๐ฆ๐บiTNews AustraliaโขStalecollected in 14m
USB stick exploits Windows BitLocker in new zero-day
๐กCritical security flaw in Windows BitLocker could expose sensitive AI data on physical hardware.
โก 30-Second TL;DR
What Changed
YellowKey proof-of-concept demonstrates BitLocker bypass
Why It Matters
This vulnerability could force enterprises to re-evaluate physical security protocols for devices containing sensitive AI training data or proprietary models.
What To Do Next
Audit your fleet of Windows devices and disable unauthorized USB boot capabilities in BIOS/UEFI settings.
Who should care:Enterprise & Security Teams
Key Points
- โขYellowKey proof-of-concept demonstrates BitLocker bypass
- โขVulnerability relies on physical access via USB interface
- โขSecurity researchers warn of potential data exposure risks
๐ง Deep Insight
Web-grounded analysis with 11 cited sources.
๐ Enhanced Key Takeaways
- โขThe YellowKey exploit specifically targets Windows 11 and Windows Server 2022/2025, with Windows 10 reportedly remaining unaffected by this particular bypass.
- โขThe researcher, known as Nightmare-Eclipse (or Chaotic Eclipse), suggests that the vulnerability might be an intentional backdoor, citing that the exploitable component exists only within the Windows Recovery Environment (WinRE) image with the bypass functionality, despite a similarly named component existing in normal Windows installations without it.
- โขThe bypass primarily affects BitLocker configurations operating in TPM-only mode, which is the default setting for many consumer devices, allowing automatic drive unlocking without user interaction.
- โขThe exploit involves copying a specially crafted 'FsTx' folder to a USB stick (or directly to the EFI partition), then initiating a reboot into WinRE while holding the CTRL key, which subsequently opens a command prompt with unrestricted access to the encrypted volume.
- โขAlongside YellowKey, the same researcher also released a secondary proof-of-concept called GreenPlasma, which is described as a local privilege escalation vulnerability targeting the CTFMON subsystem to achieve SYSTEM-level access, though the full escalation code was not publicly released.
๐ ๏ธ Technical Deep Dive
- Affected Operating Systems: Windows 11, Windows Server 2022, and Windows Server 2025 are vulnerable; Windows 10 is not affected.
- Exploit Mechanism: The YellowKey exploit leverages NTFS transactions in conjunction with specific components within the Windows Recovery Environment (WinRE) image.
- Vulnerable Component: A particular component within the WinRE image contains the functionality that triggers the bypass, even though a component with the exact same name exists in normal Windows installations without this specific vulnerability.
- Triggering the Exploit: An attacker must copy an 'FsTx' folder to a specific path within the
System Volume Informationdirectory on a USB stick (or alternatively, to the EFI partition of the target drive). - Execution Steps: The compromised USB stick is inserted, the machine is rebooted into the Windows Recovery Environment (WinRE) by holding Shift and clicking Restart, and then the CTRL key is held down during the reboot process.
- Outcome: If the timing is correct, a command prompt opens, granting unrestricted access to the BitLocker-encrypted volume, which can then be mounted using
diskpartto access its contents. - BitLocker Configuration: The exploit primarily targets BitLocker drives configured in TPM-only mode, which typically unlock automatically without requiring a pre-boot PIN. The researcher claims a version also works against TPM+PIN but has not released it.
- Researcher's Stance: The researcher, Nightmare-Eclipse, has publicly stated a belief that the vulnerability's nature suggests it could be an intentional backdoor.
- Associated Exploit: A separate local privilege escalation exploit named GreenPlasma, targeting the CTFMON subsystem for SYSTEM access, was also disclosed by the same researcher.
๐ฎ Future ImplicationsAI analysis grounded in cited sources
Increased scrutiny will be placed on the security of the Windows Recovery Environment (WinRE).
The YellowKey exploit's reliance on specific components and behaviors within WinRE highlights this environment as a critical, potentially overlooked, attack surface for physical access vulnerabilities, prompting deeper security analysis.
Microsoft will face significant pressure to rapidly develop and deploy a patch for this zero-day vulnerability.
The public disclosure of a BitLocker bypass, especially one that the researcher claims resembles a backdoor, severely impacts trust in Windows encryption and necessitates an urgent response from Microsoft to protect its users.
Enterprises and users will likely re-evaluate their BitLocker deployment strategies and consider stronger pre-boot authentication.
The vulnerability underscores the risks associated with relying solely on TPM-only BitLocker, potentially driving a shift towards implementing pre-boot PINs or other multi-factor authentication methods, despite the researcher's unreleased claim of a TPM+PIN bypass.
โณ Timeline
2007-01
Microsoft introduces BitLocker full-disk encryption with Windows Vista.
2022-05
Microsoft addresses several BitLocker-related vulnerabilities, including CVE-2022-29127 and CVE-2022-22048, through various updates.
2025-07
Microsoft patches CVE-2025-48804, a critical WinRE vulnerability, which later enables the 'BitUnlocker' downgrade attack due to unrevoked certificates.
2025-11
Researcher Guillaume Quรฉrรฉ demonstrates a physical attack bypassing BitLocker PIN authentication by capturing the Volume Master Key (VMK) from the TPM via logic analyzer.
2026-05-12
Researcher 'Nightmare-Eclipse' (Chaotic Eclipse) publicly releases the YellowKey proof-of-concept for BitLocker bypass and GreenPlasma for privilege escalation.
2026-05-13
Security researchers confirm YellowKey's functionality; Microsoft has not yet issued a public acknowledgment or patch for this specific vulnerability.
๐ Sources (11)
Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.
๐ฐ
Weekly AI Recap
Read this week's curated digest of top AI events โ
๐Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: iTNews Australia โ