YellowKey reportedly works in Windows 11, Windows Server 2022 and 2025, but not in Windows 10.
YellowKey can be triggered simply by merely copying some files to a USB stick and rebooting to the Windows Recovery Environment. We tested this ourselves, and sure enough, not only does it work, it bears all the hallmarks of a backdoor, down to the exploit’s files disappearing from the USB stick after it’s used once.
100% certainty of backdoor. Is bitlocker developed outside of MSFT? Would seem to need MSFT cooperation to implement.
Bitlocker was developed entirely inside MSFT. Upon further review, there is a chance that this is all somewhat normal behaviour. Part of MSFT safeOS to make it convenient to recover bitlocker access, and update windows.
And be able to easily comply with law enforcement requests for decryption.
Ergo, the encryption is actually worthless.
Somebody on twitter “reverse engineered” the exploit. Apparently ms shipped debug code in production. At least it’s not called Backdoor_FBI outright.
How it works:
- Recovery tools look for a config file called RecoverySimulation.ini on the OS drive
- If Active=Yes, it enables “test mode” for the recovery tools
- Test mode unlocks your BitLocker drive but a flag called FailRelock tells it to skip relocking
- cmd.exe spawns with full access to your “encrypted” drive
“Ah yes, but think about how much faster they shipped that code with Copilot doing all the heavy lifting.”
- Some Microsoft exec, probably
Microslop can’t even claim incompetence. The way this reads, the function is intended as a back door.
That makes me think of when TrueCrypt suddenly stopped being developed: https://www.techmonitor.ai/technology/cybersecurity/is-truecrypt-a-victim-of-hacking-4280447?cf-view
As in you think they were pressured into stopping development so people would switch over to BitLocker, which now appears to have a backdoor put in by Microsoft or at least one of the developers, presumably at the behest of a government?
there’s a backdoor built right into bitlocker in the form of ‘recovery keys’–and for most users, microsoft knows what they are.
and for most users, microsoft knows what they are.
This is notable specifically because Microsoft has been compelled by courts to turn over those keys before.
I don’t blame Microsoft for complying with legal court orders, but I 100% blame them for building systems that allow them to access users’ data (including the keys) in the first place. If they used proper E2EE, they wouldn’t be able to access your keys at all. But that would prevent them from gobbling up all of your private data to sell. And the fifth amendment doesn’t protect third parties. So if the FBI confiscates your PC and you clam up, the feds can just compel Microsoft to give them your keys instead.
The thought did cross my mind, yeah. I don’t think it’s quite sufficient evidence to make such a big conclusion, but both of these seem so conspicuous
Bitlocker is Temu encryption
Temu is, as Chinese netizens will tell you, full of items on a lower 4th rung of quality well below what they are used to (at least the urbanites, but I doubt farmers want to buy junk for shit they need to do). That doesn’t mean that a single-board computer you buy off it would be incapable of anything you need to do, just surrounded by stuff advertised in a misleading way to get you to buy more shit.
Their business itself has customer data well-encrypted, never sends out your email to spammers (I isolate email accounts I would notice). They have never had a single data breach.
weird bot
I manually post on these as well, they currently have only used post scheduling, haven’t set up feeds. It’s nice to hide my own accounts from each other, and if I don’t, then I’m going to forget and people will get mad that the bots are unmarked. Not your problem.
So, any comment on me pointing out the obvious racism?
The post you replied to never said “Chinese”, it said “Temu”. So you saying “Oh yeah Chinese people agree, Temu is garbage” actually proves… that it was a reasonable statement?
It still could’ve been said from a racist place or with undertones of racism, but it’s not necessarily guaranteed. Temu is garbage. Americans think so. Chinese people apparently think so.
How specious. Yes, Temu is trash mixed with treasure, but it’s the exact same garbage you pay a premium for at online or brick-and-mortar retailers, so I find it quite funny when USonians act above it. You don’t have an option for better quality that isn’t as Chinese as possible without getting ripped off, unless you need cameras or the latest graphics cards. Temu encryption is good. American corporate encryption leans very bad. Just watch some cybersecurity conferences. More than racism I’m irritated by people using terminology wrong.
Chinese people think Temu is trash and would never use it
I find it quite funny when USonians act above it
I’m going to stop talking to you now because wtf are you even on about. No one said anything about not wanting to buy Chinese goods. I specifically buy Chinese goods because at least their billionaires are kept to heel and are doing less to actively fuck over my life than Jeff Bezos.
Also no one said anything about Temu encryption but you, so again, wtf are you even on about?
Well, I’m happy to stop talking if you’re the type more interested in catfighting than even interpreting the conversation correctly. GreenBottles did in fact start off saying Microsoft is using Temu encryption. If Microsoft was using Temu encryption then their customers would be safe & they would have a record of zero data breaches. I don’t think farmers would buy anything important on Temu, I never said no Chinese person would use it. This is anecdotal from speaking to urbanites who were more interested in high-quality manufacturing for throwing some money around in the markets. Nevermind!
I’m glad you buy your Chinese stuff directly instead of through Bezos, but I hope you can see that the kids using Temu synonymously with “dogshit” are being somewhat racist. Since this isn’t based off a comparison with durable good from Amazon or the supermarket. Amazon support just isn’t worth the markup. It’s informed by propaganda spreading through unconventional means such as gore websites plastered with Russian and Chinese industrial accidents or hit-and-runs from the 2000s. Things change, and when that change is accompanied by a meme where a Chinese company is used as an adjective meaning dogshit, I think, well, the advertising firms that these Fortune 500 companies employ would feel quite chickenshit if they got beaten to the punch by natural slang developments. They’d be saying gee, I wish we got them talking like this five years before.
Lmao, remember when Microsoft wouldn’t make a backdoor for the US government? https://mashable.com/archive/fbi-microsoft-bitlocker-backdoor
I wonder what favor the government traded for this. Or maybe what threats were made to Microsoft…
Gee Mr Gates, that’s a nice monopoly you’ve got there. It sure would be a shame, if that anti-trust lawsuit the AG is researching were to happen to it…
Maybe it’s just a coincidence! Maybe those files just randomly do that lmao. Including deleting themselves!
Lol, imagine if they made that defense. “This was the result of an AI hallucination!”
JuSt MaKe A sEcUrE bAcKdOoR
Surely the bad guys would never use an encryption backdoor made for the “good” guys??
From their blog:
Now regarding YellowKey, lots of you are wondering how does one even find such backdoor ?
I’ll tell you how, it took me more time trying to get it to work than the amount of sleep I had in two years combined. No AI involved, no help in any shape or form. I could have made some insane cash selling this but no amount of money will stand between me and my determination against Microsoft.
[…]
I can’t wait when I will be allowed to disclose the full story, I think people will find my crashout very reasonable and it definitely won’t be a good look for Microsoft.
Looking forward to the full story.
I could have made some insane cash selling this but no amount of money will stand between me and my determination against Microsoft.
There is no better motivator than pure anger and spite.
Ngl I feel like it’s just going to be “I thought it was backed up but it wasn’t and M$ wouldn’t write me a back door”
Which is fine as a back story, but also a dime a dozen really.
BitLocker is basically malware, so who fucking cares. Far more people have it accidentally on and get locked out than people that have purposefully activated it.
Companies care
When I worked at an MSP, BitLocker cost companies thousands of dollars when it did something strange. User error has very catastrophic consequences with BitLocker and nobody that actually cares about security uses BitLocker. From my professional experience it is malware. The places where I have seen it used on purpose was because of policy bullshit and everyone agreed that it was a hindrance rather than an advantage.
And from my experience in banking, healthcare and others; every company uses bitlocker on workstations, I saw EncFS once in dozens of companies audited.
Using encryption on files systems is fine, but the Microslop Bitlocker implementation is awful. In any ecosystem that is not fully regulated BitLocker is a liability. I have had colleagues that could beat it.
There was a reason for disappearance of TrueCrypt
What reason? It was broken?
Suddenly dev resigned and posted bizzare post that read like he was at a gunpoint, recommending bitlocker instead of truecrypt
No, it worked so well that the governments didn’t like it.
It was very likely compromised by NSA requiring a backdoor or weakened encryption that could be cracked by the US. There’s a long story that’s pretty interesting if you want to hit the rabbit hole
if I just browsed the web and didn’t play any computer games I’d be on Mac or Linux. I’m only on windows because it’s familiar, works with my games (new and old), and I’m lazy
Why people are saying that the files being deleted indicate a backdoor? This is clearly to be executed while having access to the laptop. So it’s not like I’m tricking someone into connecting the USB drive and after the PC is infected I want to get rid of the evidence. If some FBI agent is using a USB drive to unlock a laptop at work, what’s the point of making the drive single use?
This could also be part of the PoC created by the researcher, not part of the backdoor.
I lost 3 years of work and my research dissertation because of bitlocker. Fuck you microslop, now I do everything on Linux because of your security garbage
I mean, the concept behind BitLocker is fine. Encrypting drives by default should be the norm, the same way we encrypt our web traffic by default with https. The issue is Microsoft’s awful implementation that has led lots of users to accidentally lock themselves out of their own data, without even realizing what they were doing.
Not to be that guy, but that’s 100% on you for not having backups of important work. It’s 3 years and your fucking research dissertation, how the fuck do you keep that all in one place?
This time you got fucked by Microsoft for having shit software. But it could have been your hardware that exploded, your house catching fire, your shit being stolen, you downloading malware from that one site you told your girlfriend you’d never visit again, shitty infrastructure causing power issues or flooding, you yourself having a nervous breakdown and nuking the thing.
Keep everything important at least in three places, one of which should be in a physically different (remote) place. Backup often, keep to the schedule and test your backups.
Jeez man, using Microsoft software and not having backups is like walking around with a loaded gun pointed at your dick. It’s all well and good till you get your dick blown off.
Yeah, I would also like to know more on how bitlocker screwed him. Like was it a legit problem or that the device died and didnt have the keys to decrypt it? If it’s not keeping the keys somewhere safe, which it even makes you do by not allowing you to select the local device, then idk how the blame is microsoft is shitty. Need more info though.
IT lapsed and diddnt have keys for the computer. So windows 10 “updated” to windows 11 the computer bricked. IT also blocked us from plugging in usb sticks. Which they then blamed me for not backing everything thing up to one drive. It’s all just left a sour taste in my mouth
In the immortal words of Daniel Rutter (again): If nothing else, backups are necessary because at some point in your life you will confidently instruct your computer to destroy your data.
Been there, done that.
I was lucky last time, was able to reconstruct almost all of it (99.7%) in 3 weeks of after-work messing around. The 0.3% is non-critical.
Now I do something I wrote myself with cron, rsync, hardlinks and gpg. It’s simple, easy to test and fairly bulletproof. Protip: keep many backups of your keys or you’ll wish you had.
Syncthing (distributed folder sharing including “keep x copies of each file”) and duplicity (gpg-encrypted, incremental backup anywhere) are your friends.
Been using them for a very, very long time. A++ open source, cross-platform solutions.
I to have multi tiered backups for my laptops and do regular restores to validate them. Same for my parents and all my non technical family and friends. Its amazing that big companies mess this up since everyone does it. It’s just so cheap and easy to do. /s
- Find online backup service
- Pay for subscription
- Install backup software
- …
- Still have your data
I use Backblaze myself… But there are many other straightforward and easy backup solutions out there.
Storing important data online on someone else’s computer is beyond fucked up levels of stupid: You only need to lose your encryption key once in your lifetime afterwards, and you can consider your backup public for all the world to see. And a single encryption weakness / backdoor will expose data just the same. Not to mention using third party sw to “do the backup” for you and relying on them to encrypt it so that they themselves can’t read it, is very naive.
Once your data left your home network, it is no longer yours to control.
You sound like a paid shill for microslop
No, he does not. A bit of an overreaction on your part.
Advising people to have safe backup of their work is not being a shill for anyone, it’s basic common sense.
