How bad can the administrator privilege escalation be? A comment on Forshaw’s hacking attack on Copilot+ and Microsoft’s Recall feature
Then on Wednesday, James Forshaw, a researcher with Google’s Project Zero vulnerability research team, published an update to a blog post pointing out that he had found methods for accessing Recall data without administrator privileges—essentially stripping away even that last fig leaf of protection. “No admin required ;-)” the post concluded.
Forshaw’s blog post described two different techniques to bypass the administrator privilege requirement, both of which exploit ways of defeating a basic security function in Windows known as access control lists that determine which elements on a computer require which privileges to read and alter. One of Forshaw’s methods exploits an exception to those control lists, temporarily impersonating a program on Windows machines called AIXHost.exe that can access even restricted databases. If a hacker with the same privileges as the user were to rewrite the access control lists on a target machine, they would be able to gain access to the full database.
With Forshaw’s technique, “you don’t need any privilege escalation, no pop-up, nothing,” says Hagenah. “This would make sense to implement in the tool for a bad guy.”
On Friday, Microsoft announced that it would be making multiple dramatic changes to its rollout of its Recall feature, making it an opt-in feature in the Copilot+ compatible versions of Windows where it had previously been turned on by default, and introducing new security measures designed to better keep data encrypted and require authentication to access Recall’s stored data.
Now, security researchers have pointed out that even the one remaining security safeguard meant to protect that feature from exploitation can be trivially defeated.
Dave Aitel, founder and CEO of security firm Immunity, told WIRED that it made his security very fragile. It is possible for someone to get their entire history from your computer. Which is not what people want.
The updated set up experience of Copilot+ PCs will give people a clearer choice to opt in to save snapshots using recall, according to Pavan Davuluri, Microsoft’s Corporate Vice President. If you do not turn on it, it will be off by default.
Why a Product Is Too Dangerous to Buy? Microsoft’s Answer to Nadella’s Security Threat Prioritization Against New Features and Support for Legacy Systems
Those scandals have escalated to the degree that Microsoft’s Nadella issued a memo just last month declaring that Microsoft would make security its first priority in any business decision. “If you’re faced with the tradeoff between security and another priority, your answer is clear: Do security,” Nadella’s memo read (emphasis his). “In some cases, this will mean prioritizing security above other things we do, such as releasing new features or providing ongoing support for legacy systems.”
Microsoft intended the word recall to be used to refer to a kind of perfect, artificial intelligence-enabled memory for your device. The definition of a product being too dangerous or potentially dangerous to be left on the market is more appropriate today.
