Bonum Certa Men Certa

UEFI 'Security' is Totally Hopeless, Even a Paradox

BlackLotus UEFI Bootkit Source Code Leaked on GitHub
Like 'pwning' Microsoft on a Microsoft/NSA platform



Summary: The pseudo-security industry (bug doors, imperialism/national security in 'security' clothing) is losing the argument; grown-ups have meanwhile classified UEFI 'secure' boot as a laughing stock and its proponents as Microsoft trolls

THE people who promote fake security just 'happen' to be the loudest and most aggressive Internet (or IRC) trolls, constantly looking to defame, threaten, blackmail, and maybe even dox both my wife and I.



They keep losing the argument, they even half-admit that (in their blogs), but somehow it's us who are the problem?

It has been nearly a year since we last wrote about UEFI 'secure' boot, i.e. outsourcing to Microsoft portrayed as some kind of Buffy-on-steroids of security. But it's back in the news [1] because of another black eye. As a reminder, there's no real solution to this [2-4]. Just reject fake security. Reject Microsoft and its Munchkins [1, 2, 3].

Related/contextual items from the news:


  1. BlackLotus UEFI Bootkit Source Code Leaked on GitHub

    The source code for the BlackLotus UEFI bootkit has been leaked on GitHub and an expert has issued a warning over the risks.



  2. NSA: BlackLotus BootKit Patching Won't Prevent Compromise

    BlackLotus burst on the scene last fall when it was spotted for sale on the Dark Web for $5,000. It has the dubious distinction of being the first in-the-wild malware to successfully bypass to Microsoft's Unified Extensible Firmware Interface (UEFI) Secure Boot protections.

    UEFI is the firmware that's responsible for the booting-up routine, so it loads before the operating system kernel and any other software. BlackLotus — a software, not a firmware threat, it should be noted — takes advantage of two vulnerabilities in the UEFI Secure Boot function to insert itself into the earliest phase of the software boot process initiated by UEFI: CVE-2022-21894, aka Baton Drop, CVSS score 4.4; and CVE-2023-24932, CVSS score 6.7. These were patched by Microsoft in January 2022 and May 2023 respectively.

    But the country's top technology intelligence division warned that applying the available Windows 10 and Windows 11 patches is only a "a good first step."



  3. Microsoft’s bootkit patches offer ‘false sense of security’ against BlackLotus threat, NSA says

    BlackLotus targets Windows boot by exploiting a flaw in older boot loaders, or boot managers, to set off a chain of malicious actions that compromise endpoint security. This is achieved by exploiting the Baton Drop vulnerability to strip the Secure Boot policy and prevent its enforcement.

    BlackLotus shares some characteristics with Boot Hole, a vulnerability discovered in 2020. Unlike Boot Hole, however, BlackLotus targets vulnerable boot loaders that have not been added to the Secure Boot Deny List Database (DBX) revocation list.



  4. To kill BlackLotus malware, patching is a good start, but...

    Then, in research published in March, ESET malware analyst Martin Smolár confirmed the myth of an in-the-wild bootkit bypassing Secure Boot "is now a reality," as opposed to hypothetical threats raised by some experts and the usual slew of fake bootkits criminals attempted to trick fellow miscreants into buying.

    No Linux-targeting variant of the malware has been observed; BlackLotus strictly nobbles Microsoft Windows machines.



Recent Techrights' Posts

A Year Ago, Only a Few Weeks After We Countersued the 'Hulk Hogan of UEFI', Our Webhost Came Under Attack
At the end of September 2024 our webhost received several threats
The Register - Kissing the hand that feeds it
hired to manage the publication several people connected to Microsoft, including the new Editor in Chief
Next Step: Find Out Who's Funding the 'Hulk Hogan of UEFI' to SLAPP Us
We now have the 'Hulk Hogan of UEFI' working alongside a strangler of women, who as a Microsoft employee spent time in prison for it
Web Sites That Are Independent Are Also Like Software Projects (Sometimes Literally So)
Roll out your own 'stack'
 
Links 28/09/2025: Moldova Elections, LLM Slop Failing Again to Accomplish Anything
Links for the day
Links 28/09/2025: Slop Does More Harm, Newly Released Epstein Estate Documents
Links for the day
Links 28/09/2025: Fentanylware (TikTok) 'Going Private' (the Dictator's Media Allies) and UK Mirror Lays Off More Journalists
Links for the day
If Only Someone Warned Us About This...
Ubuntu is committing suicide with Rusty code
The Myths of "Linux" and of "Intelligence"
As noted this morning
People Remembered GNU's Birthday (Which Helps Remind People It All Started in 1983, Not 1991)
Have the FSF and GNU earned the respect they deserve?
Slopwatch: Ponzi Schemes Promoted by Media Companies, Linux Journal Turning Its 30-Year Reputation to Dust, and Serial Slopper Brian Fagioli Plagiarising, As Usual
This bubble will end up very badly
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, September 27, 2025
IRC logs for Saturday, September 27, 2025
Links 27/09/2025: Squashing Software Patents and When Hospitals Become For-Profit
Links for the day
Gemini Links 27/09/2025: Young Feet and Online Bots
Links for the day
GNU Project Turns 42
In 2033 it'll be 50
Pieter Hintjens on Codes of Misconduct a Decade Ago
original is still online
Links 27/09/2025: Australia Might Ban Microsoft GitHub for Young People, Likely Illegal Executive Order Turns TikTok Into Cheeto Propaganda
Links for the day
Repeating the Lies to Promote a Ponzi Scheme is Not OK Because "Many Other Sites Do This" (Including Slopfarms)
They already work on the next Ponzi scheme
The Register MS (Situation Publishing) is Participating in a Ponzi Scheme
The market in "tech" seems awful when a lot of it sells a fraud and journalism about this market is part of the fraud
Glimmer of Hope: More People Realise and Come to Accept "AI" is Just a Giant, Elaborate Ponzi/Pyramid Scheme That Will Leave Everyone Worse Off (Except the "Top of the Pyramid")
quoting Einhorn and some comments
Mass Layoffs in Starbucks... and Society Loses Nothing of Value
Society might even be better off if Starbucks shuts down entirely
Do Your Job and Demand Your Compensation - But in That Order.
We'll do our best to convince the Judge to award all costs to us (lawyers, barrister, LIP bills etc.) plus judgements against them, for abusive litigation and needless suffering associated with that abuse
Matthew J. Garrett Behaved in a Similar Fashion to 4Chan and Kiwi Farms
Opposites attract? Are they opposites at all?
Drew DeVault Suggests "CoC Enhancement", Starts Trolling Projects in Microsoft GitHub
And it backfires immediately
Like Nazi Germany and Volkswagen
Tell us all about "freedom" when your government runs a Ponzi scheme
Microsoft Sponsored This Man, Microsoft Sponsored His Behaviour (and He Controls Microsoft)
They get what they paid for
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, September 26, 2025
IRC logs for Friday, September 26, 2025
He Talks Too Much, He Says Dumb Things
only British when that suits him
Slopwatch: FUD and Plagiarism (Working Against Linux) Promoted and Rewarded by Google News
Shame on Google News
Reminder: We're Unloading Some Publications to Tux Machines
About 15 years ago I was struggling to keep up with TechDirt
The E-mail Protocol is for Text
bad netiquette
Gemini Links 26/09/2025: Slop in OpenStreetMap and MOPML (My Own Private Markup Language)
Links for the day
Links 26/09/2025: More Provocations Against NATO by Russia (Near Alaska, USA), Microsoft Booster Accenture Has Mass Layoffs
Links for the day
Links 26/09/2025: Hardware, Security, Health, and Nuclear Armament
Links for the day
Links 26/09/2025: "Digital Fatigue" and Slop Frenzy (Hype) Ruining Work Productivity, Culture, Languages
Links for the day
Brett Wilson LLP Unwilling to Disclose or Explain How 'Hulk Hogan of UEFI' Pays for His SLAPPs Against Us (He Cannot Afford These), So We Are Escalating
Escalated in the British authorities
What 'Hulk Hogan of UEFI' Could Learn From Jimmy Kimmel About the 'Streisand Effect'
Lawyering up is risky and is usually doesn't work
Linux is Replacing Apple
Apple is money down the drain. Not only are the gadgets overpriced; they cost a lot to maintain and keep going over time
"We don't have that kind of relationship with Microsoft. The only public key that every UEFI firmware is guaranteed to have is Microsoft's, and only Microsoft owns the private key."
This is how to sabotage GNU/Linux distros that Microsoft does not control
Slopwatch: linuxconfig.org, linuxsecurity.com, and Google's Promotion of the Worst and Most Prolific Slopfarms
Over in Google News it has been quite chaotic this past day
Gemini Links 26/09/2025: Reading RSS Feeds, ROOPHLOCH 202
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, September 25, 2025
IRC logs for Thursday, September 25, 2025