Zero-Day Vulnerability Bypasses Windows BitLocker Encryption

BitLocker Bypass Discovered

A critical zero-day vulnerability in Windows BitLocker, Microsoft's built-in full-volume encryption feature, has been publicly disclosed. The exploit, named "YellowKey," enables a total bypass of the encryption, granting attackers completely unrestricted access to locked system drives.

According to reports, the vulnerability allows individuals with physical access to a Windows 11 system to defeat default BitLocker protections and gain complete access to an encrypted drive within seconds. BitLocker typically relies on the Trusted Platform Module (TPM) to provide hardware-based security, which is intended to protect user data from unauthorized access in the event a device is lost or stolen.

Disclosure and 'GreenPlasma' Exploit

The vulnerabilities were publicly released by a security researcher who is described as "disgruntled" and "frustrated". The disclosure followed an ongoing dispute and occurred after Microsoft's May Patch Tuesday.

In addition to YellowKey, the researcher released a second zero-day exploit named "GreenPlasma". While YellowKey targets the encryption bypass, GreenPlasma is a privilege escalation flaw. These exploits have been released as Proof of Concepts (PoCs) targeting both BitLocker protections and privilege controls.

Technical Impact

The YellowKey exploit is characterized as the most critical of the two flaws.

Because the exploit requires physical access to the machine, the primary risk is associated with stolen or lost hardware.