Discovering the legendary BlackLotus bootkit

[ad_1]

ESET Analysis

Here is a narrative of how an evaluation of a supposed sport cheat changed into the invention of a strong UEFI risk

12 Jul 2023
 • 
,
1 min. learn

In the direction of the top of 2022 an unknown risk actor boasted on an underground discussion board that they’d created a brand new and highly effective UEFI bootkit known as BlackLotus. Its most distinctive function? It may bypass UEFI Safe Boot – a function constructed into all fashionable computer systems to forestall them from working unauthorized software program.

What at first appeared like a fable – particularly on a totally up to date Home windows 11 system – has changed into actuality a couple of months later, when ESET researchers discovered a pattern that completely matched this major function in addition to all different attributes of the marketed bootkit.

On this episode of ESET Analysis podcast, ESET Distinguished Researcher and host of this podcast Aryeh Goretsky talks to ESET Malware Researcher Martin Smolár about how he found the risk and what the principle findings of his evaluation have been.

Within the dialogue, Martin reveals that he initially thought of the BlackLotus pattern to be a sport cheat and describes the second when he realized that he had discovered one thing far more harmful. To keep away from a standard false impression, Martin additionally explains the distinction between malicious UEFI firmware implants and threats that “solely” goal the EFI partition. To make the data actionable for our listeners, the ultimate a part of the dialogue explores the prevention and mitigation of UEFI assaults.

For extra particulars corresponding to who is likely to be affected by BlackLotus or how a risk actor would possibly receive the bootkit, take heed to the entire episode of ESET Analysis podcast on Spotify, Google Podcasts, Apple Podcasts, or PodBean. And in case you like what you hear, subscribe for extra.

[ad_2]

Supply hyperlink