UEFI Bootkits and Where UEFI Security Fails
summary
BlackLotus bypasses Secure Boot on fully updated Windows by exploiting a year-old bootloader vulnerability plus missing revocations, with proof‑of‑concept installers appearing within weeks of the public exploit and revocation timelines taking months to years; researchers also find signed GRUBs, OEM-signed shells and manufacturing “SecureBackDoor” drivers that allow trivial Disable-SecureBoot actions. Recommended defenses: EFI partition access control, partial Secure Boot customization, and OS reinstalls or EFI-only restores to remove bootkits.
AI-written summary · about
chapters (13)
- 0:00UEFI bootkits threat
- 4:40ESET UEFI research
- 6:05UEFI bootkits basics
- 8:55Execution during boot
- 11:30BlackLotus bypasses Secure Boot
- 15:54Secure Boot flaws
- 20:42Secure Boot failures
- 27:43UEFI vulnerabilities
- 29:59Protecting systems
- 33:42Customizing Secure Boot
- 37:05Removing bootkits
- 38:09Key takeaways
- 40:15Q&A
related talks
28mBOOTKITTY: Multi-OS Trust Chain compromise from Bootkit to Rootkit
27mBreaking the Chain of Trust
45mESPecter: Showing the Future of UEFI Threats
01h 04mAnalyzing UEFI BIOSes from Attacker & Defender Viewpoints
17mBOOTKITTY: A Stealthy Bootkit-Rootkit Against Modern Operating Systems
47mExposing Bootkits with BIOS Emulation
44mLogoFAIL: Security Implications of Image Parsing During System Boot
57mExtreme Privilege Escalation on Windows 8/UEFI Systems