Copilot‘s screen-snapping Recall data stored in plain text


Researchers have scorned the safety implications of Microsoft's Recall feature, pointing out that the tech behemoth will set cybersecurity back a decade and empower cybercrooks.

The wave of ridicule washing over Microsoft‘s decision to screenshot everything users do is far from receding. While the tech behemoth tried quashing criticism by claiming that attackers won't be able to remotely access screenshots, researchers think otherwise.

According to Kevin Beaumont, a cybersecurity researcher and former senior threat intelligence analyst at Microsoft, Recall-collected information is stored on an SQLite database. Moreover, anyone with administrator-level access, a default setting for most Windows users, can view the data.

“Microsoft told media outlets that a hacker cannot exfiltrate Copilot+ Recall activity remotely. Reality: how do you think hackers will exfiltrate this plain text database of everything the user has ever viewed on their PC? Very easily, I have it automated,” Beaumont shared on X.

Beaumont lamented Microsoft’s claims that attackers would have to have physical access to the device if they wanted to steal Recall data. While Recall-specific malware might not exist yet, given the sensitivity of the data it collects, attackers will be incentivized to roll up their sleeves.

For example, Beaumont claims to have tested the feature with messaging apps like WhatsApp, Signal, and Teams. While these apps allow for encrypted communications and disappearing messages, Recall takes screenshots of conversations, raising severe concerns about privacy.

“Somebody message you with disappearing messages? They're recorded anyway. Write a disappearing message? It's recorded. Delete a message? It's recorded,” Beaumont wrote.

Microsoft introduced Recall with its new batch of AI-driven personal computers, Copilot+. Satya Nadella, Microsoft's CEO, compared the Recall feature to the device's “photographic memory.”


More from Cybernews:

In search of comfort in the cord: the enduring appeal of throwback tech

OpenAI blocks multiple attempts by US adversaries to misuse its AI

TikTok to give independent copy of core algorithm to US

Ticketmaster hit with class action suit over massive data breach

Data of 30M Santander customers for sale, ShinyHunters take the spotlight

Subscribe to our newsletter



Leave a Reply

Your email address will not be published. Required fields are markedmarked