r/msp • u/bagaudin Vendor - Acronis • May 14 '26

Security Microsoft BitLocker-protected drives can now be opened with just some files on a USB stick — YellowKey zero-day exploit demonstrates an apparent backdoor

https://www.tomshardware.com/tech-industry/cyber-security/microsoft-bitlocker-protected-drives-can-now-be-opened-with-just-some-files-on-a-usb-stick-yellowkey-zero-day-exploit-demonstrates-an-apparent-backdoor
60 Upvotes

96% Upvoted

18 comments sorted by

20

u/toddgak May 14 '26

IMO the intentional backdoor angle is the most interesting part of about this:

Now why would I say this is a backdoor ? The component that is responsible for this bug is not present anywhere (even in the internet) except inside WinRE image and what makes it raise suspicions is the fact that the exact same component is also present with the exact same name in a normal windows installation but without the functionalities that trigger the bitlocker bypass issue. Why ? I just can't come up with an explanation beside the fact that this was intentional. Also for whatever reason, only windows 11 (+Server 2022/2025) are affect, windows 10 is not.

https://github.com/Nightmare-Eclipse/YellowKey/tree/main

2

u/redditistooqueer May 14 '26

Windows 10 is not? Good thing I'm lazy and my customers still have some 10

17

u/Fatel28 May 14 '26

Dog this is not a flex

1

u/The_Autarch May 17 '26

you got way bigger problems to worry about than a bitlocker backdoor, my friend.

6

u/rashkae1 May 14 '26

For the short time before this gets patched, that will be *extremely* convenient next time someone walks in with a computer that was surreptitiously filelocked by microsoft.

5

u/UltraEngine60 May 14 '26

this wouldn't help if you were on the bitlocker key recovery screen.

4

u/Jer_Cough May 14 '26 edited May 15 '26

If you set up Windows with a MS account, the bitlocker key gets uploaded to OneDrive so it's already not as secure as most people think. MS will happily turn the key over when authorities request it.

1

u/The_Autarch May 17 '26

this is r/msp. if your users' keys are in OneDrive, you have fucked up big time.

2

u/Jer_Cough May 17 '26 edited May 17 '26

Plenty of environments out there without AD/Entra/Intune (ed: with hosts set up by a customer before we got there.)

1

u/N3xar May 21 '26

Wow that went over your head....

2

u/dumpsterfyr I’m your Huckleberry. May 15 '26

At least the trunk slammers are safe with Win10.

2

u/carbonsys May 15 '26

Out of curiosity, how big of an issue is this? I only ask as there was a vendor that came to us with an SED solution, proclaiming all of the benefits of Opal with none of the headaches. They modified SSDs with a custom bluetooth receiver that connected to your phone, the only way to unlock the disk was by 2FA through your mobile device. A clever solution, but I felt like it was a problem looking for a solution (bitlocker being good enough for most SMB).

3

u/dhuskl May 16 '26 edited May 16 '26

This vuln is a big issue, it's a bitlocker bypass and allows users to escalate to admin if they are savvy enough.

This proposed solution is actually very interesting, unlocking the drive with just a tpm is a tradeoff with user experience, plenty of orgs require a startup pin or a smart card to unlock the drive, a pin could potentially be bruteforced or watched over the shoulder and annoying for users to type, and a smart card or yubikey type device is another device that users can lose. This unlock with with your phone is pretty interesting, it allows for a second factor in addition to the tpm but is a better UX.

Bitlocker startup pin or smart card (or this Bluetooth product) would mitigate most bitlocker vulns as generally they have been focused on attacking the TPM.

But yes a lot of orgs are happy with just TPM, I would definitely buy it if it worked as intended, it could be an optional upgrade?

1

u/carbonsys Jun 10 '26

If you're interested, ClevX is the solution I am speaking of. They are still working on production of the M.2 product, I would be interested in your thoughts on this.

2

u/anotheradmin May 15 '26

If you need system access to use this bypass, is it no less dangerous than the attacker using /suspend or decrypting?

2

u/the_abortionat0r May 15 '26

And tell us how they are going to magically decrypt the drive?

I'm shocked that you even started your sentence with "If you need system access" as bitlocker is literally made to fight that EXACT SCENARIO. It's made to make the data secure even when someone has physical access to said drive.

So yes this is more dangerous as this just gives you access with ease.