2023 年，被追踪为 BlackLotus 的恶意软件成为首个公开记录的在野 UEFI bootkit，能够在完全更新的 Windows 11 系统上绕过安全启动。随着全行业信任链机制被颠覆，该恶意软件得以在 Windows 完全加载、许多安全防御开始运行之前运行恶意代码。
In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. With the industry-wide chain-of-trust mechanism subverted, the malware was able to run malicious code before Windows was fully loaded and many security defenses were operational.
微软已在 2022 年修补了 BlackLotus 利用的漏洞。2023 年和 2024 年，微软发布了额外更新。第一个更新添加了一个不再信任易受攻击的启动管理器的新证书。第二个更新提供了撤销对用于签名旧版易受攻击的 Windows 启动管理器的数字证书信任的方法。感染了名为 BlackX 的新 bootkit 的组织已安装了所有这些补丁。那么它们为何会受害？
Microsoft had already patched the vulnerability that BlackLotus exploited in 2022. In 2023 and 2024, Microsoft issued additional updates. The first added a new certificate that no longer trusted the vulnerable boot managers. The second provided the means to revoke trust in the digital certificate used to sign older vulnerable Windows boot managers. The organizations infected by the new bootkit, which is tracked under the name BlackX, had installed all of these patches. So how did they fall victim?
在进一步讨论该事件之前，有必要简要回顾 BlackLotus 和 UEFI 恶意软件。UEFI 是 Unified Extensible Firmware Interface 的缩写，是计算机开机后立即运行的固件。其主要工作之一是加载系统配置设置、识别并初始化硬件组件，并准备计算机启动其操作系统。
Before discussing the incident further, a brief review of BlackLotus and UEFI malware is in order. Short for Unified Extensible Firmware Interface, UEFI is firmware that runs immediately after a computer is turned on. One of its main jobs is to load system configuration settings, identify and initialize hardware components, and prepare the computer to start its OS.