Home / Technology / Microsoft's Recall Flaw: Data Vault Breached
Microsoft's Recall Flaw: Data Vault Breached
15 Apr
Summary
- New tool bypasses Recall's secure vault, exposing sensitive data.
- Microsoft claims existing controls prevent vulnerabilities.
- Security expert argues Recall's design still allows malware access.
Microsoft's AI-powered Recall feature, designed to screenshot user activity, is once again facing scrutiny over security vulnerabilities. A new tool, TotalRecall Reloaded, has been developed to exploit weaknesses in Recall's data vault. This tool can allegedly extract all captured data after a user authenticates, a scenario Microsoft claimed its redesigned security measures would prevent.
Recall's enhanced security includes a secure vault and Windows Hello authentication. Microsoft stated this restricts malware attempts. However, security researcher Alexander Hagenah demonstrated that TotalRecall Reloaded can bypass these protections. The tool forces authentication and then extracts data, contradicting Microsoft's claims about preventing latent malware access.
Microsoft has stated that the reported access patterns align with existing controls and do not represent a security bypass. They cited timeout protections limiting malicious queries. Hagenah disputes these claims, asserting the timeout can be bypassed and that the enclave does not prevent malware from accessing data.
While the tool can also wipe capture history or extract the latest screenshot without authentication, malware could achieve similar outcomes independently. Microsoft argues that normal Windows processes allow code injection, creating opportunities for abuse. The core issue, according to Hagenah, is that decrypted content is sent to unprotected processes, undermining the vault's security.
