BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
Summary
A new UEFI bootkit called BlackX has been identified, exploiting the Baton Drop vulnerability to bypass Secure Boot. This bootkit was used in an espionage campaign to load a malicious driver that interferes with security software like Kaspersky and Avast.
IFF Assessment
The discovery of a new UEFI bootkit that bypasses a critical security feature like Secure Boot is bad news for defenders as it represents a sophisticated and stealthy attack vector.
Severity
This bootkit's ability to bypass Secure Boot, a foundational security mechanism, and load malicious drivers without detection grants it significant privileges and persistence, making it highly exploitable and impactful.
Defender Context
This discovery highlights the persistent threat of UEFI bootkits and the importance of maintaining vigilance against advanced persistent threats that leverage older, but still effective, vulnerabilities. Defenders should be aware of the Baton Drop vulnerability and ensure systems are protected against such low-level attacks that can compromise the integrity of the boot process.