UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
UEFI bootkit感染了已完全打補丁的Windows機器。微軟該負責嗎？
UEFI bootkit BlackX exploits Microsoft's lack of clarity around Secure Boot protections.
一個名為BlackX的UEFI bootkit感染了已安裝微軟全部相關補丁的Windows設備，引發誰該負責的追問。文章先回顧BlackLotus與UEFI固件的工作機制，再討論補丁為何未能阻止感染。
文章圍繞一個反直覺的事實展開：補丁齊全的機器仍被bootkit攻破。閱讀時可重點抓因果鏈——漏洞修補、證書更新、吊銷信任三步各自解決什麼、又留下什麼缺口，這是理解全文的關鍵。術語密集（UEFI、Secure Boot、bootkit、證書吊銷），適合練習在技術語境中定位定義句和同義替換，並辨別作者在“微軟該不該負責”上的態度傾向。
In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. With the industry-wide chain-of-trust mechanism subverted, the malware was able to run malicious code before Windows was fully loaded and many security defenses were operational.
Microsoft had already patched the vulnerability that BlackLotus exploited in 2022. In 2023 and 2024, Microsoft issued additional updates. The first added a new certificate that no longer trusted the vulnerable boot managers. The second provided the means to revoke trust in the digital certificate used to sign older vulnerable Windows boot managers. The organizations infected by the new bootkit, which is tracked under the name BlackX, had installed all of these patches. So how did they fall victim?
UEFI bootkit refresher
Before discussing the incident further, a brief review of BlackLotus and UEFI malware is in order. Short for Unified Extensible Firmware Interface, UEFI is firmware that runs immediately after a computer is turned on. One of its main jobs is to load system configuration settings, identify and initialize hardware components, and prepare the computer to start its OS.
重點詞彙
(8)
來源：Ars Technica · arstechnica.com