Black Hat USA 2025 | BitUnlocker: Leveraging Windows Recovery to Extract BitLocker Secrets

In Windows, the cornerstone of data protection is BitLocker, a Full Volume Encryption technology designed to secure sensitive data on disk. This ensures that even if an adversary gains physical access to the device, the data remains secure and inaccessible. One of the most critical aspects of any data protection feature is its ability to support recovery operations in case of failure. To enable BitLocker recovery, significant design changes were implemented in the Windows Recovery Environment (WinRE). This led us to a pivotal question: did these changes introduce any new attack surfaces impacting BitLocker? In this talk, we will share our journey of researching a fascinating and mysterious component: WinRE. Our exploration begins with an overview of the WinRE architecture, followed by a retrospective analysis of the attack surfaces exposed with the introduction of BitLocker. We will then discuss our methodology for effectively researching and exploiting these exposed attack surfaces. Our presentation will reveal how we identified multiple 0-day vulnerabilities and developed fully functional exploits, enabling us to bypass BitLocker and extract all protected data in several different ways. Notably, the findings described reside entirely in the software stack, not requiring intrusive hardware attacks to be exploited. After identifying these vulnerabilities as attackers, we then took on the role of defenders. We will share the insights Microsoft gained from this research and explain our approach to hardening and further securing WinRE, which in turn strengthens BitLocker. By: Alon Leviev | Security Researcher, Microsoft Netanel Ben Simon | Senior Security Researcher, Microsoft Yair Netzer | Principal Security Research Manager, Microsoft Amit Dori | Senior Security Research Manager, MORSE Team, Microsoft Full Presentation Materials Available at: https://ift.tt/5qkCOdG

source https://www.youtube.com/watch?v=2CJl6mTtgws