Security researcher says Microsoft built a Bitlocker backdoor, releases exploit
583 points
• 1 day ago
• Article
Link
一位名为 Nightmare‑Eclipse 的安全研究人员发布了名为 YellowKey 的工具，声称可以完全绕过 BitLocker 的整盘加密。该利用方法是把特定的 "FsTx" 文件夹复制到以 NTFS 、 FAT32 或 exFAT 格式化的 USB 驱动器上，将受 BitLocker 保护的机器重启到 Windows Recovery Environment，然后按一套特定的输入序列操作。若步骤无误，会弹出一个命令行 shell，从而在不需要任何密码的情况下无限制访问加密卷。
Nightmare‑Eclipse 认为，这个问题看起来不像普通的程序缺陷，更像是 Microsoft 在 BitLocker 中刻意留下的后门。其理由是触发问题的组件仅存在于官方的 Windows Recovery Environment 镜像中，并且在运行系统上与标准 Windows 安装镜像的表现不同。此外，该问题只影响 Windows 11 和 Server 2022/2025，而 Windows 10 不受影响，研究者认为这点很难用偶然解释，更倾向于故意设计。
据报道，第三方研究人员已验证 YellowKey 与公开的 GitHub 资料描述一致。 Nightmare‑Eclipse 还发布了第二个名为 GreenPlasma 的提权工具，声称能实现权限提升，但并未公开可直接拿来获得 SYSTEM 级访问的完整概念验证代码。研究者表示可能会在下个月的 Patch Tuesday 前披露更多细节。
Nightmare‑Eclipse 有过针对 Microsoft 的公开对抗历史，曾以 Chaotic Eclipse 名义活动并发布过 Red Sun 等漏洞，且声称 Microsoft 损害了其职业和声誉。研究者一贯的对抗性做法为其关于 YellowKey 是刻意后门的大胆结论提供了背景说明。
对于担心 BitLocker 安全性的人，缓解建议是不要仅依赖单一加密方案。安全专业人士建议评估经过良好审查的整盘加密替代方案，如 VeraCrypt 。这一事件也凸显了独立安全研究者与大型科技公司在漏洞披露和主流安全工具信任度方面持续存在的紧张关系。
A security researcher known as "Nightmare-Eclipse" has released a tool called YellowKey that allegedly bypasses BitLocker's full-volume encryption entirely. The exploit works by copying a specific "FsTx" folder to a USB drive formatted with NTFS, FAT32, or exFAT, rebooting a BitLocker-protected machine into the Windows Recovery Environment, and following a particular sequence of inputs. If done correctly, a command shell appears granting unrestricted access to encrypted volumes without requiring any passwords.
Nightmare-Eclipse argues this vulnerability looks less like a typical bug and more like an intentional backdoor built into BitLocker by Microsoft. Their reasoning centers on the fact that the component triggering the issue only exists in the official Windows Recovery Environment image and behaves differently on live systems compared to standard Windows installation images. The researcher also notes that only Windows 11 and Server 2022/2025 are affected, while Windows 10 is not, which they find suspicious and difficult to explain as anything other than deliberate design.
Third-party researchers have reportedly confirmed that YellowKey works as described in the public GitHub materials. Nightmare-Eclipse also released a second exploit called GreenPlasma, said to enable privilege escalation, though they did not publish full proof-of-concept code for achieving SYSTEM-level access. The researcher suggested they may disclose further details ahead of next month's Patch Tuesday.
Nightmare-Eclipse has a history of targeting Microsoft and accusing the company of hostility toward external security researchers. Previously operating as "Chaotic Eclipse," they released other vulnerabilities like Red Sun while claiming Microsoft damaged their career and reputation. The researcher's confrontational approach adds context to the bold claims about YellowKey being an intentional backdoor.
For those concerned about BitLocker's security, mitigation advice centers on not relying solely on any single encryption system. Security professionals recommend evaluating well-reviewed full-disk encryption alternatives such as VeraCrypt. The situation highlights ongoing tensions between independent security researchers and large technology companies over vulnerability disclosure and the integrity of widely-used security tools.
261 comments • Comments Link
• 安全研究员 Nightmare-Eclipse 在声称微软违反披露协议并让其陷入困境后，公开了两个 BitLocker 漏洞——YellowKey 和 GreenPlasma 。其博客暗示负责任的披露流程已被破坏，并对微软的处理方式愈发失望。
• 这些漏洞似乎可以实现登录绕过和对加密驱动器的未授权访问，甚至可能在 Windows Recovery Environment 中获得不受限制的 shell 。其中一个漏洞涉及对 EFI 分区内 FsTx 文件的操纵，但有人指出挂载 EFI 分区本身就需要 root 权限，这在某种程度上使该攻击显得多此一举。
• TrueCrypt 在 2014 年的突然关闭仍被社区视作标志性事件，许多人把其停止维护并推荐使用 BitLocker 解释为政府施压以植入后门的证据。这段历史加深了人们对专有加密工具，尤其是 BitLocker 的怀疑。
• 关于各类加密方案的可信度存在激烈争论。一些人主张使用 VeraCrypt 等开源替代品，但也有人指出其来源可疑，任何复杂代码库的全面审计都非常困难。总体上，人们更倾向于使用大型厂商自带的加密功能，尽管这些方案并不完美。
• 有人认为加密系统中的不安全默认设置在功能上等同于后门。例如 iCloud 备份默认并非端到端加密，WhatsApp 在 Google Drive 上保存的 Android 备份也是未加密的。这类默认设置既为公司保留了合理否认的空间，又能迎合执法需求。
• 全盘加密的实际影响存在争议。一些用户更看重数据可恢复性而非安全性，宁愿使用未加密驱动器以便在紧急情况下轻松访问；另一些人则认为只要做好备份，加密带来的不便微乎其微，但能显著提升防盗保护。
• 微软在从本地账户迁移到在线账户时自动启用 BitLocker 的做法备受批评。有用户反映在未获同意或不知情的情况下被锁定系统，被迫走 aka.ms 恢复流程。这被一些人视为一种数据勒索，尽管并未直接货币化。
• BitLocker 的恢复密钥管理长期令人困惑，尤其对可能不知道驱动器已被加密的非技术用户更是如此。当用户从未主动设置加密却被要求通过在线账户恢复密钥时，会造成严重的可访问性问题。
• 对物理安全的担忧超出了简单的数据被盗。有人警告，具有物理访问权限的攻击者可能会在未加密的驱动器上植入非法材料，随后被操作系统自带的扫描程序检测到，从而给设备所有者带来法律风险。
• 更广泛的讨论反映出安全性、可用性与对企业信任之间的深层张力。尽管加密技术在计算上已足够成熟且成本近乎可忽略，但密钥管理、用户同意与恢复等人为因素仍是厂商未能充分解决的挑战。
• 讨论表明社区正努力应对有关专有加密系统信任、负责任披露伦理以及安全性与可用性之间权衡的根本问题。 TrueCrypt 的关闭等历史事件继续影响认知，而微软当前自动激活 BitLocker 的做法引发了强烈反弹。技术漏洞虽值得关注，但作为对话的催化剂，它们暴露了现有加密实现的不足，并凸显了对更好用户教育与同意机制的需求。 • A security researcher known as Nightmare-Eclipse has publicly disclosed two BitLocker vulnerabilities, YellowKey and GreenPlasma, after claiming Microsoft violated a disclosure agreement and left them homeless. The researcher's blog posts suggest a breakdown in the responsible disclosure process, with frustration mounting over Microsoft's handling of the situation.
• The vulnerabilities appear to enable login bypass and unauthorized access to encrypted drives, potentially allowing attackers to gain unrestricted shell access in the Windows Recovery Environment. One exploit involves manipulating FsTx files in the EFI partition, though some argue that mounting the EFI partition already requires root-level access, making the attack somewhat redundant.
• The TrueCrypt shutdown in 2014 remains a touchstone in the community, with many interpreting the abrupt closure and recommendation to use BitLocker as evidence of government pressure to insert backdoors. This historical context fuels ongoing skepticism about proprietary encryption tools, particularly Microsoft's BitLocker.
• There is significant debate about the trustworthiness of various encryption solutions. Some advocate for open-source alternatives like VeraCrypt, while others point to its own questionable origins and the challenges of auditing any complex codebase. The consensus leans toward using built-in encryption from major vendors despite their imperfections.
• Insecure defaults in encryption systems are viewed by some as functionally equivalent to backdoors. Examples include iCloud backups not being end-to-end encrypted by default and WhatsApp storing Android backups unencrypted in Google Drive. These defaults provide plausible deniability for companies while satisfying law enforcement access requirements.
• The practical implications of full-disk encryption are contested. Some users prioritize data recoverability over security, preferring unencrypted drives for easy access in emergencies. Others argue that with proper backup strategies, encryption adds minimal inconvenience while significantly improving security against theft.
• Microsoft's practice of automatically enabling BitLocker during account migrations from local to online accounts has drawn criticism. Users report being locked out of their systems without consent or awareness, forced to navigate the aka.ms recovery process. This is seen as a form of data ransom, even if not monetized.
• The recovery key management process for BitLocker has been a source of confusion, particularly for non-technical users who may not realize their drives are being encrypted. The requirement to use online accounts for key recovery when users never intentionally set up encryption creates significant accessibility issues.
• Physical security concerns extend beyond simple data theft. There are warnings that attackers with physical access could plant illegal material on unencrypted drives, which could then be flagged by built-in OS scanners, creating legal risks for the device owner.
• The broader discussion reflects deep-seated tensions between security, usability, and corporate trust. While encryption technology has matured to the point of being nearly free computationally, the human factors of key management, consent, and recovery remain significant challenges that vendors have not adequately addressed.
The discussion reveals a community grappling with fundamental questions about trust in proprietary encryption systems, the ethics of responsible disclosure, and the practical trade-offs between security and usability. Historical events like the TrueCrypt shutdown continue to shape perceptions, while current practices by Microsoft regarding automatic BitLocker activation generate significant backlash. The technical vulnerabilities themselves, while notable, serve as a catalyst for broader conversations about the inadequacies of current encryption implementations and the need for better user education and consent mechanisms.