:warning:Microsoft Recall Security Tool Bypassed by TotalRecall Reloaded
Your Windows data just got a whole lot more vulnerable
TL;DR
A new tool called TotalRecall Reloaded can silently extract sensitive data from Microsoft's Recall feature, including text history, messages, and browsing history. This raises concerns about the security of Windows users' data.
Microsoft redesigned its Recall feature to create a secure vault with Windows Hello authentication and a Virtualization-based Security Enclave (VBS enclave). However, a new tool called TotalRecall Reloaded can bypass this security measure and extract all captured data. The tool can silently run in the background and activate the Recall timeline to force a user into authenticating with a Windows Hello prompt. Once authenticated, it can extract everything that Windows Recall has ever captured. This raises concerns about the potential impact on cybersecurity and privacy. Microsoft's changes to Recall security came after CEO Satya Nadella emphasized the importance of prioritizing security over other priorities.
Key Points
TotalRecall Reloaded can extract sensitive data from Microsoft's Recall feature
The tool can bypass Windows Hello authentication and VBS enclave
Microsoft redesigned Recall to create a secure vault with Windows Hello authentication
The Virtualization-based Security Enclave (VBS enclave) is considered 'rock solid' by the security researcher
Why It Matters
This vulnerability affects developers who use Windows and rely on Microsoft's Recall feature for data capture. For example, if a developer uses Recall to store sensitive code snippets or browsing history, they may be at risk of having that data extracted without their knowledge.
Frequently Asked Questions
Why does this matter?
This vulnerability affects developers who use Windows and rely on Microsoft's Recall feature for data capture. For example, if a developer uses Recall to store sensitive code snippets or browsing history, they may be at risk of having that data extracted without their knowledge.
What happened?
A new tool called TotalRecall Reloaded can silently extract sensitive data from Microsoft's Recall feature, including text history, messages, and browsing history. This raises concerns about the security of Windows users' data.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,134 builders reading daily.