Did you manually update your Secure Boot Keys ?

garlin · Jul 2, 2025

MS would have normally started the cycle to replace CA 2011 around this time (regardless of Black Lotus), with the only difference being they wouldn't have to ban CA 2011 as untrustworthy. They could have rolled out CA 2023 in parallel with CA 2011 with no disruption.

You're conflating two different objectives into the same process. MS expected the original "the sky is falling" mitigation plan to have completed by now, which would have incidentally taken care of the long anticipated CA 2011 rollover. If it wasn't for the DBX part, CA 2023 could have been silently pushed to everyone's PC without fuss.

Because stopping Black Lotus, which is being sold on underground hacker markets, is higher importance right now.

garlin · Jul 2, 2025

Marcus Vinicus said:
I do have a specific question about this. I've been trying to find hard core accurate information about after making the changes to UEFI and Secure Boot et al. has the process of creating installable media via USB for Windows 11 24H2 changed. That is using tools such as Rufus and/or Microsoft's Media Creation Tool (MCT).

Please post useful web links if relevant.

There's two sets of boot files, each signed by CA 2011 and CA 2023, because Windows doesn't know out of the box where your UEFI is.

Rufus has been aware of this issue for the past year, and will actively warn you if the boot file provided on the ISO image is CA 2011. Of course, it doesn't know either if that's the right version or not. Your PC could possibly only trust CA 2011, trust both CA 2011 & 2023, or only trust 2023.

UUP dump has the ConvertConfig.ini option "UpdtBootFiles=1" to use the boot file provided by applying the later Windows Updates (any time past July 2024), or the base file provided in the original ISO (UpdtBootFiles=0).

After you've switched over to CA 2023, your imaging process must follow one of two rules:
1. Strictly use an ISO (or MCT image) created after July 2024, or patched to recent.

2. Retrofit an obsolete ISO by replacing the boot files. Now MS being MS won't support EOL'ed OS, so they won't provide you a script. But it's basically copying two EFI files out of a patched 24H2 system or install image to the ISO, and the boot & install WIM/ESD.

Technically the boot files will change over time, as bugs or security holes are fixed. But all of them will be exclusively signed CA 2023 in the near future, which means you can't boot them on non-updated UEFI unless Secure Boot is disabled.

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

Marcus Vinicus · Jul 3, 2025

Thanks for helpful post @garlin

When I've got some time over the next couple of days (tied up completing a clean install of Windows 11 on one of my computers) I'm going to create some new boot USB's and test stuff out. There are commands listed in that MS webpage you mention under the bootable media section.

COPY D:\EFI\MICROSOFT\BOOT\BCD D:\EFI\MICROSOFT\BOOT\BCD.BAK

bcdboot c:\windows /f UEFI /s D: /bootex

COPY D:\EFI\MICROSOFT\BOOT\BCD.BAK D:\EFI\MICROSOFT\BOOT\BCD

garlin · Jul 3, 2025

Forgot someone at MS wrote a PowerShell script:
Updating Windows bootable media to use the PCA2023 signed boot manager - Microsoft Support

This script expects you to have the Windows ADK installed. But in reality, it only wants ADK to run oscdimg.exe (which creates an ISO file). Someone's posted a GitHub repo with older copies of oscdimg.exe. For the purposes of what the script is doing, it really doesn't matter it's not the latest version.

GitHub - hydrz/oscdimg: Oscdimg is a command-line tool part of the Windows Assessment and Deployment Kit (ADK)

Just drop a copy of oscdimg.exe in the same folder as the PS script.

Marcus Vinicus · Jul 3, 2025

I asked copilot (in deep thinking mode) about this but it didn't come up with any additional information and resources.

garlin · Jul 3, 2025

Marcus Vinicus said:
I asked copilot (in deep thinking mode) about this but it didn't come up with any additional information and resources.

This reminds me of the parable/Victorian poem of the Six Blind Men and the Elephant. AI's great on fine details, but terrible on the big picture.

Marcus Vinicus · Jul 3, 2025

It repeated the same info we already have.

garlin · Jul 3, 2025

"Even a blind squirrel finds a nut once in a while".

hsehestedt · Jul 3, 2025

I wrote a big long article on this whole topic of BlackLotus (see link below) but it has been over a year now and I'm sure that some things have changed.

I appreciate this post because it reminds me that I need to get after this to update the article and review he current state of the issue.

I have to admit, however, that after Microsoft missed their own deadlines several times on this issue, I rather lost interest in the whole thing. But at the very least, my article might serve as a reference to the related KBs and info from Microsoft for now.

Performing Mitigations for BlackLotus UEFI Bootkit

Please note that this is my first attempt at an article with all the BBcode formatting. Any constructive critisism is welcome. At the same time, I would appreciate it if you could bear in mind that this is a first attempt! This is the initial release of this document, released on May 3, 2024...

www.elevenforum.com

XxXxX · Jul 3, 2025

hsehestedt said:
I wrote a big long article on this whole topic of BlackLotus (see link below) but it has been over a year now and I'm sure that some things have changed.

I appreciate this post because it reminds me that I need to get after this to update the article and review he current state of the issue.

I have to admit, however, that after Microsoft missed their own deadlines several times on this issue, I rather lost interest in the whole thing. But at the very least, my article might serve as a reference to the related KBs and info from Microsoft for now.

Performing Mitigations for BlackLotus UEFI Bootkit

Please note that this is my first attempt at an article with all the BBcode formatting. Any constructive critisism is welcome. At the same time, I would appreciate it if you could bear in mind that this is a first attempt! This is the initial release of this document, released on May 3, 2024...

www.elevenforum.com

this maybe of interest to you and could lead you in directions that you may not have yet considered
in regard to the UFEI, secure boot and DBX files in relation to blacklotus and especially in relation to access to files for the boot process.

Is Red Hat Enterprise Linux vulnerable to the BlackLotus UEFI bootkit? - Red Hat Customer Portal

This article discusses boot failure and the validation process.

access.redhat.com

it also has links to some very interesting research.
best of luck, Steve ..

gunrunnerjohn · Jul 3, 2025

Levitate11 said:
My point is that MS has known this was an upcoming issue for a decade. Now, with a year left to go, they are finally working on it. Shameful, borderline negligent, and likely to result in many business and user difficulties.

While turning off secure boot is a possibility, I don't agree that that's a viable solution. My data security is just as important to me as a Corporation's is to it. In fact, the Corporation is much more likely to be able to absorb a hit than I am. On top of that, that average-user has no idea how to turn off Secure Boot - even if they knew they needed to do it.

MS should have gotten this rolling a long time ago.

You're kidding, right? Our government waits until the last day for decisions a lot more important than this one! :lmao:

It's human nature to wait until the 11th hour for stuff like this. I'd be shocked if it was handled any other way!

Levitate11 · Jul 3, 2025

garlin said:
This reminds me of the parable/Victorian poem of the Six Blind Men and the Elephant. AI's great on fine details, but terrible on the big picture.

Google's AI Assistant most always gives you its analysis these days.

Whenever I am very familiar with the subject area, I see errors, sometimes significant, in the analysis it provides. It's often close but maybe 95% correct. That leads me to believe that every answer it provides is likely only 95% correct... I just don't have enough familiarity with some subject areas to detect it.

Sometimes I go nerd-mode and report it with their handy Feedback section at the bottom of the AI response. Sometimes I don't. But sometimes when Wikipedia is wrong I fix that, and sometimes I don't. You have to decide how much nerd time you have available.

hsehestedt · Jul 3, 2025

I'm still in the "don't trust and verify" stage with AI. In particular, if I ask for tech info, it's a mixed bag for me. Sometimes I get something really insightful where I wonder why I didn't think of it, but other times I get completely made-up answers.

So, I'll ask AI, but it is considered guilty of misinformation until I prove by testing that the answers I got are correct.

But I will say this: Almost every single month I can see marked improvements. The rate of improvement is really amazing and that's what keeps me going back for more.

gunrunnerjohn · Jul 3, 2025

Yep, I don't trust AI yet, but as you way, it's improving almost every day. I'll like it when I can describe a problem and have it spit out working code to solve it.

Cameraman1955 · Jul 7, 2025

Please a little help, I mannually update the sucure boot key's and this go right, I have the "treu" verification after two boots.
But when I look in my Gigabyte bios I see only the new certeficate but not the KEK and PK ones, am I doing something wrong, or is this ok ?
I have the latest bios version on my Z390GX motherboard.

garlin · Jul 7, 2025

I would ask Gigabyte support for help. The process is supposed to install the KEK & PK keys, otherwise the new certs aren't authorized.

Cameraman1955 · Jul 8, 2025

garlin said:
I would ask Gigabyte support for help. The process is supposed to install the KEK & PK keys, otherwise the new certs aren't authorized.

Thanks yes I was thinking that too, I send the question to Gigabyte.

Cameraman1955 · Jul 8, 2025

Today there was a new bios update F12a for my Z390 motherbord, after install this all the new 2023 certificates are loaded in the KEK & PK, so I am safe and happy now

Cameraman1955 · Jul 9, 2025

I am now started to upgrade the certificates on my second computer my laptop, it goes well I have the "treu" after the check, only it is impossible to set the bios on this laptop to advanced I try everything, so I can't see if the certificates are in my bios, is there an other way to check this ?

garlin · Jul 9, 2025

Cameraman1955 said:
I am now started to upgrade the certificates on my second computer my laptop, it goes well I have the "treu" after the check, only it is impossible to set the bios on this laptop to advanced, so I can't see if the certificates are in my bios, is there an other way to check this ?

Here's a PowerShell script to report your current certs:
Did you manually update your Secure Boot Keys ?

Did you manually update your Secure Boot Keys ?

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Semper paratus

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Semper paratus

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Semper paratus

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computers

My Computer

My Computers

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer