<![CDATA[So I’ve just had a quick play with this and yes, it works.]]>So I’ve just had a quick play with this and yes, it works. Essentially BitLocker has a backdoor. https://github.com/Nightmare-Eclipse/YellowKey

Mitigation = BitLocker PIN and BIOS password lock.

]]>https://board.circlewithadot.net/topic/9f5829cf-bf38-4b98-8d6e-8076f57e3420/so-i-ve-just-had-a-quick-play-with-this-and-yes-it-works.RSS for NodeThu, 14 May 2026 23:24:39 GMTWed, 13 May 2026 05:40:57 GMT60<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 20:20:16 GMT]]>@GossiTheDog
The aurhor claims that TPM + PIN is not protection.

Personally I have a hard time understanding how that could be bypassed. Thoughts?

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116569120232405418https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116569120232405418Wed, 13 May 2026 20:20:16 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 19:56:44 GMT]]>@gsuberland @GossiTheDog I think I used something like this last year. After a bios update a new Windows update fucked up my OS and the machine kept rebooting and going into recovery...

From that recovery mode I had access to the unlocked OS disk (without using the recovery key) and I was able to copy the couple of folders which were not in my backup... before I wiped the disk and did a clean install.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/sassdawe/statuses/116569027652326826https://board.circlewithadot.net/post/https://infosec.exchange/users/sassdawe/statuses/116569027652326826Wed, 13 May 2026 19:56:44 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 19:26:38 GMT]]>@GossiTheDog Okay I got it working on the desktop, even though `reagentc /info` showed that it was enabled, running `reagentc /disable` then `reagentc /enable` made the machine vulnerable

]]>https://board.circlewithadot.net/post/https://mastodon.kaisev.net/users/daigle/statuses/116568909302444738https://board.circlewithadot.net/post/https://mastodon.kaisev.net/users/daigle/statuses/116568909302444738Wed, 13 May 2026 19:26:38 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 19:13:08 GMT]]>@GossiTheDog Do you think U.S. authorities could be investigating NightmareEclipse due to their disclosures?

I imagine Microsoft is investigating internally to determine if it's someone with previous/current access to internal info that is still legally protected (by contract or law).

Based on their posts, MS might already know their identity if they have interacted with this person via MSRC and have their payment info for the bug bounty programs.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/AlesandroOrtiz/statuses/116568856258849574https://board.circlewithadot.net/post/https://infosec.exchange/users/AlesandroOrtiz/statuses/116568856258849574Wed, 13 May 2026 19:13:08 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 19:04:35 GMT]]>@GossiTheDog This doesn't work for me. I'm using an exFat Ventoy USB (it's all I have right now) on a T16 Gen 1 and a desktop. Both with TPM, no PIN.

ThinkPad - won't boot with CTRL held down, I briefly release it on the Lenovo screen. CMD pops up but C:\ is mapped to a Ventoy partition and the BitLocker partition wasn't mounted or unlocked.

Desktop - I got to CMD and C:\ was mounted but locked.

Without the USB CMD doesn't open on either PC. I might try again later with clean NTFS USB stick.

]]>https://board.circlewithadot.net/post/https://mastodon.kaisev.net/users/daigle/statuses/116568822638310429https://board.circlewithadot.net/post/https://mastodon.kaisev.net/users/daigle/statuses/116568822638310429Wed, 13 May 2026 19:04:35 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 19:00:20 GMT]]>@gsuberland @GossiTheDog Slightly easier than grabbing the key off LPC I guess.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/AMS/statuses/116568805879820061https://board.circlewithadot.net/post/https://infosec.exchange/users/AMS/statuses/116568805879820061Wed, 13 May 2026 19:00:20 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 18:53:13 GMT]]>Me and @wdormann have both recreated the BitLocker backdoor^H^H^Hvulnerability https://www.bleepingcomputer.com/news/security/windows-bitlocker-zero-day-gives-access-to-protected-drives-poc-released/

]]>https://board.circlewithadot.net/post/https://cyberplace.social/users/GossiTheDog/statuses/116568777898644704https://board.circlewithadot.net/post/https://cyberplace.social/users/GossiTheDog/statuses/116568777898644704Wed, 13 May 2026 18:53:13 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 16:49:54 GMT]]>@GossiTheDog You've probably seen this, but there were a bunch more in WinRE: https://media.ccc.de/v/39c3-bitunlocker-leveraging-windows-recovery-to-extract-bitlocker-secrets]]>https://board.circlewithadot.net/post/https://ue.oiaa.aaio.eu/objects/8ff41cfc-86de-47ef-b09b-6f4057b56422https://board.circlewithadot.net/post/https://ue.oiaa.aaio.eu/objects/8ff41cfc-86de-47ef-b09b-6f4057b56422Wed, 13 May 2026 16:49:54 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 16:30:43 GMT]]>@GossiTheDog Very interesting indeed. I only have a work laptop with windows 11 so I have no testbed. Everything else is Linux, and famliy has Macbooks. I use to be able to boot Linux from a portable ssd drive + portable hard drive on my work laptop to make a compressed backup of the entire laptop SSD, so I could just roll back to last working image. Could this exploit be used to perform some "essentials" backup that could be used to restore from a bitlocker lockout or other failures?

]]>https://board.circlewithadot.net/post/https://newsie.social/users/mdb/statuses/116568217552946776https://board.circlewithadot.net/post/https://newsie.social/users/mdb/statuses/116568217552946776Wed, 13 May 2026 16:30:43 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 15:59:24 GMT]]>@GossiTheDog I mean they already do key escrow if you link to a MSFT account right? So seems sloppy for an intentional backdoor.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/mikesiegel/statuses/116568094463186880https://board.circlewithadot.net/post/https://infosec.exchange/users/mikesiegel/statuses/116568094463186880Wed, 13 May 2026 15:59:24 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 15:58:01 GMT]]>@GossiTheDog

Link Preview Image
]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/mikesiegel/statuses/116568089010065464https://board.circlewithadot.net/post/https://infosec.exchange/users/mikesiegel/statuses/116568089010065464Wed, 13 May 2026 15:58:01 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 15:33:25 GMT]]>@berglerma @gsuberland @mkoek @GossiTheDog This is BitLocker we are talking about. There's about one yearly post somewhere online, from someone new who bypassed bitlocker with an arduino and two paperclips. It's always passive attacks on the bus.

]]>https://board.circlewithadot.net/post/https://c.im/users/pianosaurus/statuses/116567992239142979https://board.circlewithadot.net/post/https://c.im/users/pianosaurus/statuses/116567992239142979Wed, 13 May 2026 15:33:25 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 15:23:51 GMT]]>@GossiTheDog

  • it provides a login bypass, as you’re dumped as SYSTEM prior to Windows Hello or password login

Technically you're running in WinPE with unlocked 😄 drive.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/jernej__s/statuses/116567954666560839https://board.circlewithadot.net/post/https://infosec.exchange/users/jernej__s/statuses/116567954666560839Wed, 13 May 2026 15:23:51 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 15:17:19 GMT]]>@Rairii @GossiTheDog @mkoek yeah, I was just thinking "hm I should edit that post from yesterday to mention fTPMs"

]]>https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116567928974176185https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116567928974176185Wed, 13 May 2026 15:17:19 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 15:15:50 GMT]]>@gsuberland @mkoek @GossiTheDog not always - this wouldn't work with a "firmware TPM" implementation in IntelME/AMD PSP or in Pluton for example]]>https://board.circlewithadot.net/post/https://labyrinth.zone/objects/af91e389-7714-4b28-9611-4afb0bf15b58https://board.circlewithadot.net/post/https://labyrinth.zone/objects/af91e389-7714-4b28-9611-4afb0bf15b58Wed, 13 May 2026 15:15:50 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 15:11:32 GMT]]>@splinux @GossiTheDog my mom sent me an old ssd in the same situation. Haven't been able to recover her data from it so far. 😞

]]>https://board.circlewithadot.net/post/https://phpc.social/users/kboyd/statuses/116567906223246829https://board.circlewithadot.net/post/https://phpc.social/users/kboyd/statuses/116567906223246829Wed, 13 May 2026 15:11:32 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 14:51:47 GMT]]>@prsfalken @barubary @GossiTheDog they’re excellent at planning Copilot and spyware integrations, though.

]]>https://board.circlewithadot.net/post/https://haz.pink/users/can/statuses/116567828543118339https://board.circlewithadot.net/post/https://haz.pink/users/can/statuses/116567828543118339Wed, 13 May 2026 14:51:47 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 14:28:27 GMT]]>@drm @GossiTheDog Ah bah j'ai toujours cru que Bitlocker était by-design vuln aux downgrade attacks

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/S1m/statuses/116567736813129309https://board.circlewithadot.net/post/https://infosec.exchange/users/S1m/statuses/116567736813129309Wed, 13 May 2026 14:28:27 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 14:02:07 GMT]]>@GossiTheDog I suspect you have that NSA key set. 😉

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/moelassus/statuses/116567633288070417https://board.circlewithadot.net/post/https://mastodon.social/users/moelassus/statuses/116567633288070417Wed, 13 May 2026 14:02:07 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 13:46:27 GMT]]>@S1m @GossiTheDog 💪🏼. Je crois que tu confonds avec cette vuln https://github.com/garatc/BitUnlocker

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/drm/statuses/116567571630265395https://board.circlewithadot.net/post/https://mastodon.social/users/drm/statuses/116567571630265395Wed, 13 May 2026 13:46:27 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 13:28:44 GMT]]>@drm @GossiTheDog Toujours à la pointe les collègues. C'est pas un patch qui nécessite une mise à jour des certifs secureboot ça ? Le genre de mise à jour qui est toujours retardée

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/S1m/statuses/116567501985386800https://board.circlewithadot.net/post/https://infosec.exchange/users/S1m/statuses/116567501985386800Wed, 13 May 2026 13:28:44 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 13:27:01 GMT]]>@S1m @GossiTheDog testé hier par un collègue, ça marche bien ! Mais ça va être rapidement patché... 😭

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/drm/statuses/116567495274976493https://board.circlewithadot.net/post/https://mastodon.social/users/drm/statuses/116567495274976493Wed, 13 May 2026 13:27:01 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 13:12:35 GMT]]>@GossiTheDog thanks God i can recover an Old ssd whose bitlocker key is somewhere in the short-circuited mainboard Something Something Secure Module and I happen to not have a backup of that specific bitlocker key

]]>https://board.circlewithadot.net/post/https://mastodon.uno/users/splinux/statuses/116567438500507016https://board.circlewithadot.net/post/https://mastodon.uno/users/splinux/statuses/116567438500507016Wed, 13 May 2026 13:12:35 GMT<![CDATA[Reply to So I’ve just had a quick play with this and yes, it works. on Wed, 13 May 2026 12:59:45 GMT]]>@GossiTheDog

@drm Plus besoin de s'embêter à faire du TPM sniffing

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/S1m/statuses/116567388009416530https://board.circlewithadot.net/post/https://infosec.exchange/users/S1m/statuses/116567388009416530Wed, 13 May 2026 12:59:45 GMT