3 ms·
This is like one or two steps away from a Mimikatz with superpowers. Add some OCR and string pattern matching to your payload and you could probably mass harves
by cess11 2y ago
This is like one or two steps away from a Mimikatz with superpowers. Add some OCR and string pattern matching to your payload and you could probably mass harvest certain interesting numbers and strings from your botnet that you previously couldn't.
- Scion9066 2y agoUh, Recall does the OCR for you already and you can just search the saved data for stuff like "password" or "credit card". It'd probably be easiest for an attacker to just upload the Recall database as soon as they gain access to the machine and then do all the processing on their own systems rather than trying to do anything that might trigger suspicions or use resources on a victim's machine.
- haswell 2y agoAnd based on initial estimates, the actual data stored by Recall is pretty small on a daily basis, making exfiltration a potentially very fast process. One researcher was able to use existing info stealer malware to exfiltrate the entire database before windows defender could kick in and remediate the issue.