Microsoft's Recall is already exploited

https://github.com/Pennyw0rth/NetExec/pull/335

by tomrod • 2 years ago

27 26 2 years ago

Wow, so using this tool, I can now remotely view the Recall database of any Windows PC? Without even knowing the person or touching their computer? Amazing! (Sarcasm)

- - -

A User can access their own data. That isn't an exploit.

sn_master• 2 years ago

Except this thing is opt-out and would put a whole lot of data on tens of millions of computers including things that were never stored by default (credit card numbers, reset codes, e2e encrypted messages etc).

Recall is a malware.

its-summertime8• 2 years ago

That is irrelevant to the topic of its security being exploited as claimed.

- - -

Most browsers beg to store credit cards by default, e2e encrypted messages are already accessible by the user (because they are one of the "ends"), reset codes are probably in most people's download folders, in the stuff-sent-to-the-printer cache, or forgotten completely (which IMO is worse)

aaronharnly• 2 years ago

I agree that exploit is a strong term here, but when you think about the next time someone in your life falls for a TeamViewer tech support scam, it makes a difference whether the scammers are getting ahold of the contents of their screen at the moment, or everything they’ve done since having the computer.

It seems obvious that MS should put Recall data behind more of an access control than “any process that can read files”.

BiteCode_dev• 2 years ago

Everytime I mess up a password, I click the "eye" button to reveal it if I'm alone, so it will likely go into the screenshot.

I type totp code that will be valid for 2 minutes, and they are clear.

I have emails, account numbers and emails.

I have contacts of my network, sites I visits regularly and nick names I use. Sometimes I paste sensitive content in encrypted chats, but hey, now they are in the screenshot.

Then there are nude pics of partners, intimate journaling notes, porn activity, how much I have in the bank, contracts with clients under nda, legal and illegal drugs I order, political alliances, and all the stupid stuff I may do...

All that conveniently centralized and searchable.

38• 2 years ago

you seem to be intentionally downplaying the dangers of this software, under the guise of pedantry. please stop.

wormius2• 2 years ago

I don't think this is the case, but it sure seems like something actual scammers would come into forums to downplay. "Relax guys! There's no problem, it's tooooootally safe, trust MS! wink wink."

its-summertime8• 2 years ago

You are correct about the downplaying. I do not see how this adds any appreciable danger in terms of data stored, that isn't already extremely accessible in a place on the computer with the same permissions that exist for Recall.

In turn, I do not see people complaining about Firefox storing all your browsing history in plain text, your chat history in cache files, so on and so forth.

haswell4• 2 years ago

This is missing the point, and I'd strongly recommend reading Kevin Beaumont's findings presented as a Q&A style post about Recall [0].

This kind of poorly controlled local access makes it significantly more dangerous to use a Windows PC, because it significantly increases the harm/value of info stealing malware and will increase the degree of interest in penetrating windows systems. The fact that it's enabled by default is horrific, especially when you consider that the people most vulnerable are also the least likely to understand or disable the feature.

Before, info stealers would look for specific words/phrases in documents because anything more would be bandwidth/compute prohibitive. Now, such stealers just need to pull the Recall DB, and all of the juiciest information is served up on a platter.

To prove his point, Kevin deployed a piece of common info stealing malware and it was able to exfiltrate the Recall data before Windows Defender could remediate the issue.

This would still be a dangerous architecture even if Windows had a reputation for being impenetrable. Given the reality, this architecture is incomprehensibly bad.

- [0] https://doublepulsar.com/recall-stealing-everything-youve-ev...

its-summertime8• 2 years ago

I read the blog post and all I could feel was that if someone did the equivalent of running `chmod -R a+rwX ~` and then running an unauthenticated ssh server. Then yeah, they might have some security problems seen in that post. Their computer is probably already FUBAR from doing this as a habit though so...

cess11• 2 years ago

This is like one or two steps away from a Mimikatz with superpowers. Add some OCR and string pattern matching to your payload and you could probably mass harvest certain interesting numbers and strings from your botnet that you previously couldn't.

Scion9066• 2 years ago

Uh, Recall does the OCR for you already and you can just search the saved data for stuff like "password" or "credit card". It'd probably be easiest for an attacker to just upload the Recall database as soon as they gain access to the machine and then do all the processing on their own systems rather than trying to do anything that might trigger suspicions or use resources on a victim's machine.

timmytokyo• 2 years ago

The "Recall" feature has been designed and rolled out in such a shoddy matter that I don't know if you can even call this an "exploit" in the traditional sense. As designed, Recall is irresistible bait for bad actors who will inevitably craft all sorts of methods to harvest its data for the purposes of theft and blackmail.

Microsoft deserves all the opprobrium it's getting over this galactically stupid idea.

lawlessone2• 2 years ago

I can see Microsoft pulling this feature as the backlash picks up.

But they'll try again

yencabulator• 2 years ago

This came out about the same time as you wrote your comment: https://news.ycombinator.com/item?id=40610435

Microsoft's Recall is already exploited

Related Stories