Microsoft's Recall feature screenshots your desktop to let you review past activity, but security researcher Alexander Hagenau showed attackers with user-level access can extract these images. The speaker argues Microsoft's safeguards are insufficient and calls for secondary authentication, opt-in defaults, and involvement of security experts before release.
Chapters
Microsoft has created the Recall tool, and it will be released in a new version of their operating system, and it's intended to benefit the users. It essentially takes screenshots of what the user is doing over a period of time so that the user can dial that back and see what they were doing, or recall what they were working on. But the problem is it probably has more value to attackers, data brokers, digital extortionists, and others who would use that information to the detriment of the user. In fact, the privacy concerns on this is off the chart. And unfortunately, the security controls protecting Recall, well, they're really not doing the job. Security researcher Alexander Hagenau created a tool that showed how those screenshots that Recall gathers can be exploited and exposed. Now, Microsoft's been informed of this, and their response is, well, to defend the design, saying that an attacker would need to at least have user permissions and physical access to be able to get to that data. Now it's, the former is probably true in regards to user permissions, which aren't that high on the system, but the latter probably can be worked around by the attackers. So the real issue is the fact that if an attacker does get a foothold on the device, which means it's logged in from that user, they would be able to access all this potentially valuable data. And at the very least, what needs to happen is there needs to be better security. There needs to be some kind of secondary authentication that should be implemented around accessing that data. And I would like to see other limitations put in place, such as not capturing screenshots of Windows when submitting credentials, uh, or if someone's using a privacy browser. Don't capture that window. Or what if they're accessing sensitive data or sensitive third-party data? That window should not be captured. It's probably enough for a user to dial back and see what windows are at least open, even if they can't see the contents, and that should give them what they're looking for. But there should also be other indications or notifications. Uh, for example, when your camera is active and let's say you're, chatting with somebody on a video call or something of that sort, images are being taken of that. So there probably should be some notification or that information should be blocked out of any of those images. Additionally, this whole feature should be disabled by default, which means users, when they upgrade their version of Windows, should have to opt in to turn this on. Otherwise, we're gonna have a slew of users that just don't know the fact that all their activities are being tracked by their PC, including what browsing sites are going to, who they're communicating with, and what those communications are. Now, my position from a cybersecurity strategist perspective is very, very straightforward. If you're going to develop a desktop surveillance system which is what this capability really is, well, then you're gonna have to wrap it with some very strong security, far above what is standard for the system or regular applications. Such a tool can be powerful. It can be catastrophic in the hands of cyber criminals or any type of malicious hacker, data harvesters, and even Insiders. So Microsoft, before you cut this loose and release it into your operating system, I think you need to go back to the drawing board. I think you need to bring in security architects and security knowledgeable people. I'm not talking about engineers who know how to code securely. I'm talking about seasoned veterans that understand the security industry. In battling against intelligent adversaries. Bring those people on the team, have them take a look, and you better have privacy people taking a look at what's being captured and what controls are there and what notifications the end users are having and third parties who the system may be drawing in, like on a video conference call, how they're gonna get notified that yes, they're also being captured without potentially their inputs. So please, before you release it, go back to the drawing board, get the right people involved, get the right security, privacy, and ethical controls in place so that this tool can actually be beneficial and greatly minimize the risk of misuse or abuse. If you like this kind of content, please subscribe and you'll hear more.
