PcTattletale leaks victims' screen recordings to entire Internet

https://www.ericdaigle.ca/pctattletale-leaking-screen-captures/

by nneonneo • 2 years ago

195 79 2 years ago

ericdaigle.ca

junniper3• 2 years ago

Yeesh.

Is it still considered a “vulnerability” if the door is built without locks? Or even a handle.

ronsor2• 2 years ago

"What door?"

junniper3• 2 years ago

Doors with locks are often a metaphor for security.

In this case the “door” is this company’s API.

Considering the context of the original post what did you think my comment meant?

rinze• 2 years ago

Is that the codename for Windows 11?

ronsor2• 2 years ago

Based on the functionality, I'd think it's the codename for "Copilot Plus" or whatever it's called now.

supernes• 2 years ago

What a wild story. From one of the linked reports:

it took Fleming over 20 hours to take the defaced website offline, but the long time was not for lack of trying: his own spyware recorded him clumsily attempting to restore the site fairly early on but ultimately failing to do so. while pcTattletale itself has now been entirely down for a few hours, the sending of screenshots to the s3 bucket continued until Flemings aws account was locked down by amazon shortly before publishing this article.

e_daigle• 2 years ago

I'm the author of the blog post - the exploit is so simple it kind of speaks for itself, but if anyone has any questions feel free.

sizzle• 2 years ago

Thanks for the write up

buran774• 2 years ago

The even more worrying thing for anyone considering any solutions which do such mass surveillance, regardless of motive (like Windows Rewind). They're all one or two steps removed from massive scale access to these recordings. All of the steps have happened repeatedly in the past. The only way to be safer is not keep that data in the first place.

the tiny shell lets anyone execute abitrary php code by simply setting a cookie. what makes this file such an interesting find, though, is that the shell has been present since at least december 2011 (which is when the site got moved to its current server). it is impossible to tell whether this shell was placed there by pcTattletale (for whatever reason) or by a threat actor; either way, it reveals that pcTattletale has been backdoored for basically forever and may have had data exfiltrated from it for years by external actors

dgellow7• 2 years ago

Windows Recall is stored locally and encrypted from what I understood

dorkwood• 2 years ago

Yes. I've heard it's unhackable. We are in good hands.

buran774• 2 years ago

Until a year or two later when MS rolls out the feature of "AI" on "your data". Or gives the option/default to store the recording on OneDrive. Or any number of options that MS can monetize somehow while selling it as a benefit for you. How many massively popular feature requests sit on the waiting list every day while this one comes out of the blue despite almost no user ever asking for it, and it's for you?

Rewind is the house's foundation, the rest of the walls come later. How fast they come depends on what the CEO sees as the future of making money.

Having these recordings is a liability more than it is a productivity boost. People today don't operate computers under the assumption they are recorded at all times even if they know the feature is there. So of course it's dangerous.

One day, when you'll be thoroughly used to being surveilled at all times, having Rewind-like features will be as ubiquitous or as normal as walking around today with a GPS tracker, microphone and spy cam in your pocket, for someone else to use. Something equally unacceptable some decades ago.

squigz2• 2 years ago

Until Microsoft wants to start using that data, or is compelled to hand it over.

jocoda• 2 years ago

I'm all for tools like this if they allow me to review my activity, especially if that's across the multiple systems I use, to get a handle on how and where I spend my time.

It's not a surprise that Microsoft and Apple are determined to get us to use their cloud products for our personal data - there's billions up for grab.

bayindirh3• 2 years ago

Its keys or the token which gets the key from the TPM will probably be memory resident. I don't see encryption as a barrier to get relevant information.

In the future, if I know Microsoft, this trove will be mined for "consumer oriented optimization and improvement of Windows Experience". This means at least a DLL or more probably an API will be present to tap into that data, which can be (ab)used by third parties.

So, even if it's stored locally and be encrypted at rest, it doesn't mean it'll be completely unavailable to Microsoft or third parties.

Oh, lastly, I'm sure that there'll be at least one forensics company which will build a tool to dump this data, making governments do a little happy dance.

a01232• 2 years ago

That's fine then because no one has ever managed to get around a single security measure, especially not in the world of computing.

TiredOfLife2• 2 years ago

Also newer ever make any notes or take any photos/video of anything. Talk only face to face in a cone of silence.

buran774• 2 years ago

The sarcasm made an already shaky point even worse.

There's a huge difference in magnitude here (writing a note vs. screen grabbing everything you ever do on the computer), and also a difference of awareness (intently recording one moment in time with a photo vs. almost unconsciously being recorded all the time even if you enabled it).

These simplistic fallacies are the result of very superficial assessments. Either an apparently small mistake leads to a wildly wrong conclusion (being overheard once is the same as being overheard all the time, because overheard is overheard), or everything is justifiable in small increments so you just loop through them as many times as it takes to get to a wildly unacceptable result (if one photo is ok, then two photos are ok, and just iterate it until you get 30 photos per second of constant video surveillance, you just said you're fine with one more photo).

Bottom line being you won't get anything of value out of such a conversation. I know I don't.

VS19992• 2 years ago

This dismissive, snarky one-liner only works if people already overwhelmingly agree with you. Most people are tired of companies adding more and more surveillance "features" and grew up in a time that set a higher bar for how much privacy they're willing to give away. A user taking a note? Sure. The OS recording everything you do 24/7 to send through an AI? Maybe we need new legislation to address your behavior.

Renaud2• 2 years ago

Isn't MS Rewind/Recall supposed to be encrypted and offline, on-device only? I don't see how it could be anything else and pass any data-protection regulation (in the EU, at least).

It's a hazard and its usefulness needs to be balanced with other needs, but on a work machine that belongs to me, it could be useful. Now, if my boss has unfettered access to this data, or any of it is online, then obviously it's a no no.

Understanding the implications of tools like this is necessary. I'm not too optimistic that the general user will fully understand these implications though. That's one of the main danger with these technologies: promises are made, people don't think twice and overshare, and the data is used against their interests.

However, I want it to exist, MS or Open Source, preferrably, but only if I get 100% control over it, and it is never accessible to anyone else.

Having said that, I'm very much aware that most implementation of these tools will become a security and surveillance nightmare.

The next few years are going to be interesting, and probably frightening.

sandworm1013• 2 years ago

> Isn't MS Rewind/Recall supposed to be encrypted and offline, on-device only?

From what I have been reading, the raw data is meant to remain local (the screen recordings) but I am unclear about the indexed AI-generated metadata. For instance, if the AI identified that you used X software at Y time to complete Z task, are the XYZ tags kept local or archived elsewhere? That might not violate many privacy rules. Either way, they certainly could be uploaded/shared very easily should Microsoft's policies change. I guess it is down to how much we all trust Microsoft long term.

Personally, I will never accept someone recording my screens. In fact, running any such software on my work machine would violate a host of professional rules.

loeg• 2 years ago

If the data can be accessed by the user, it can be accessed programmatically -- no? It's available locally for something malicious to exfiltrate.

mrangle• 2 years ago

I don't see how it could be anything else and pass any data-protection regulation
Having said that, I'm very much aware that most implementation of these tools will become a security and surveillance nightmare.

The contradiction of the quoted statements nullifies anyone's ability to make sense of the theme in the post.

urbandw311er• 2 years ago

So 17Tb of screenshot data from the last 7 years is doing the rounds in the wild? An AI will have a field day extracting whatever kinds of specific juicy details an attacker could ever want.

“Give me a list of all the credit card numbers” “Give me any emails where somebody is asking a lawyer to block publication of something” Etc

squigz2• 2 years ago

I don't think the AI's day is going to be any different, really.

araes• 2 years ago

Notably other issues (from the publisher):

pcTattletale is a discreet and powerful tool that records and shows you the online activities of your employees and children. (emphasis mine)

Work computers with work secrets and children's computers with children's data. 17,000,000,000,000 bytes of such data. Maybe 5,000,000 screens if it was "normal" cell images. (Based on say a 3 MB screen, which might be large. If it's all XGA, or SXGA, or something, it may be way more screens.)

rgmerk4• 2 years ago

This kind of thing has happened repeatedly, but kinda misses the point.

Stalkerware is designed and built as a tool of abuse. The people who create it are looking to profit off that abuse.

More effort should be devoted to prosecuting these bottom-feeders.

TiredOfLife2• 2 years ago

US and other countries are moving to classify more and more things as "not a crime" like car theft or shoplifting. So don't hold your hope up.

ziddoap• 2 years ago

Can you back this up somehow?

I haven't heard of or seen anything indicating that the US, or any other country, is trying to make car theft or petty theft legal.

rgmerk4• 2 years ago

Not taking sides on this one because I don’t live in San Francisco and haven’t had the chance to look into these claims.

But on the issue of domestic and family violence, where I live in Australia it has become a major political issue, and there have been significant changes to law and policy to try and reduce the risks.

In this case, we are dealing with a relatively small number of people selling a product intended to facilitate what is recognised in most jurisdictions as a serious crime. As such, putting more effort into finding and prosecuting (or suing) these people seems like a worthwhile investment - but because it’s a global market there needs to be global cooperation to achieve much.

badgersnake• 2 years ago

All the users password hashes (in MD5, so basically their plaintext passwords) got leaked as well.

mmsc• 2 years ago

  what makes this file such an interesting find, though, is that the shell has been present since at least december 2011

It's really easy to change the creation date of a file by changing the system clock for a millisecond, and create a file, before changing the clock back to normal. Some people like to do this to avoid their back doors being found by IR doing a "find" for any newly created files.

zaxomi• 2 years ago

No need to change the system clock for a millisecond. The operating system has an API for changing allt the timestamps of a file.

vitus• 2 years ago

Indeed, that's what `touch -t 201101020304 /tmp/old-file` is for. (Although on ext4 it seems that you can't control the birth time; for that you would need to set your system clock.)

gigatexal• 2 years ago

Just in time for Microsoft Rewind or whatever it’s called.

userbinator• 2 years ago

Unfortunately there are 86400 timestamps per day, so enumerating this across all days and all devices would take forever.

Instead we'll use a heuristic: we'll start with the last screenshot and subtract one second at a time, downloading from each and seeing if we get a valid photo or the error XML that comes up if no screenshot was taken at that second. If we get the error XML 20 times in a row, we'll assume the recording is over and give up.

Binary search?

abtinf3• 2 years ago

This, and the other stalkerware linked to in the article, is what everyone on iOS can look forward to thanks to the EU.

EMIRELADERO• 2 years ago

Care to elaborate? I thought Chat Control laws and similar were deemed "unconstitutional" by the ECHR

abtinf3• 2 years ago

Sideloading.

wackget• 2 years ago

You mean the ability to install your choice of software on a device that you own is dangerous????? Someone should tell the authors of literally every other operating system ever made about this astonishing discovery!

abtinf3• 2 years ago

They should. Every major platform has this issue pervasively, except for iOS.

People like you have decided that you own my phone, not me. You get to tell me and Apple how I have to use my phone, just because you don’t like that my choice of software is a locked down device.

justin_oaks• 2 years ago

the pcTattletale client api returns raw aws credentials. it's intended to allow screenshots to be directly uploaded to the storage bucket, which is already terrible enough on its own, but it's worsened by the fact that these credentials are the same for all devices and provide full unscoped access to Fleming's aws infrastructure

(From the Maia arson crimew blog post linked in the article)

This is my favorite part of the story. This is one of the worst decisions you can make when developing an app that uses cloud resources.

It's so pathetic that it makes me wish that we could revoke someone's license to write code.

halfcat2• 2 years ago

It appears that this is installed to the path below on Windows, if you want to check if it’s running on your PC:

C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler

Using one of these executable names:

mssched.exe

jusched32.exe

imchillyb• 2 years ago

My Grandfather: "Don't write anything down that you don't want others to see."

Those words have been with me since I was 8 years old. The truth of them resounds throughout history, and well into the distant future.

Ignore them at your peril.

PcTattletale leaks victims' screen recordings to entire Internet

Related Stories