Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

techspot.com

Post reply on HN
Print view View original

191–200 of 280 posts

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#191

Post by solenoid0937 »

bri3d wrote: post #151
embedding-shape wrote: post #18

Seems this traces back almost a week, from Nightmare-Eclipse who is the researcher who found this: Tuesday, 12 May 2026 - "Here are the links, yes, two vulnerabilities this time [YellowKey] [GreenPlasma] [...] Next patch tuesday will have a big surprise for you Microsoft" Wednesday, 13 May 2026 - "I can't wait when I will be allowed to disclose the full story, I think people will find my crashout very reasonable and…

Previously discussed numerous times on HN, like: https://news.ycombinator.com/item?id=48130519 Whether this is a backdoor or not boils down to whatever your usual proclivities about "bug or backdoor" are; it's not like "if microsoft = 1 hack bitlocker" like the tech press seem to love to report. This is a bug in the NTFS transaction log replay functionality in the Windows Recovery Environment WinRE, where it will rea…

The author says he is able to use a similar vuln to bypass the PIN requirement. Most certainly a backdoor if true.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#192

Post by wolvoleo »

gusfoo wrote: post #172
866-RON-0-FEZ wrote: post #161

Earlier quoted context omitted.

Many brilliant people have serious mental health issues that preclude their ability to regulate their emotions and act maturely in serious situations e.g. responsible vulnerability disclosure. I've watched genius-level IQ people get fired time and again because they don't know how to work with others at a basic kindergarten level.

There is, sadly, no place for non-standard ICs in corpos nowadays. HR will enforce that.

Yeah I'm getting a lot of pressure to be a "team player" lately. I've told them over and over I'm not capable of that and that has never been a problem before. But we have a hipster new VP who is really pushy and wants to generalise everything.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#193

Post by bawolff »

PyWoody wrote: post #190
Hypomixolydian wrote: post #169

Earlier quoted context omitted.

[citation needed]

How would one cite a personal belief?

Presumably by explaining what lead to said belief.

I wouldnt of used the citation needed here meme personally, but i think its clear the poster is just asking why it should not be trusted.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#194

Post by jrflowers »

866-RON-0-FEZ wrote: post #161
mr_mitm wrote: post #54

Earlier quoted context omitted.

How would that leave them homeless?

Many brilliant people have serious mental health issues that preclude their ability to regulate their emotions and act maturely in serious situations e.g. responsible vulnerability disclosure. I've watched genius-level IQ people get fired time and again because they don't know how to work with others at a basic kindergarten level.

Adults pay rent in money, not feelings. The answer to “how could Microsoft leave you homeless?” is “by not paying you”, not some bizarre “by making you feel so bad you lose your house, which you pay for with good feelings”

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#195

Post by Hypomixolydian »

PyWoody wrote: post #190
Hypomixolydian wrote: post #169

Earlier quoted context omitted.

[citation needed]

How would one cite a personal belief?

For example pointing to the research confirming that Veracrypt is not secure somehow (if such belief has any justification in facts).

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#196

Post by Scaled »

michaelt wrote: post #108
rokkamokka wrote: post #49

Earlier quoted context omitted.

Fiasco? You mean where they voluntarily shut down rather than compromise themselves? Or are you referring to another matter?

Presumably when the authors of TrueCrypt declared “Using TrueCrypt is not secure” If I trust them to provide my FDE software, I certainly trust them when they say I shouldn’t use it.

One of the greatest cyber security mysteries of our time. Regardless of what actually happened, I hope the author is okay. (The story implied to me that the author was forced to post that, or was disappeared and the website was changed by someone else)

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#197

Post by bri3d »

solenoid0937 wrote: post #191
bri3d wrote: post #151

Earlier quoted context omitted.

Previously discussed numerous times on HN, like: https://news.ycombinator.com/item?id=48130519 Whether this is a backdoor or not boils down to whatever your usual proclivities about "bug or backdoor" are; it's not like "if microsoft = 1 hack bitlocker" like the tech press seem to love to report. This is a bug in the NTFS transaction log replay functionality in the Windows Recovery Environment WinRE, where it will rea…

The author says he is able to use a similar vuln to bypass the PIN requirement. Most certainly a backdoor if true.

I discussed this at length in the last thread: https://news.ycombinator.com/item?id=48137059

We know how PIN-locked BitLocker works, and it requires unwrapping using a key sealed behind a TPM PIN policy and stretching it using the PIN itself. So we can deduce that this would require that:

* The attacker was able to bypass the TPM PIN sealing policy _and_ brute-force the stretching applied to the decrypted key. Brute-forcing the stretch is plausible on a "lots of expensive stuff" timeline but not an easy attack. Bypassing TPM PIN policy across multiple platforms would be something quite incredible. Given that TPMs are implemented by multiple vendors across multiple fundamental architectural approaches, and aren't based on a universal reference implementation, it would be rather bizarre to find a mistake in many or all of them.

* There is a secret volume key stored on a volume which can be decrypted by another mechanism. This would be a backdoor, but seems vanishingly unlikely given the amount of research which has been applied against BitLocker historically.

* The attacker is at some point able to inject something which allows them to observe the victim applying the PIN. There could be an attack here but it isn't nearly as interesting.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#198

Post by mananaysiempre »

wolvoleo wrote: post #189
866-RON-0-FEZ wrote: post #161

Earlier quoted context omitted.

Many brilliant people have serious mental health issues that preclude their ability to regulate their emotions and act maturely in serious situations e.g. responsible vulnerability disclosure. I've watched genius-level IQ people get fired time and again because they don't know how to work with others at a basic kindergarten level.

To be honest if I got fired in a mean or unfair way I'd definitely hit back at my employer in such a manner if I'd have the ability to. I'm unlikely to have that though as I'm not aware of any saucy company secrets. But if this is what happened I think it's pretty justified. The secret here seems to be that Microsoft caches the key somewhere even when it's supposed to be only in the TPM! That's a pretty big revelatio…

> The secret here seems to be that Microsoft caches the key somewhere even when it's supposed to be only in the TPM!

Not what happened here (I reserve my judgment wrt the promised TPM+PIN exploit).

In the default TPM-only mode of BitLocker, the secret is in fact in the TPM, which will (as instructed by Windows upon key creation) release it to the correct OS running on the correct computer. Notably not in the picture is any user-provided data: measured boot is the only protection. It is only the correct programming of the OS that makes it request an account password (completely unrelated to the disk-encryption cryptography) before letting the user poke at the disk, which the OS can at that point already decrypt.

Well, turns out the programming is such that if you ask politely it’ll just pop an Administrator(?) shell.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#199

Post by zingababba »

mr_mitm wrote: post #54
krisbolton wrote: post #30

Earlier quoted context omitted.

I read it as the author is / was going through the vulnerability disclosure process with Microsoft and they're annoyed for unclear reasons and decided to publicly disclose, rather than being an insider.

How would that leave them homeless?

https://github.com/BigPolarBear1/The_story

I've been pretty convinced this is SandboxEscaper for awhile now.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#200

Post by LastTrain »

dpark wrote: post #104
cowpig wrote: post #96

Earlier quoted context omitted.

people with values different from yours, presumably

This is one it those answers that seems on the surface like it contains insight but on closer inspection it’s vacuous. This could be rewritten as “because they aren’t you”, which is true but not a meaningful or educational answer.

It was about as meaningful as the question it was answering.
Post reply on HN