Quick Read
- A novel zero-day vulnerability known as YellowKey bypasses Windows BitLocker by utilizing a specially designed USB drive.
- This vulnerability impacts Windows 11 and Windows Server versions 2022 and 2025.
- YellowKey necessitates physical access to the targeted machine.
- Transactional NTFS logs are involved in this security issue.
- The researcher proposes that YellowKey may serve as an intentional backdoor.
- Additional vulnerabilities called GreenPlasma and BlueHammer have also been revealed.
Understanding the YellowKey Vulnerability
A security expert recognized by the pseudonyms “Nightmare-Eclipse” and “Chaotic Eclipse” has uncovered a significant flaw within Microsoft’s BitLocker encryption for Windows systems. This exploit, referred to as YellowKey, employs a USB stick containing specific files to bypass security protocols, impacting both Windows 11 and Windows Server versions 2022 and 2025.
How YellowKey Functions
The Function of Transactional NTFS
YellowKey takes advantage of the Transactional NTFS feature, implemented in Windows Vista, to compromise BitLocker. By transferring a directory named FsTx to a USB drive, attackers can reboot a targeted system into the Windows Recovery Environment (WinRE), where the FsTx logs are replayed, resulting in a command prompt interface with unrestricted access.
Security Risks
Possible Intentional Backdoor
There are concerns regarding YellowKey being a potentially intentional backdoor. The researcher notes the absence of the problematic component outside of WinRE environments, implying a possible deliberate oversight in the system’s architecture.
Further Vulnerabilities
GreenPlasma and BlueHammer
In addition to YellowKey, information about a privilege escalation vulnerability termed GreenPlasma has been disclosed. The researcher has also mentioned earlier exploits, BlueHammer and RedSun, that have been actively utilized by attackers.
Microsoft’s Reaction and Upcoming Revelations
The researcher has criticized Microsoft’s approach to dealing with these vulnerabilities, citing ineffective solutions and revealing plans for further disclosures. The situation underscores the ongoing difficulties in achieving responsible vulnerability disclosure.
Conclusion
YellowKey signifies a critical zero-day vulnerability within Microsoft’s security framework, carrying significant risks for users depending on BitLocker encryption. The possibility of additional vulnerabilities and the indication of intentional backdoors raise grave questions regarding system security and integrity practices.
Q&A Section
Q: Which systems are impacted by the YellowKey vulnerability?
A: YellowKey impacts Windows 11 and Windows Server 2022/2025.
Q: In what manner does YellowKey circumvent BitLocker encryption?
A: By exploiting Transactional NTFS logs through a USB drive, YellowKey grants access to a command prompt interface with unrestricted access.
Q: Is it possible to mitigate YellowKey with extra security measures?
A: Although TPM authentication with a PIN has been proposed as a potential mitigation, the researcher asserts that a variant can still bypass this added security.
Q: Are there other associated vulnerabilities?
A: Yes, the researcher has also disclosed partial information regarding GreenPlasma, alongside earlier exploits BlueHammer and RedSun.