Windows YellowKey & GreenPlasma Zero-Days Released

A security researcher has publicly released details on two critical Windows zero-day vulnerabilities, dubbed YellowKey and GreenPlasma, according to SecurityWeek. These exploits represent significant risks that defenders must understand and mitigate immediately.

YellowKey is a BitLocker bypass that requires physical access to the target system. While physical access might seem like a high bar, it’s a critical threat for devices in sensitive environments or those prone to theft. Attackers gaining physical control can circumvent disk encryption, exposing sensitive data thought to be protected. GreenPlasma, on the other hand, is an elevation of privilege (EoP) vulnerability enabling attackers to gain System-level access. This is the holy grail for post-exploitation, allowing full control over a compromised machine.

The combination of these two vulnerabilities paints a grim picture. An attacker with physical access could potentially bypass BitLocker and then use GreenPlasma to achieve full system compromise. This isn’t theoretical; this is a clear attack chain. Defenders need to assess their physical security controls and ensure endpoint hardening goes beyond just disk encryption.