A public proof-of-concept (PoC) exploit has now been released, highlighting the severity of the risk to millions of Windows devices relying on BitLocker without pre-boot authentication. A critical vulnerability in Microsoft’s BitLocker full disk encryption, demonstrating that it can be bypassed in under five minutes using a software-only attack dubbed “Bitpixie” (CVE-2023-21563). Organizations relying solely on TPM-based BitLocker protection are urged to review their security posture immediately and deploy pre-boot authentication to safeguard sensitive data. Unlike traditional hardware-based attacks, which require physical tampering, soldering, or specialized equipment, the Bitpixie vulnerability enables attackers to extract BitLocker’s Volume Master Key (VMK) entirely through software. The attack’s speed and non-invasive nature make it a significant risk, especially in scenarios involving lost or stolen laptops protected only by TPM-based BitLocker without additional authentication. “The Bitpixie vulnerability – and more generally both hardware and software-based attacks – can be mitigated by forcing pre-boot authentication,” researchers emphasize. The Bitpixie vulnerability exposes a high-risk attack path against BitLocker encryption, with a working proof-of-concept now available. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The primary mitigation against Bitpixie and similar attacks is to enforce pre-boot authentication, which requires a PIN, USB key, or key file before the system boots. This non-invasive method leaves no permanent trace and does not require a complete disk image, making it particularly attractive for red teamers and adversaries targeting stolen or unattended laptops. This development underscores the need for robust authentication measures and highlights the dangers of relying on default configurations for disk encryption. For systems that block third-party signed components (e.g., secured-core PCs), attackers can use only Microsoft-signed components.PXE boot into Windows Boot Manager again with a modified BCD. A newly discovered malicious Python package, solana-token, has been weaponized to steal source code and sensitive secrets from developers working on Solana blockchain applications. The public PoC released by researchers automates these attack chains, allowing for rapid compromise-often in less than five minutes.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 15 May 2025 06:30:20 +0000