New unpatched GreatXML exploit bypasses Windows BitLocker encryption

The researcher known as Nightmare Eclipse has published a second unpatched Windows exploit in two days, this one defeating BitLocker disk encryption. Called GreatXML, it abuses the Windows Defender Offline Scan feature: any machine that has ever run an offline scan is left permanently vulnerable. An attacker with physical access copies a crafted unattend.xml file and a Recovery folder to the recovery partition, reboots into the Windows Recovery Environment with Shift plus Restart, and gets a privileged shell with full access to the encrypted drive, no login needed. Proof-of-concept code is public on GitHub, there is no patch yet, and Microsoft says it is investigating.

Check

Identify Windows devices protected only by BitLocker without a startup PIN, especially laptops that travel, and check whether Windows Defender Offline Scan has ever been run on them.

Affected

Windows devices using BitLocker where a Defender Offline Scan has run at least once; an attacker with physical access to the machine can reach the encrypted volume. No patch yet.

Fix

Require a TPM-plus-PIN or startup password for BitLocker so pre-boot recovery cannot be abused, restrict physical access to devices, and watch for a Microsoft fix to apply once released.