BlackLotus UEFI bootkit fix by Microsoft

petero

Hi. What will happen to the USB recovery drive and the images created  before this fix after the fix will be implemented. I know that disabling secure boot is a temporary fix for now. Will the creation of the recovery drive be updated in good time and will the recovered images boot?

aiArtisan

Petero, thank you for bringing this to our attention. Could you please describe what this fix is?

petero

Hello AiArtisan. This is what I've seen about it. It will be fully implemented in the first quarter of 2024. (Three stages total). So hopefully Win PE will have an update prior to this so we will have to create a new recovery USB. We should also create new images after. This is just what I can make out.

KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

aiArtisan

https://www.bleepingcomputer.com/news/security/microsoft-shares-guidance-to-detect-blacklotus-uefi-bootkit-attacks/

admin

@Petero, Sorry that we don't quite understand your question. Could you explain it further?

petero

Wondering if you will update the recovery drive creation to accommodate it booting before the  2024 implementation of the final fix, otherwise the recovery drive won't boot unless secure boot is disabled. I think that the images made prior to the fix also won't boot after restore? That's my understanding of it. 

Thanks. 

aiArtisan

Thank you Petero, I believe you. Please reply with the link to the article where you read that, so Aomei can do what you are asking.

petero

Hi, already posted the link,

KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

Looks like Microsoft will update Windows PE so we will need to create a new bootable recovery drive. Would like to know if we will be notified of this (knowing me i'd forget) and when we need to create a new one. Thanks.

aiArtisan

Petero, I was hoping for a different kind of article. That is a 15 page article that you had already posted. I had already read that, in addition to several media articles about that issue. It's ok, there will be more announcements about this issue on the web, and I very much appreciate your service to us all in posting this, I did not know about it. Please continue to post about other important issues in Forums! Have a good day.

admin

@Petero, We will submit the situation to our dev team.

petero

Just a note, I'm also testing out another imaging program (AEOMI is my prefered though) and that software has already updated its RE version.
Will consider this solved,
Thank you.