Five‑minute BitLocker hack even after upgrading to Windows 11

The new tool BitUnlocker allows quick bypass of BitLocker protection

Researchers from Intrinsec created a working prototype (PoC) downgrade attack that decrypts BitLocker-encrypted volumes on Windows 11 in less than five minutes. The attack can be used only when physical access to the machine and a USB drive are available.

How the attack works
1. CVE‑2025‑48804 vulnerability

- One of four critical zero-day vulnerabilities discovered by Microsoft’s internal STORM team and fixed in Patch Tuesday July 2025.

- It resides in Windows Recovery Environment (WinRE) and relates to processing SDI files (System Deployment Image).

- The bootloader checks the integrity of one WIM image but allows a second, attacker-controlled image to be added. As a result, a modified WinRE loads that opens a command prompt on an already decrypted volume.

2. Signing issue

- Microsoft released a patched `bootmgfw.efi` via Windows Update in July 2025.

- Secure Boot verifies only the signature certificate, not the file version number.

- The outdated Microsoft Windows PCA 2011 certificate (signed all bootloaders until July 2025) remains trusted on almost every machine except those with a clean install after early 2026.

- A mass revocation of PCA 2011 is impossible without breaking the signatures of many legitimate files.

3. Step-by-step scenario

- The attacker prepares a modified BCD file pointing to the tampered SDI.

- The old vulnerable bootloader signed with PCA 2011 loads via USB or PXE.

- The platform TPM module issues the BitLocker volume master key (VMK) without warnings, because PCR 7 and 11 measurements remain valid under the trusted certificate.

- The system volume opens fully decrypted.

Who is at risk
- Fully vulnerable: machines where BitLocker uses only TPM without a PIN and Secure Boot lists PCA 2011 as a trusted certificate.

- Protected:

- Devices with TPM + PIN (TPM will not release VMK without user input).

- Systems updated to KB5025885 using the Windows UEFI CA 2023 certificate.

What to do now
1. Enable pre‑boot authentication with TPM + PIN – this blocks VMK retrieval without user interaction.

2. Install update KB5025885 – it switches the bootloader signature to CA 2023 and introduces revocation mechanisms that block downgrade attacks.

3. Verify certificates: use `sigcheck` to ensure `bootmgfw.efi` is signed by CA 2023, not the outdated PCA 2011.

4. Remove the WinRE partition on critical workstations where pre‑boot authentication is impossible.

5. Accelerate corporate network migration to the CA 2023 certificate before attackers start using this technique in targeted attacks.

Conclusion
BitUnlocker demonstrates that even after patches, CVE‑2025‑48804 can be exploited to bypass BitLocker if Secure Boot continues to trust an outdated certificate. Immediate measures to update and enable TPM + PIN authentication are critical for data protection.