Did you manually update your Secure Boot Keys ?

MS would have normally started the cycle to replace CA 2011 around this time (regardless of Black Lotus), with the only difference being they wouldn't have to ban CA 2011 as untrustworthy. They could have rolled out CA 2023 in parallel with CA 2011 with no disruption.

You're conflating two different objectives into the same process. MS expected the original "the sky is falling" mitigation plan to have completed by now, which would have incidentally taken care of the long anticipated CA 2011 rollover. If it wasn't for the DBX part, CA 2023 could have been silently pushed to everyone's PC without fuss.

Because stopping Black Lotus, which is being sold on underground hacker markets, is higher importance right now.

Marcus Vinicus said:

I do have a specific question about this. I've been trying to find hard core accurate information about after making the changes to UEFI and Secure Boot et al. has the process of creating installable media via USB for Windows 11 24H2 changed. That is using tools such as Rufus and/or Microsoft's Media Creation Tool (MCT).

Please post useful web links if relevant.

Click to expand...

There's two sets of boot files, each signed by CA 2011 and CA 2023, because Windows doesn't know out of the box where your UEFI is.

Rufus has been aware of this issue for the past year, and will actively warn you if the boot file provided on the ISO image is CA 2011. Of course, it doesn't know either if that's the right version or not. Your PC could possibly only trust CA 2011, trust both CA 2011 & 2023, or only trust 2023.

UUP dump has the ConvertConfig.ini option "UpdtBootFiles=1" to use the boot file provided by applying the later Windows Updates (any time past July 2024), or the base file provided in the original ISO (UpdtBootFiles=0).

After you've switched over to CA 2023, your imaging process must follow one of two rules:
1. Strictly use an ISO (or MCT image) created after July 2024, or patched to recent.

2. Retrofit an obsolete ISO by replacing the boot files. Now MS being MS won't support EOL'ed OS, so they won't provide you a script. But it's basically copying two EFI files out of a patched 24H2 system or install image to the ISO, and the boot & install WIM/ESD.

Technically the boot files will change over time, as bugs or security holes are fixed. But all of them will be exclusively signed CA 2023 in the near future, which means you can't boot them on non-updated UEFI unless Secure Boot is disabled.

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

Thanks for helpful post @garlin

When I've got some time over the next couple of days (tied up completing a clean install of Windows 11 on one of my computers) I'm going to create some new boot USB's and test stuff out. There are commands listed in that MS webpage you mention under the bootable media section.

COPY D:\EFI\MICROSOFT\BOOT\BCD D:\EFI\MICROSOFT\BOOT\BCD.BAK

bcdboot c:\windows /f UEFI /s D: /bootex

COPY D:\EFI\MICROSOFT\BOOT\BCD.BAK D:\EFI\MICROSOFT\BOOT\BCD

Click to expand...

Forgot someone at MS wrote a PowerShell script:
Updating Windows bootable media to use the PCA2023 signed boot manager - Microsoft Support

This script expects you to have the Windows ADK installed. But in reality, it only wants ADK to run oscdimg.exe (which creates an ISO file). Someone's posted a GitHub repo with older copies of oscdimg.exe. For the purposes of what the script is doing, it really doesn't matter it's not the latest version.

GitHub - hydrz/oscdimg: Oscdimg is a command-line tool part of the Windows Assessment and Deployment Kit (ADK)

Just drop a copy of oscdimg.exe in the same folder as the PS script.

I asked copilot (in deep thinking mode) about this but it didn't come up with any additional information and resources.

Marcus Vinicus said:

I asked copilot (in deep thinking mode) about this but it didn't come up with any additional information and resources.

Click to expand...

This reminds me of the parable/Victorian poem of the Six Blind Men and the Elephant. AI's great on fine details, but terrible on the big picture.

It repeated the same info we already have.

"Even a blind squirrel finds a nut once in a while".

I wrote a big long article on this whole topic of BlackLotus (see link below) but it has been over a year now and I'm sure that some things have changed.

I appreciate this post because it reminds me that I need to get after this to update the article and review he current state of the issue.

I have to admit, however, that after Microsoft missed their own deadlines several times on this issue, I rather lost interest in the whole thing. But at the very least, my article might serve as a reference to the related KBs and info from Microsoft for now.

hsehestedt said:

I wrote a big long article on this whole topic of BlackLotus (see link below) but it has been over a year now and I'm sure that some things have changed.

I appreciate this post because it reminds me that I need to get after this to update the article and review he current state of the issue.

I have to admit, however, that after Microsoft missed their own deadlines several times on this issue, I rather lost interest in the whole thing. But at the very least, my article might serve as a reference to the related KBs and info from Microsoft for now.

Performing Mitigations for BlackLotus UEFI Bootkit

Please note that this is my first attempt at an article with all the BBcode formatting. Any constructive critisism is welcome. At the same time, I would appreciate it if you could bear in mind that this is a first attempt! This is the initial release of this document, released on May 3, 2024...

www.elevenforum.com

Click to expand...

this maybe of interest to you and could lead you in directions that you may not have yet considered
in regard to the UFEI, secure boot and DBX files in relation to blacklotus and especially in relation to access to files for the boot process.

it also has links to some very interesting research.
best of luck, Steve ..

Levitate11 said:

My point is that MS has known this was an upcoming issue for a decade. Now, with a year left to go, they are finally working on it. Shameful, borderline negligent, and likely to result in many business and user difficulties.

While turning off secure boot is a possibility, I don't agree that that's a viable solution. My data security is just as important to me as a Corporation's is to it. In fact, the Corporation is much more likely to be able to absorb a hit than I am. On top of that, that average-user has no idea how to turn off Secure Boot - even if they knew they needed to do it.

MS should have gotten this rolling a long time ago.

Click to expand...

You're kidding, right? Our government waits until the last day for decisions a lot more important than this one! It's human nature to wait until the 11th hour for stuff like this. I'd be shocked if it was handled any other way!

garlin said:

This reminds me of the parable/Victorian poem of the Six Blind Men and the Elephant. AI's great on fine details, but terrible on the big picture.

Click to expand...

Google's AI Assistant most always gives you its analysis these days.

Whenever I am very familiar with the subject area, I see errors, sometimes significant, in the analysis it provides. It's often close but maybe 95% correct. That leads me to believe that every answer it provides is likely only 95% correct... I just don't have enough familiarity with some subject areas to detect it.

Sometimes I go nerd-mode and report it with their handy Feedback section at the bottom of the AI response. Sometimes I don't. But sometimes when Wikipedia is wrong I fix that, and sometimes I don't. You have to decide how much nerd time you have available.

I'm still in the "don't trust and verify" stage with AI. In particular, if I ask for tech info, it's a mixed bag for me. Sometimes I get something really insightful where I wonder why I didn't think of it, but other times I get completely made-up answers.

So, I'll ask AI, but it is considered guilty of misinformation until I prove by testing that the answers I got are correct.

But I will say this: Almost every single month I can see marked improvements. The rate of improvement is really amazing and that's what keeps me going back for more.

Yep, I don't trust AI yet, but as you way, it's improving almost every day. I'll like it when I can describe a problem and have it spit out working code to solve it.