BitLocker Flaw Exposes Windows 11 Data

Windows 11 BitLocker Exploit Discovered

A zero-day exploit, named YellowKey, has been publicly disclosed, enabling physical bypass of default Windows 11 BitLocker encryption. The exploit, published by a researcher known as Nightmare-Eclipse, allows an attacker with physical access to a Windows 11 system to gain full access to an encrypted drive within seconds. This vulnerability affects default BitLocker deployments where decryption keys are stored in a Trusted Platform Module (TPM).

The YellowKey exploit leverages a custom FsTx folder on a USB drive. By connecting this drive to a BitLocker-protected device and initiating Windows recovery mode, a command prompt with full access to the encrypted drive contents appears. This bypasses the typical requirement for a BitLocker recovery key. Multiple security researchers, including Kevin Beaumont and Will Dormann, have confirmed the exploit's functionality.

The mechanism behind the bypass appears to involve Transactional NTFS, where the presence of a specific FsTx directory on one volume can manipulate the contents of another volume during the Windows Recovery environment. This manipulation leads to the deletion of the winpeshl.ini file, which normally controls Windows Recovery actions, resulting in an unlocked command prompt. Microsoft has stated it is investigating the reported vulnerability.