YellowKey reportedly works in Windows 11, Windows Server 2022 and 2025, but not in Windows 10.

  • Cornballer@lemmy.zip
    link
    fedilink
    English
    arrow-up
    53
    ·
    18 days ago

    Somebody on twitter “reverse engineered” the exploit. Apparently ms shipped debug code in production. At least it’s not called Backdoor_FBI outright.

    How it works:

    1. Recovery tools look for a config file called RecoverySimulation.ini on the OS drive
    2. If Active=Yes, it enables “test mode” for the recovery tools
    3. Test mode unlocks your BitLocker drive but a flag called FailRelock tells it to skip relocking
    4. cmd.exe spawns with full access to your “encrypted” drive
    • jabberwock@lemmy.dbzer0.com
      link
      fedilink
      English
      arrow-up
      18
      ·
      18 days ago

      “Ah yes, but think about how much faster they shipped that code with Copilot doing all the heavy lifting.”

      • Some Microsoft exec, probably
    • BigDanishGuy@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      18
      ·
      18 days ago

      Does test mode unlock without the key?!? So it’s just “encrypted” with a generic key, and the unlock key is for authentication? That sounds insane, even for microsoft.