Windows Recall takes a screenshot every five seconds. Cybersecurity researchers say the system is simple to abuse—and one ethical hacker has already built a tool to show how easy it really is.

When Microsoft CEO Satya Nadella revealed the new Windows AI tool that can answer questions about your web browsing and laptop use, he said one of the “magical” things about it was that the data doesn’t leave your laptop; the Windows Recall system takes screenshots of your activity every five seconds and saves them on the device. But security experts say that data may not stay there for long.

Two weeks ahead of Recall’s launch on new Copilot+ PCs on June 18, security researchers have demonstrated how preview versions of the tool store the screenshots in an unencrypted database. The researchers say the data could easily be hoovered up by an attacker. And now, in a warning about how Recall could be abused by criminal hackers, Alex Hagenah, a cybersecurity strategist and ethical hacker, has released a demo tool that can automatically extract and display everything Recall records on a laptop.

Dubbed TotalRecall—yes, after the 1990 sci-fi film—the tool can pull all the information that Recall saves into its main database on a Windows laptop. “The database is unencrypted. It’s all plain text,” Hagenah says.⁩ Since Microsoft revealed Recall in mid-May, security researchers have repeatedly compared it to spyware or stalkerware that can track everything you do on your device. “It’s a Trojan 2.0 really, built in,” Hagenah says, adding that he built TotalRecall—which he’s releasing on GitHub—in order to show what is possible and to encourage Microsoft to make changes before Recall fully launches.

  • Blackmist@feddit.ukEnglish
    30·
    5 months ago

    It barely matters if the database is encrypted or not. If the user has access to it, they have the keys to it, and so would anybody else with access.

    The real danger is that intruders will have access to your entire history from before they had access to your machine, and it’s all in one place.

    • VieuxQueb@lemmy.caEnglish
      8·
      5 months ago

      With easily searchable text, search for “bank” and get all accounts login. Yay no need to wait for the hacked user to get on his banking site he’s been there before. Quick in and out without being noticed and you got all you need to empty his account. Thanks Microsoft I knew you where so helpful to hackers while making my life shittier all the while.

      • Blackmist@feddit.ukEnglish
        5·
        5 months ago

        Every banking site I’ve been on jumps through all sorts of hoops to make sure the browser doesn’t save the password, usually with some 2FA thrown into the mix.

        But I’d imagine that a lot of older people have a helpful passwords.txt file sat smack bang in the middle of their desktop, or just use the same one for everything. I mean, we’re in an age where you need a username and password to update your graphics drivers for some godforsaken reason. It’s not going to be hard to find that The One True Password with access to this.

        • Wereduck@lemmy.blahaj.zoneEnglish
          2·
          5 months ago

          I’ve encountered IT departments with an unencrypted passwords.xlsx file that they store on the network. Not always super small companies too.