UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
UEFI bootkit感染了已完全打补丁的Windows机器。微软该负责吗？
UEFI bootkit BlackX exploits Microsoft's lack of clarity around Secure Boot protections.
一个名为BlackX的UEFI bootkit感染了已安装微软全部相关补丁的Windows设备，引发谁该负责的追问。文章先回顾BlackLotus与UEFI固件的工作机制，再讨论补丁为何未能阻止感染。
文章围绕一个反直觉的事实展开：补丁齐全的机器仍被bootkit攻破。阅读时可重点抓因果链——漏洞修补、证书更新、吊销信任三步各自解决什么、又留下什么缺口，这是理解全文的关键。术语密集（UEFI、Secure Boot、bootkit、证书吊销），适合练习在技术语境中定位定义句和同义替换，并辨别作者在“微软该不该负责”上的态度倾向。
In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. With the industry-wide chain-of-trust mechanism subverted, the malware was able to run malicious code before Windows was fully loaded and many security defenses were operational.
Microsoft had already patched the vulnerability that BlackLotus exploited in 2022. In 2023 and 2024, Microsoft issued additional updates. The first added a new certificate that no longer trusted the vulnerable boot managers. The second provided the means to revoke trust in the digital certificate used to sign older vulnerable Windows boot managers. The organizations infected by the new bootkit, which is tracked under the name BlackX, had installed all of these patches. So how did they fall victim?
UEFI bootkit refresher
Before discussing the incident further, a brief review of BlackLotus and UEFI malware is in order. Short for Unified Extensible Firmware Interface, UEFI is firmware that runs immediately after a computer is turned on. One of its main jobs is to load system configuration settings, identify and initialize hardware components, and prepare the computer to start its OS.
重点词汇
(8)
来源：Ars Technica · arstechnica.com