A Security Researcher Says Microsoft Secretly Built a Backdoor Into BitLocker, Releases an Exploit to Prove It
Security researcher “Nightmare-Eclipse” has released an exploit called YellowKey, revealing a vulnerability that allegedly allows bypassing Microsoft's BitLocker full-volume encryption via USB and Windows Recovery Environment. The researcher claims this flaw may be an intentional backdoor built into BitLocker on Windows 11 and newer, as it involves components only found in official Microsoft recovery images, granting attackers unrestricted access to encrypted data without passwords. Third parties have confirmed the exploit's functionality, while mitigations include using alternative encryption solutions like VeraCrypt.
