes in kernel mode ahead of security software, it's undetectable by standard defenses like BitLocker and Windows Defender (and can indeed turn them off entirely). It also can control and subvert every other program on the machine and can load additional stealthy malware that will execute with root privileges.

"UEFI vulnerabilities, as the guidance from NSA shows, are particularly difficult to mitigate and remediate because they are in the earliest stage of software and hardware interactions," says Gallagher. "The guidance NSA is providing is critically important as a reminder to pay attention to boot-level vulnerabilities and have a method to address them."

It all sounds pretty dire — an assessment of which many systems administrators agree. But as the NSA noted, most security teams are confused about how to combat the danger that the bootkit poses.

"Some organizations use terms like 'unstoppable,' 'unkillable,' and 'unpatchable' to describe the threat," according to the NSA guidance. "Other organizations believe there is no threat, due to patches that Microsoft released in January 2022 and early 2023 for supported versions of Windows. The risk exists somewhere between both extremes."

The NSA didn't provide an explanation for why it's issuing the guidance now — i.e., it didn't issue information about recent mass exploitation efforts or in-the-wild incidents. But John Bambenek, principal threat hunter at Netenrich, notes that the NSA piping up at all should indicate that BlackLotus is a threat that requires attention.

"Whenever the NSA releases a tool or guidance, the most important information is what they aren't saying," he says. "They took the time and effort to develop this tool, declassify it, and release it. They will never say why, but the reason was worth a significant diversion from how they usually operate by saying nothing."