BitUnlocker: Encrypted Windows media is open in minutes
A new tool called BitUnlocker can be used to defeat BitLocker hard drive encryption on Windows 11 systems within a few minutes. However, physical access to the respective computer is required.
Old weak point as a basis
The basis of the attack is the vulnerability CVE-2025-48804, which Microsoft had already closed in July 2025 as part of its Patch Tuesday. It was originally discovered by the internal research team Security Testing & Offensive Research (STORM). Like the security company Intrinsec now explained the attack can succeed despite installed patches. The attack exploits a gap between the application of a patch and the revocation of old signature certificates. Secure Boot does check the authenticity of the Windows boot manager, but only based on the certificate used – not based on the specific version number. The older “Microsoft Windows PCA 2011” certificate, which was used to sign earlier boot managers, is still considered trustworthy on many computers.
This allows attackers to load an older, vulnerable boot manager even though current security updates are installed. According to the researchers, a manipulated Windows image is integrated that automatically opens a command prompt when it starts, while the BitLocker drive is already decrypted and integrated. Neither special hardware nor extensive technical modifications are required for the attack. All that is required is physical access to the target device and a USB stick or a PXE boot server. Systems in which BitLocker is only secured with TPM protection without an additional PIN are particularly at risk. In these cases, the Trusted Platform Module releases the key without the user having to intervene.
What to do
However, systems with a TPM plus PIN configuration are protected, as additional authentication is required before starting. Computers that have already been converted to the newer “Windows UEFI CA 2023” certificate are also protected. Security experts strongly advise companies in particular to use the Microsoft update KB5025885 to install and check the boot manager certificates. In addition, if possible, an additional PIN query should be activated when the system starts. The publication of one freely available proof of concepts According to the researchers, GitHub increases the pressure on companies to quickly check their BitLocker configurations.
