5 ms·

What would prevent a virus from directly stealing the data it wants without going through this feature?

by paxys 2y ago

djmips 2y ago
Just like in biology a virus can be simpler if it can co-opt existing machinery.
- buildbot 2y ago
  I agree, the ability to take screenshots is unsafe and should be removed. A virus is just a PRT SCRN away from stealing everything! (/s)
  - genevra 2y ago
    You realize sneaking in code to arbitrarily exfiltrate user data is much simpler if a trusted source (in this case Recall), is doing the collecting
ndiddy 2y ago
Without Recall, an attacker needs to get a program to stay resident in memory to log keystrokes, screen contents, etc. for an extended period of time without getting detected. With Recall, they can get the same end effect by exfiltrating the Recall database file whenever it's convenient (i.e. an infected version of a text editor could send it while pretending to check for updates). This significantly lowers the barrier to entry for getting a victim's data, while also making it much easier to avoid detection.
- drexlspivey 2y ago
  > Without Recall, an attacker needs to get a program to stay resident in memory to log keystrokes, screen contents, etc Or it could just steal your cookies which are out there in the open.
  - haswell 2y ago
    Cookies are of relatively low value compared to a database of everything the user has typed and seen.
    - wvenable 2y ago
      What value is that? My auth cookies are far more valuable than anything I typed out in the open today.
      - haswell 2y ago
        Your auth cookie expires. The username/password you type in next time it expires is far more valuable. And it might not even be necessary to obtain cookies or credentials if I can just see whatever you could see when you’re logged into various sites.
        wvenable 2y ago
        This is all moot anyway because Microsoft has already said they are now going to encrypt everything behind Windows Hello making it as secure as my password manager.
        haswell 2y ago
        Microsoft has made misleading statements regarding encryption [0] and it doesn’t help much. Encryption at rest doesn’t much matter if the user being logged in is enough for the data to be decrypted. This is the context malware runs in. https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e https://doublepulsar.com/recall-stealing-everything-youve-ev...
        wvenable 2y ago
        That's old information. This is how Microsoft is intending to change Recall based on these criticisms: Microsoft will also require Windows Hello to enable Recall, so you’ll either authenticate with your face, fingerprint, or using a PIN. “In addition, proof of presence is also required to view your timeline and search in Recall,” says Davuluri, so someone won’t be able to start searching through your timeline without authenticating first. This authentication will also apply to the data protection around the snapshots that Recall creates. “We are adding additional layers of data protection including ‘just in time’ decryption protected by Windows Hello Enhanced Sign-in Security (ESS) so Recall snapshots will only be decrypted and accessible when the user authenticates,” explains Davuluri. “In addition, we encrypted the search index database.” https://www.theverge.com/2024/6/7/24173499/microsoft-windows-recall-response-security-concerns https://www.theverge.com/2024/6/7/24173499/microsoft-windows...
godelski 2y ago
Virus turns on recall, user might not notice much. A real Microsoft service is running. It can then just wait and activate later. If the user notices recall on, they'll just blame Microsoft. You can then just turn it on again. You can already see that many users are suspect that it'll go back to being on by default sometime in the future too. It's not uncommon to see system updates change settings. The virus doing the same things as recall will be much noiser and much more suspicious. Making it much more likely to be removed. Not to mention that once recall has been running a virus only needs to extract the data. It records far more than what a password manager does and is far easier to search through. It just makes a very large attack surface. Basically, why would anyone develop keyloggers anymore? Microsoft did it for you. And it'll never be tripped by antivirus software because it's an official and legitimately signed program. You don't see a problem with this?

What would prevent a virus from directly stealing the data it wants without going through this feature?

by paxys 2y ago

What would prevent a virus from directly stealing the data it wants without going through this feature?

djmips 2y ago

Just like in biology a virus can be simpler if it can co-opt existing machinery.

buildbot 2y ago
I agree, the ability to take screenshots is unsafe and should be removed. A virus is just a PRT SCRN away from stealing everything! (/s)
- genevra 2y ago
  You realize sneaking in code to arbitrarily exfiltrate user data is much simpler if a trusted source (in this case Recall), is doing the collecting

ndiddy 2y ago

Without Recall, an attacker needs to get a program to stay resident in memory to log keystrokes, screen contents, etc. for an extended period of time without getting detected. With Recall, they can get the same end effect by exfiltrating the Recall database file whenever it's convenient (i.e. an infected version of a text editor could send it while pretending to check for updates). This significantly lowers the barrier to entry for getting a victim's data, while also making it much easier to avoid detection.

drexlspivey 2y ago
> Without Recall, an attacker needs to get a program to stay resident in memory to log keystrokes, screen contents, etc Or it could just steal your cookies which are out there in the open.
- haswell 2y ago
  Cookies are of relatively low value compared to a database of everything the user has typed and seen.
  - wvenable 2y ago
    What value is that? My auth cookies are far more valuable than anything I typed out in the open today.
    - haswell 2y ago
      Your auth cookie expires. The username/password you type in next time it expires is far more valuable. And it might not even be necessary to obtain cookies or credentials if I can just see whatever you could see when you’re logged into various sites.
      - wvenable 2y ago
        This is all moot anyway because Microsoft has already said they are now going to encrypt everything behind Windows Hello making it as secure as my password manager.
        haswell 2y ago
        Microsoft has made misleading statements regarding encryption [0] and it doesn’t help much. Encryption at rest doesn’t much matter if the user being logged in is enough for the data to be decrypted. This is the context malware runs in. https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e https://doublepulsar.com/recall-stealing-everything-youve-ev...
        wvenable 2y ago
        That's old information. This is how Microsoft is intending to change Recall based on these criticisms: Microsoft will also require Windows Hello to enable Recall, so you’ll either authenticate with your face, fingerprint, or using a PIN. “In addition, proof of presence is also required to view your timeline and search in Recall,” says Davuluri, so someone won’t be able to start searching through your timeline without authenticating first. This authentication will also apply to the data protection around the snapshots that Recall creates. “We are adding additional layers of data protection including ‘just in time’ decryption protected by Windows Hello Enhanced Sign-in Security (ESS) so Recall snapshots will only be decrypted and accessible when the user authenticates,” explains Davuluri. “In addition, we encrypted the search index database.” https://www.theverge.com/2024/6/7/24173499/microsoft-windows-recall-response-security-concerns https://www.theverge.com/2024/6/7/24173499/microsoft-windows...

godelski 2y ago

Virus turns on recall, user might not notice much. A real Microsoft service is running. It can then just wait and activate later. If the user notices recall on, they'll just blame Microsoft. You can then just turn it on again. You can already see that many users are suspect that it'll go back to being on by default sometime in the future too. It's not uncommon to see system updates change settings. The virus doing the same things as recall will be much noiser and much more suspicious. Making it much more likely to be removed. Not to mention that once recall has been running a virus only needs to extract the data. It records far more than what a password manager does and is far easier to search through. It just makes a very large attack surface. Basically, why would anyone develop keyloggers anymore? Microsoft did it for you. And it'll never be tripped by antivirus software because it's an official and legitimately signed program. You don't see a problem with this?