Researchers Say Malware Can Manipulate Windows Recall

Researchers have discovered that malware can exploit Microsoft's new Windows Recall feature to steal sensitive user data. Windows Recall, which is part of Microsoft's new Copilot+ PCs, captures regular screenshots to help users retrieve previously seen content through natural language queries. However, this tool's potential for misuse has alarmed cybersecurity experts.

Marc-André Moreau, a cybersecurity researcher, demonstrated that Recall stores data in an unencrypted SQLite database, making it a prime target for attackers. "It's disappointing to see such a powerful feature not taking security more seriously," Moreau said in a post on Linkedin. Cybersecurity expert Alexander Hagenah echoed his concerns and has developed an open-source tool called TotalRecall to show how easily data can be extracted from Recall's database. Speaking to SecurityWeek, Hagenah added, "I hope Microsoft will address this before the official release.” Security expert Kevin Beaumont also noted that infostealers could be easily modified to grab data from Recall.

Microsoft has issued assurances that physical access and valid credentials are needed to obtain Recall data, but the concerned researchers seem to have proven this claim to be unreliable.

The company’s chief scientist Jaime Teevan was reluctant to address privacy concerns during a discussion at Stanford's Institute for Human-Centered Artificial Intelligence. When pressed, Teevan confirmed that Recall data is stored locally and not uploaded to the cloud, but this does little to alleviate the risk of local data breaches.

As vpnMentor previously reported, Recall has raised significant data privacy concerns from its inception. The introduction of the feature has sparked a backlash from privacy advocates, with experts likening Recall to spyware due to its extensive data collection capabilities. Critics argue that the unencrypted storage of screenshots, which can include sensitive information from applications like Signal and WhatsApp, poses a significant privacy threat.

"This misfeature contravenes privacy law throughout the EU and in healthcare organizations everywhere which has a medical right to privacy," said Charlie Stross, an author and privacy advocate.

Despite Microsoft's reassurances about the feature's privacy safeguards, including local storage and user control over what data is collected, the global privacy community remains skeptical.