Security Researcher Calls Windows 11 AI 'Recall' Screenshotting Feature a Disaster
What measures has Microsoft reportedly taken to secure the Recall feature, and why does Beaumont believe they are ineffective?
Microsoft has reportedly taken several measures to secure the Recall feature. According to the information available, Microsoft has stored the data locally on the device, and it is encrypted using BitLocker. Additionally, the data is not sent to Microsoft or advertisers, and users have the option to turn off Recall or delete any snapshots at any time.
However, security researcher Kevin Beaumont believes these measures are ineffective for a few reasons. Firstly, the data is not encrypted when the user is logged into the computer, which means it is vulnerable to malware designed to scrape data. Secondly, Beaumont discovered that the data is stored in an SQLite plaintext database, which is accessible and readable, not encrypted. He claims that the protections Microsoft has put in place are easily bypassed and an attacker could easily write a bit of software to ignore those permissions if they wanted.
Furthermore, Beaumont was able to automate a program that provides plain text data of everything a user has viewed, despite Microsoft's claims that Recall information cannot be exfiltrated remotely. He asserts that hackers are able to scrape "everything you've ever looked at within seconds," and users should prepare for "AI powered super breaches."
In summary, while Microsoft has implemented some security measures for the Recall feature, Beaumont believes they are insufficient and can be easily bypassed, leaving user data vulnerable to potential attacks.
What is the main function of the Recall feature in Windows 11 as introduced by Microsoft?
The main function of the Recall feature in Windows 11, as introduced by Microsoft, is to record and store everything that a user does on their PC, including activities in apps, communications in live meetings, and websites visited for research. It takes snapshots of the user's screen every few seconds and uses AI to analyze these snapshots, making the text and images searchable. This allows users to easily find and retrieve their past activities on their PC.
According to Beaumont, how might infostealer trojans exploit the Recall feature?
According to Kevin Beaumont, infostealer trojans might exploit the Recall feature by modifying them to support Recall. Since the OCR data from Recall is stored in an SQLite database, data from the feature can be accessed remotely by hackers using malware2. This allows them to gain access to a wealth of information, such as text messages, passwords, user interactions, and websites visited, with the exception of Microsoft Edge in Private Mode.