When Microsoft CEO Satya Nadella revealed the new Windows AI tool that can answer questions about your web browsing and laptop use, he said one of the “magical” things about it was that the data doesn’t leave your laptop; the Windows Recall system takes screenshots of your activity every five seconds and saves them on the device. But security experts say that data may not stay there for long.
Two weeks ahead of Recall’s launch on new Copilot+ PCs on June 18, security researchers have demonstrated how preview versions of the tool store the screenshots in an unencrypted database. The researchers say the data could easily be hoovered up by an attacker. And now, in a warning about how Recall could be abused by criminal hackers, Alex Hagenah, a cybersecurity strategist and ethical hacker, has released a demo tool that can automatically extract and display everything Recall records on a laptop.
Dubbed TotalRecall—yes, after the 1990 sci-fi film—the tool can pull all the information that Recall saves into its main database on a Windows laptop. “The database is unencrypted. It’s all plain text,” Hagenah says. Since Microsoft revealed Recall in mid-May, security researchers have repeatedly compared it to spyware or stalkerware that can track everything you do on your device. “It’s a Trojan 2.0 really, built in,” Hagenah says, adding that he built TotalRecall—which he’s releasing on GitHub—in order to show what is possible and to encourage Microsoft to make changes before Recall fully launches.
They store it unencrypted in 2024? This should be illegal. Now every fucking Program you run can basically know everything you ever did since every shit is spyware nowadays to get that sweet data collection going
Even if they encrypt it, the computer needs access to the data thus needs the decryption key. So it’s not very secure anyway.
I guess the solution would involve keys on the TPM so that they shouldn’t need to be sat on attached storage or in memory. Although I’m not sure I’d trust all TPM implementations to have the performance necessary for the extra load (I believe bitlocker keys get cached in memory once you have unlocked the drive, for example)
Well yeah, but they should atleast store the key outside of userspace
The key is stored in
$APPDATA\WelcomeMat
Even if it were encrypted, if access to it doesn’t involve explicit confirmation and a password then it can be automated.
And if it can be automated then malware that gets on the machine will be able to access it whether it’s encrypted or not.
But let’s be real, the whole reason Microsoft is doing this is so they can parse your data for AI. And storing it unencrypted makes it easier for them.
Also “the data won’t leave your machine” is a red herring. Yeah the data won’t; but the results of AI processing will. They’ll take what they need and transfer that out, and leave you holding the bag.
They will have your computer calculating hyperspecific queries for ads.
I wouldn’t really call it a hacker tool any more than you would call a hammer a thieves tool.
It just accesses the data that stored in an unencrypted format on the computers hard drive.
If someone had remote access to your computer they could use this, but I imagine they could also use the official tool too.
Since the data is stored in an unencrypted fashion, a hacker who had remote access would be better served running some script that will just transfer all this data to their offsite server and could be accomplished pretty easily.
I guess what I want to really say is that calling it a “hacker tool” is misleading.
Nmap is a “hacker tool” and all it does is ask computers what ports they have open, something they are set to advertise to the world.
This is a “hacker tool” in the sense that it is accessing data in an unintended way, in the same contect as nmap using protocols intended to communicate for a set purpose to built a list of possible attack vectors.
So when I walk past some bicycles parked outside of a store, and simply use my eyes to determine if they have locks, I’m essentially a hacker.
There’s a word for that, it’s called “casing.”
Obviously not “hacking,” unless they’re locked up by a computer or some shit.
A hacker using software like that to test vulnerabilities seems similar to me in some ways.
no, your eyes are hacker tools
I wouldn’t really call it a hacker tool any more than you would call a hammer a thieves tool.
IANAL, but I’m pretty sure a hammer is a thieves tool if used in the commission of a burglary.
Those devices used by employees to remove security locks from CDs/DVDs aren’t “thieves tools” when used as intended, but when my dumb ass got caught with one while stealing from Blockbuster, the judge considered it one.
Now where did I leave my PowerGlove…
Hacker tool. What a weird name for a software that shows you readily accessible data to the user.
That was my thought when I read the title too.
I’m hoping MS pushes this “feature”; between this and the vulnerability Tenable published a few days ago, maybe some people will actually consider moving away from MS.
Who is this 4chan guy anyway?
Like you don’t know it’s the hacker in the white mask who created bitcoin.
The best part of this hacking tool is that it’s 5 lines of Python and the rest is just fluff lol
It’s just looking in a sqlite file and listing the jpeg directory. The only extra step is running
icaclsto let the user read the files.
don’t worry they’ll cancel the whole project the instant some idiot crooked corporate executive asshole gets his incriminating data stolen and used for blackmail
I saw someone on mastodon say something like, “don’t tell your IT department not to use recall to protect employee or customer data. Tell your legal department that all your recall data can be subpoenaed for discovery.”
HacKeR tOOl
Why on earth aren’t they encrypting the database? It could have adressed much of the criticism but they just decided to leave the whole thing completely unprotected.
They encrypt the damn start menu and they cannot encrypt this?
They do?
Likely because there was too much CPU overhead decrypting and having the LLM query the Recall image database all dynamically
I dunno, they could’ve kept some of it in-memory, it’s just a bunch of plaintext.
It could be that anything you encrypt has to have its encryption key in some place inaccessible to these same hacker tools. If your computer uses Bitlocker, for instance, you need to enter a 6-digit code each time you turn it on.
Best guess, they had such a high expectation of “convenience” for this feature that they couldn’t justify any kind of security key. Which is still a dumb explanation, obviously.
Skype used to store all history unencrypted for years after MS bought it, this seems to be a tradition of not caring enough
So the next step is: M$ encrypts their local database.
Later they want to upload it to their servers to further exploit your data. But then it is encrypted (and of course only M$ has the key), therefore the upload will be very hard to detect.
Hmpf.
Cool, now do remotely.
Done https://cyberplace.social/@GossiTheDog/112555262732490331
And since it lives in user space without needing nt/system, it should be as stealable over remote as any other file
Here is an alternative Piped link(s):
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.
It barely matters if the database is encrypted or not. If the user has access to it, they have the keys to it, and so would anybody else with access.
The real danger is that intruders will have access to your entire history from before they had access to your machine, and it’s all in one place.
With easily searchable text, search for “bank” and get all accounts login. Yay no need to wait for the hacked user to get on his banking site he’s been there before. Quick in and out without being noticed and you got all you need to empty his account. Thanks Microsoft I knew you where so helpful to hackers while making my life shittier all the while.
What exactly can recall see? Is it just what’s on screen?
Because, if I’m like most people when I type my password, I keep my passwords hashed on the screen as I type it.
Do you do any online banking? Do you ever log into any sort of health provider website? These are just two examples of a nearly infinite list of highly private information you would not want other people seeing.
Good points. I can see a few workarounds for this.
Stop using such services on a copmputer and go back to the old way of banking, going there physically.
Most normal people won’t use Linux, where could they go? Besides Windows? Chromeos? Probally not Google may copy and paste the concept of recall there. Mac os is too expensive, and Linix is complex to install. Where do normies go?
