UEFI (Unified Extensible Firmware Interface) is the modern firmware standard that initialises a computer’s hardware and loads the operating system, replacing the legacy BIOS.
How UEFI works
UEFI grew out of Intel’s EFI and is maintained by the UEFI Forum. The firmware is stored in a flash chip on the motherboard. When the computer starts, it initialises the CPU, memory and devices, loads drivers and then starts a bootloader from the EFI System Partition on the disk. Compared with BIOS, UEFI supports large GPT disks, a graphical setup, network boot and, most importantly, Secure Boot: every component of the boot chain must be signed with a trusted key. Together with a TPM, the boot process can also be measured for later verification.
Why UEFI matters for security
Malware in UEFI starts before the operating system and its security tools, and can survive reinstalling Windows or replacing the hard drive. Known cases include:
- LoJax (2018) – the first UEFI rootkit found in the wild, attributed to APT28.
- MosaicRegressor (2020) and MoonBounce (2022) – firmware implants used in espionage campaigns.
- BlackLotus (2023) – a bootkit that bypassed Secure Boot on fully patched Windows 11 by exploiting CVE-2022-21894.
Implementation flaws also matter: LogoFAIL (2023) showed that image parsers in UEFI firmware could be exploited with a malicious boot logo, and PKfail (2024) revealed hundreds of device models shipping with untrusted test Secure Boot keys.
How to protect UEFI
- Enable Secure Boot and set a firmware setup password.
- Install UEFI/BIOS updates from the device vendor.
- Keep Windows’ Secure Boot revocation list (DBX) current.
- Use endpoint tools that can scan firmware and check its integrity.
