YellowKey can be triggered simply by merely copying some files to a USB stick and rebooting to the Windows Recovery Environment. We tested this ourselves, and sure enough, not only does it work, it bears all the hallmarks of a backdoor, down to the exploit's files disappearing from the USB stick after it's used once.
this post was submitted on 13 May 2026
934 points (99.7% liked)
Technology
84769 readers
3528 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
100% certainty of backdoor. Is bitlocker developed outside of MSFT? Would seem to need MSFT cooperation to implement.
Bitlocker was developed entirely inside MSFT. Upon further review, there is a chance that this is all somewhat normal behaviour. Part of MSFT safeOS to make it convenient to recover bitlocker access, and update windows.
And be able to easily comply with law enforcement requests for decryption.
Ergo, the encryption is actually worthless.
load more comments
(1 replies)
From their blog:
Now regarding YellowKey, lots of you are wondering how does one even find such backdoor ?
I'll tell you how, it took me more time trying to get it to work than the amount of sleep I had in two years combined. No AI involved, no help in any shape or form. I could have made some insane cash selling this but no amount of money will stand between me and my determination against Microsoft.
[...]
I can't wait when I will be allowed to disclose the full story, I think people will find my crashout very reasonable and it definitely won't be a good look for Microsoft.
Looking forward to the full story.
I could have made some insane cash selling this but no amount of money will stand between me and my determination against Microsoft.
There is no better motivator than pure anger and spite.
load more comments
(3 replies)
Somebody on twitter “reverse engineered” the exploit. Apparently ms shipped debug code in production. At least it’s not called Backdoor_FBI outright.
How it works:
- Recovery tools look for a config file called RecoverySimulation.ini on the OS drive
- If Active=Yes, it enables "test mode" for the recovery tools
- Test mode unlocks your BitLocker drive but a flag called FailRelock tells it to skip relocking
- cmd.exe spawns with full access to your "encrypted" drive
"Ah yes, but think about how much faster they shipped that code with Copilot doing all the heavy lifting."
- Some Microsoft exec, probably
Does test mode unlock without the key?!? So it's just "encrypted" with a generic key, and the unlock key is for authentication? That sounds insane, even for microsoft.
this works because the bitlocker key is stored in the TPM of the mainboard on the computer.
That is neccessary for the computer to be able to boot without entering your bitlocker password.
you can configure it differently, but that is not default or super obvious to do.
load more comments
(1 replies)
load more comments
(1 replies)
BitLocker is basically malware, so who fucking cares. Far more people have it accidentally on and get locked out than people that have purposefully activated it.
You have just reminded me I could use this on the laptop my mother set up like five years ago and immediately forgot the password for.
load more comments
(5 replies)
I lost 3 years of work and my research dissertation because of bitlocker. Fuck you microslop, now I do everything on Linux because of your security garbage
Not to be that guy, but that's 100% on you for not having backups of important work. It's 3 years and your fucking research dissertation, how the fuck do you keep that all in one place?
This time you got fucked by Microsoft for having shit software. But it could have been your hardware that exploded, your house catching fire, your shit being stolen, you downloading malware from that one site you told your girlfriend you'd never visit again, shitty infrastructure causing power issues or flooding, you yourself having a nervous breakdown and nuking the thing.
Keep everything important at least in three places, one of which should be in a physically different (remote) place. Backup often, keep to the schedule and test your backups.
Jeez man, using Microsoft software and not having backups is like walking around with a loaded gun pointed at your dick. It's all well and good till you get your dick blown off.
In the immortal words of Daniel Rutter (again): If nothing else, backups are necessary because at some point in your life you will confidently instruct your computer to destroy your data.
i just deleted a month of notes by doing:
find $(pwd) "*.tmp" -delete
instead of:
find $(pwd) -iname "*.tmp" -delete
turns out the former throws an error on "*.tmp" but still deletes everything lol... PSA for everyone
why $(pwd) instead of just . ?
i changed it so that ppl on lemmy who may not be familiar with the syntax of find could read it easier? maybe it made it more confusing
load more comments
(3 replies)
load more comments
(5 replies)
load more comments
(11 replies)
I mean, the concept behind BitLocker is fine. Encrypting drives by default should be the norm, the same way we encrypt our web traffic by default with https. The issue is Microsoft’s awful implementation that has led lots of users to accidentally lock themselves out of their own data, without even realizing what they were doing.
Finally, some good news. Now I can stop having to interact with my companies shitty outsourced service desk when I need a Bitlocker key.
They also state the vulnerability is well-hidden, and that they "could have made some insane cash selling this, but no amount of money will stand between me and my determination against Microsoft."
based.
of course there's a back door. You motherfuckers think they'll TPM secure boot lock file manage SECURTYYYY and not let five eyes waltz in whenever they fucking well please?
Closed source security mechanism has backdoor
More news at 9
JuSt MaKe A sEcUrE bAcKdOoR
Surely the bad guys would never use an encryption backdoor made for the “good” guys??
The process is dead simple: grab any USB stick, get write access to the "System Volume Information," and copy into it the "FsTx" folder and its contents. Shift+click Restart to get Windows to the recovery environment, but then switch to holding down the Control key and don't let go. The machine will reboot, and without asking any questions or showing any menus, will drop you in an elevated command line with full access to the formerly Bitlocked drive, without asking for any keys.
~~Its dead simple to get write access to System Volume Information~~
~~Not even local admins have access to it. A local admin would have to take ownership of that folder (not recommended), but if a local admin is doing that for this exploit, they can just turn off Bitlocker rather than go through this nonsense.~~
I misunderstood the exploit. See replies.
By exploit standards, that's not especially hard. I don't think there's really anything blocking accessing it at all if an NTFS volume is mounted on a typical desktop Linux distro, as it's just NTFS permissions blocking it, and they're not typically obeyed by Linux in the first place.
In the face of your edit, I see that you've misunderstood the exploit. You need write access to the System Volume Information directory of your own USB stick, not anything on the target machine. It's much easier to get access to things on a computer than it is to get access on one particular computer, and this exploit lets you jump from one to the other.
load more comments
(5 replies)
load more comments
(7 replies)
There was a reason for disappearance of TrueCrypt
TrueCrypt was forked into VeraCrypt, which is still maintained.
load more comments
(4 replies)
Anything that isn't open source can't be secure. That doesn't mean that everything open source is secure though.
load more comments
(1 replies)
Lmao, remember when Microsoft wouldn't make a backdoor for the US government? https://mashable.com/archive/fbi-microsoft-bitlocker-backdoor
I wonder what favor the government traded for this. Or maybe what threats were made to Microsoft...
load more comments
(4 replies)
You’d think this would only be the 100th-or-so embarrassing security-defying bug to plague micro$oft but you’d be wrong.
It’s like we’re in a world where most people use windows to log on to facebook. Its bizarre.
good news for those being locked out of their data by one of the faulty windows 11 upgrades!
Microslop can't even claim incompetence. The way this reads, the function is intended as a back door.
That makes me think of when TrueCrypt suddenly stopped being developed: https://www.techmonitor.ai/technology/cybersecurity/is-truecrypt-a-victim-of-hacking-4280447?cf-view
Except Microsoft doesn't have the respectability to discontinue a clearly broken product now that they've baked it into ever installaion of Windows 11 by default
As in you think they were pressured into stopping development so people would switch over to BitLocker, which now appears to have a backdoor put in by Microsoft or at least one of the developers, presumably at the behest of a government?
there's a backdoor built right into bitlocker in the form of 'recovery keys'--and for most users, microsoft knows what they are.
and for most users, microsoft knows what they are.
This is notable specifically because Microsoft has been compelled by courts to turn over those keys before.
I don’t blame Microsoft for complying with legal court orders, but I 100% blame them for building systems that allow them to access users’ data (including the keys) in the first place. If they used proper E2EE, they wouldn’t be able to access your keys at all. But that would prevent them from gobbling up all of your private data to sell. And the fifth amendment doesn’t protect third parties. So if the FBI confiscates your PC and you clam up, the feds can just compel Microsoft to give them your keys instead.
load more comments
(2 replies)
I guess LUKS is safe.
Why do they call it "drive encryption" when it does not need a user-provided password or other key?
TPM microslop magic.
What's even funnier is that we already have TCG, ISE, and SE drives that hardware encrypt AES256 by design, so you still get at least an instant delete option if you never bother to set a key.
Windows wants to double screw you over by never telling you it added a key, and then leaving you dead in the water if your TPM breaks, and then also failing to maintain their own TPM requirements making it completely useless lol.
view more: next ›