YellowKey Bitlocker Bypass Vulnerability (opens in new tab)

(github.com)

87 pointsentuno1mo ago20 comments

20 comments

16 comments · 5 top-level

msuser1mo ago· 7 in thread

How is this a backdoor if one of the steps is to reboot the system while holding down SHIFT? To boot in the first place, the drive needs to be unlocked.

jamescrowley1mo ago

The EFI partition is unencrypted.

“you don't even need to plug an external storage device, you can just pull out the disk, copy the files in the EFI partition, put it back and it will still work. That's how bad it is.”

anonymars1mo ago

If you have physical access to plug in a flash drive, why would you need the drive unlocked to reboot into the recovery environment? Just power it off and trigger the boot options

fh671mo ago

Most users have it unlocked by TPM only as that is the default Microsoft configuration - you then reboot into windows recovery, yes if windows recovery is disabled or if bitlocker requires a startup pin then this is mitigated.

pajko1mo ago

"No, TPM+PIN does not help, the issue is still exploitable regardless, I asked myself this question, can it still work in a TPM+PIN environment ? Yes it does, I'm just not publishing the PoC, I think what's out there is already bad enough."

https://deadeclipse666.blogspot.com/2026/05/were-doing-silen...

biennvops1mo ago

Interesting. If TPM+PIN does not help, then what stands between Bitlocker and TPM unsealing the key?

msuser1mo ago

Point taken, but I would call this an authentication bypass (i.e. you can become administrator without any credentials) instead of a BitLocker bypass. It looks like at most, having BitLocker turned on is a requirement to trigger the bug/backdoor.

In any case I'd be very curious to read a response to these findings from someone at Microsoft.

e12e1mo ago

In addition to sibling comments, the author claims it also affects tpm+pin.

jllyhill1mo ago· 3 in thread

Does anyone know if the fix was shipped already? If it not a backdoor, of course.

pajko1mo ago

It does not matter. Who's gonna stop them adding a new backdoor in a later Windows Update(TM) ? T this point they are not to be trusted at all.

ChocolateGod1mo ago

Microsoft doesn't need a back door, they can literally sign a new bootchain with the same certificate and install them on your computer.

This is a bug / vulnerability, not a back door.

majorchord1mo ago

"Who's going to stop <any OS or app> from inserting a backdoor at some random point in the future? They are not to be trusted at all."

https://en.wikipedia.org/wiki/Slippery_slope

protimewaster1mo ago· 1 in thread

What's the data in the FsTx folder? Is it just some magic data that Windows looks for?

e12e1mo ago

Looks like it triggers a debug modus which in turn replay filesystem transactions from transaction logs?

https://infosec.exchange/@wdormann/116565129854382214

coopreme1mo ago

Seems like a backdoor.

1 more reply

rurban1mo ago

Just a little help for the fellow TSA and FBI folks

j / k navigate · click thread line to collapse

20 comments

16 comments · 5 top-level

msuser1mo ago· 7 in thread

How is this a backdoor if one of the steps is to reboot the system while holding down SHIFT? To boot in the first place, the drive needs to be unlocked.

jamescrowley1mo ago

The EFI partition is unencrypted.

“you don't even need to plug an external storage device, you can just pull out the disk, copy the files in the EFI partition, put it back and it will still work. That's how bad it is.”

anonymars1mo ago

If you have physical access to plug in a flash drive, why would you need the drive unlocked to reboot into the recovery environment? Just power it off and trigger the boot options

fh671mo ago

pajko1mo ago

https://deadeclipse666.blogspot.com/2026/05/were-doing-silen...

biennvops1mo ago

Interesting. If TPM+PIN does not help, then what stands between Bitlocker and TPM unsealing the key?

msuser1mo ago

In any case I'd be very curious to read a response to these findings from someone at Microsoft.

e12e1mo ago

In addition to sibling comments, the author claims it also affects tpm+pin.

jllyhill1mo ago· 3 in thread

Does anyone know if the fix was shipped already? If it not a backdoor, of course.

pajko1mo ago

It does not matter. Who's gonna stop them adding a new backdoor in a later Windows Update(TM) ? T this point they are not to be trusted at all.

ChocolateGod1mo ago

Microsoft doesn't need a back door, they can literally sign a new bootchain with the same certificate and install them on your computer.

This is a bug / vulnerability, not a back door.

majorchord1mo ago

"Who's going to stop <any OS or app> from inserting a backdoor at some random point in the future? They are not to be trusted at all."

https://en.wikipedia.org/wiki/Slippery_slope

protimewaster1mo ago· 1 in thread

What's the data in the FsTx folder? Is it just some magic data that Windows looks for?

e12e1mo ago

Looks like it triggers a debug modus which in turn replay filesystem transactions from transaction logs?

https://infosec.exchange/@wdormann/116565129854382214

coopreme1mo ago

Seems like a backdoor.

1 more reply

rurban1mo ago

Just a little help for the fellow TSA and FBI folks

j / k navigate · click thread line to collapse