YellowKey reportedly works in Windows 11, Windows Server 2022 and 2025, but not in Windows 10.
good news for those being locked out of their data by one of the faulty windows 11 upgrades!
Somebody on twitter “reverse engineered” the exploit. Apparently ms shipped debug code in production. At least it’s not called Backdoor_FBI outright.
How it works:
- Recovery tools look for a config file called RecoverySimulation.ini on the OS drive
- If Active=Yes, it enables “test mode” for the recovery tools
- Test mode unlocks your BitLocker drive but a flag called FailRelock tells it to skip relocking
- cmd.exe spawns with full access to your “encrypted” drive
Does test mode unlock without the key?!? So it’s just “encrypted” with a generic key, and the unlock key is for authentication? That sounds insane, even for microsoft.
this works because the bitlocker key is stored in the TPM of the mainboard on the computer.
That is neccessary for the computer to be able to boot without entering your bitlocker password. you can configure it differently, but that is not default or super obvious to do.It always struck me as…poor…to not require a password for decryption. If you require zero knowlege from me, that means a stolen has everything inside needed to decrypt all the data.
And well, lookie there at the article!
“Ah yes, but think about how much faster they shipped that code with Copilot doing all the heavy lifting.”
- Some Microsoft exec, probably
😮💨
Microslop can’t even claim incompetence. The way this reads, the function is intended as a back door.
BitLocker is basically malware, so who fucking cares. Far more people have it accidentally on and get locked out than people that have purposefully activated it.
Companies care
When I worked at an MSP, BitLocker cost companies thousands of dollars when it did something strange. User error has very catastrophic consequences with BitLocker and nobody that actually cares about security uses BitLocker. From my professional experience it is malware. The places where I have seen it used on purpose was because of policy bullshit and everyone agreed that it was a hindrance rather than an advantage.
And from my experience in banking, healthcare and others; every company uses bitlocker on workstations, I saw EncFS once in dozens of companies audited.
Using encryption on files systems is fine, but the Microslop Bitlocker implementation is awful. In any ecosystem that is not fully regulated BitLocker is a liability. I have had colleagues that could beat it.
Companies care that you have access to it. The “companies that care” literally wrote the backdoor.
You have just reminded me I could use this on the laptop my mother set up like five years ago and immediately forgot the password for.
YellowKey can be triggered simply by merely copying some files to a USB stick and rebooting to the Windows Recovery Environment. We tested this ourselves, and sure enough, not only does it work, it bears all the hallmarks of a backdoor, down to the exploit’s files disappearing from the USB stick after it’s used once.
100% certainty of backdoor. Is bitlocker developed outside of MSFT? Would seem to need MSFT cooperation to implement.
Bitlocker was developed entirely inside MSFT. Upon further review, there is a chance that this is all somewhat normal behaviour. Part of MSFT safeOS to make it convenient to recover bitlocker access, and update windows.
And be able to easily comply with law enforcement requests for decryption.
Ergo, the encryption is actually worthless.
Normal behaviour?
-“Well it turns out we just said your data was protected, for your, ehrm, satisfaction?”
From their blog:
Now regarding YellowKey, lots of you are wondering how does one even find such backdoor ?
I’ll tell you how, it took me more time trying to get it to work than the amount of sleep I had in two years combined. No AI involved, no help in any shape or form. I could have made some insane cash selling this but no amount of money will stand between me and my determination against Microsoft.
[…]
I can’t wait when I will be allowed to disclose the full story, I think people will find my crashout very reasonable and it definitely won’t be a good look for Microsoft.
Looking forward to the full story.
I could have made some insane cash selling this but no amount of money will stand between me and my determination against Microsoft.
There is no better motivator than pure anger and spite.
Ngl I feel like it’s just going to be “I thought it was backed up but it wasn’t and M$ wouldn’t write me a back door”
Which is fine as a back story, but also a dime a dozen really.
Down voted because you rushed this comment and it’s not really clear what you’re trying to say.
!remindme and all that lol
Closed source security mechanism has backdoor
More news at 9
of *course *there’s a back door. You motherfuckers think they’ll TPM secure boot lock file manage SECURTYYYY and not let five eyes waltz in whenever they fucking well please?
Buttlocker
Is this an analogy that you can take bitlocker…
The process is dead simple: grab any USB stick, get write access to the “System Volume Information,” and copy into it the “FsTx” folder and its contents. Shift+click Restart to get Windows to the recovery environment, but then switch to holding down the Control key and don’t let go. The machine will reboot, and without asking any questions or showing any menus, will drop you in an elevated command line with full access to the formerly Bitlocked drive, without asking for any keys.
Its dead simple to get write access to System Volume InformationNot even local admins have access to it. A local admin would have to take ownership of that folder (not recommended), but if a local admin is doing that for this exploit, they can just turn off Bitlocker rather than go through this nonsense.I misunderstood the exploit. See replies.
By exploit standards, that’s not especially hard. I don’t think there’s really anything blocking accessing it at all if an NTFS volume is mounted on a typical desktop Linux distro, as it’s just NTFS permissions blocking it, and they’re not typically obeyed by Linux in the first place.
In the face of your edit, I see that you’ve misunderstood the exploit. You need write access to the System Volume Information directory of your own USB stick, not anything on the target machine. It’s much easier to get access to things on a computer than it is to get access on one particular computer, and this exploit lets you jump from one to the other.
Its bitlocker encrypted. You need to unlock the disk to see System Volume Information in Linux.
does bitlocker encrypt whole volume, or userdata folders? It’s a performance issue to encrypt anything that doesn’t need to be.
Its whole-volume encryption, not file encryption. Most modern CPUs have built-in AES-NI instructions so its not much of a performance penalty (as long as AES is used for encryption).
You can do full disk or folders
I’ll copy the bit here that I just edited into my reply after you edited the first post:
In the face of your edit, I see that you’ve misunderstood the exploit. You need write access to the System Volume Information directory of your own USB stick, not anything on the target machine. It’s much easier to get access to things on a computer than it is to get access on one particular computer, and this exploit lets you jump from one to the other.
Ah yeah, I misunderstood. Thanks for the clarification.
Your strike-through didn’t work somehow.
I know! I cant figure it out 😂
It’s the spaces, I think
I tried without spaces too unfortunately
I think it’s three tildas.
Its two. It didn’t like the exclamation mark. I removed it and it started working.
Oh nice work!
You’d think this would only be the 100th-or-so embarrassing security-defying bug to plague micro$oft but you’d be wrong.
It’s like we’re in a world where most people use windows to log on to facebook. Its bizarre.
Backdoors are features, not bugs though.
That makes me think of when TrueCrypt suddenly stopped being developed: https://www.techmonitor.ai/technology/cybersecurity/is-truecrypt-a-victim-of-hacking-4280447?cf-view
Except Microsoft doesn’t have the respectability to discontinue a clearly broken product now that they’ve baked it into ever installaion of Windows 11 by default
As in you think they were pressured into stopping development so people would switch over to BitLocker, which now appears to have a backdoor put in by Microsoft or at least one of the developers, presumably at the behest of a government?
The thought did cross my mind, yeah. I don’t think it’s quite sufficient evidence to make such a big conclusion, but both of these seem so conspicuous
there’s a backdoor built right into bitlocker in the form of ‘recovery keys’–and for most users, microsoft knows what they are.
and for most users, microsoft knows what they are.
This is notable specifically because Microsoft has been compelled by courts to turn over those keys before.
I don’t blame Microsoft for complying with legal court orders, but I 100% blame them for building systems that allow them to access users’ data (including the keys) in the first place. If they used proper E2EE, they wouldn’t be able to access your keys at all. But that would prevent them from gobbling up all of your private data to sell. And the fifth amendment doesn’t protect third parties. So if the FBI confiscates your PC and you clam up, the feds can just compel Microsoft to give them your keys instead.
Yeah its Not Safe As.
Also your delivery from Flowers By Irene is waiting outside
the billionaires don’t care about your “security”
Why people are saying that the files being deleted indicate a backdoor? This is clearly to be executed while having access to the laptop. So it’s not like I’m tricking someone into connecting the USB drive and after the PC is infected I want to get rid of the evidence. If some FBI agent is using a USB drive to unlock a laptop at work, what’s the point of making the drive single use?
This could also be part of the PoC created by the researcher, not part of the backdoor.
They said in the article they recreated it on their own. So it couldn’t just be the proof of concept.
If some FBI agent is using a USB drive to unlock a laptop at work, what’s the point of making the drive single use?
Under cover/covert operations do actually happen.
They said in the article they recreated it on their own. So it couldn’t just be the proof of concept.
This could mean they just put the files from the exploit on a drive and reproduced it. The author of the exploit claims it’s very complex and no one knows how it works yet.
Under cover/covert operations do actually happen.
So what’s the scenario they are protecting themselves against? Someone catching the agent right after they unlocked some encrypted drive with the USB drive still on them? It sounds very far fetched to me that FBI would request a backdroor from Microsoft with this very specific requirement. I think it’s more likely they would cover it on their side with some easily erasable USB drive. Plus such a solution would also let them get rid of the backdoor if they are caught before they used it.
It’s possible this was just added by the guy for his proof of concept, so I guess we’ll see when more information is released.
So what’s the scenario they are protecting themselves against?
I mean, if you had a USB backdoor why wouldn’t you automate the removal of evidence? It would make disposal a lot faster. You can just unplug it and physically destroy it to be safe.
I think it’s more likely they would cover it on their side with some easily erasable USB drive.
Why not both? Redundancy never hurt.
It’s definitely possible to add a feature like that to a backdoor but I don’t see how that’s a proof it’s a backdoor. It’s definitely not something backdoors always do and we don’t know if this functionality is in Windows or it’s part of the exploit. So am I missing something? Or are people just jumping to conclusions?
deleted by creator
Er, no?
Eclipse notes that using a full TPM-and-PIN setup doesn’t help, as apparently, they have a variant for that scenario that they haven’t published a PoC for
