Linus Tech Tips Discussion

 Bitlocker "defeated" for Windows 11 If you are managing computers and rely on bitlocker to protect the data on a work laptop and don't use a PIN to unlock the bitlocker protection is now effectively nothing more than an unlocked door to your house. Microsoft has left in a debugging code/backdoor (depending who you ask) in the recovery environment that allows full access.   https://cyberunit.com/insights/windows-bitlocker-zero-day-yellowkey-winre-bypass/ Quote A researcher operating under the alias Nightmare-Eclipse (also seen as Chaotic Eclipse) published a working proof-of-concept on May 12, 2026 that defeats Windows BitLocker drive encryption on Windows 11, Windows Server 2022, and Windows Server 2025. The exploit, dubbed YellowKey, needs only physical access to the device and a USB stick. No recovery key. No password. No expensive hardware.   While I tend to believe in the whole idea that "don't attribute to malice what can be explained by incompetence"...it really is pretty hard to believe that for something like BitLocker, a product that is supposed to be protecting the drive, somehow had code left behind in the recovery environment that allows for any attacker to easily gain access to the encrypted drive.   Nightmare-Eclipse is claiming as well that using a PIN, while it protects from the current attack, that he has found a way around needing a PIN to decrypt as well.  The whole story of Nightmare-Eclipse though is interesting, where he's released a few zero-days now and claims to hold a grudge against MS.  Given though that he has shown just how dangerous the exploits he is releasing are, I'm really wondering if this is either a state sponsored/group of people, or someone internal at MS that might have had hands on the source.  Either way though, Nightmare-Eclipse has claimed it's a backdoor and you know I sort of agree that it looks like one (or it's very very irresponsible of MS to not have vetted a key part of code...which given how sloppy MS's approach has been could be the case).   Either way, for the Sys Admins out there, don't just rely on BitLocker to keep the data safe in the event of a laptop being stolen (because lets face it, as often as you tell employees not to store anything important on their system they will still do it)