UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
Summary
Security researchers discovered a sophisticated UEFI bootkit capable of bypassing the Secure Boot defenses on fully updated Windows systems. The malicious software successfully executes before the operating system finishes loading and activates core security protections. This incident raises questions regarding accountability within the software industry and Microsoft's role in the security failure.
In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. With the industry-wide chain-of-trust mechanism subverted, the malware was able to run malicious code before Windows was fully loaded and many security defenses were operational. Microsoft had already patched the vulnerability that BlackLotus exploited in…
Source: Read the full story at Ars Technica - All content