What’s wrong with Recall? Comment on a hacker’s attempt to steal a screenshot of a desktop snapshot using a simple bypass technique

Then on Wednesday, James Forshaw, a researcher with Google’s Project Zero vulnerability research team, published an update to a blog post pointing out that he had found methods for accessing Recall data without administrator privileges—essentially stripping away even that last fig leaf of protection. “No admin required” the post concluded.

That second, simpler bypass technique “is just mindblowing, to be honest,” says Alex Hagenah, a cybersecurity strategist and ethical hacker. Hagenah recently built a proof-of-concept hacker tool called TotalRecall designed to show that someone who gained access to a victim’s machine with Recall could immediately siphon out all the user’s history recorded by the feature. Hagenah’s tool, however, still required that hackers find another way to gain administrator privileges through a so-called “privilege escalation” technique before his tool would work.

With Forshaw’s technique, “you don’t need any privilege escalation, no pop-up, nothing,” says Hagenah. “This would make sense to implement in the tool for a bad guy.”

Microsoft’s new Recall feature can be used to store a history of your computer desktop as ‘photographic memory’ for your PC, allowing it to be used for analysis. Within the cybersecurity community, meanwhile, the notion of a tool that silently takes a screenshot of your desktop every five seconds has been hailed as a hacker’s dream come true and the worst product idea in recent memory.

Now, security researchers have pointed out that even the one remaining security safeguard meant to protect that feature from exploitation can be trivially defeated.

“It makes your security very fragile,” as Dave Aitel, a former NSA hacker and founder of security firm Immunity, described it—more charitably than some others—to WIRED earlier this week. Anyone can get your computer’s history, even if they only penetrate it for a second. Which is not something people want.”

Microsoft’s Corporate Vice President, Windows + Devices, Pavan Davuluri wrote in a post that they are updating the set-up experience of Copilot+ PCs to give people a clearer choice to opt in to saving snapshots using Recall. If you do not turn it on, it will be turned off by default.

How Do You Ensure That Your Software Does Not Have a Problem? An Analysis of Microsoft’s Security Message on “Recall and Product Recall”

Last month, Microsoft’s Nadella issued a memo stating that the software company would make security its first priority when making business decisions. If you have to make a decision between security and other priorities, it is important that you do security. We’re going to prioritize security over other things we do in some cases, like releasing new features or providing ongoing support for legacy systems.

When Microsoft named its newest feature, it was meant to mean a kind of perfect, artificial intelligence-enabled memory for your device. Today, the other, unintended definition of “recall”—a company’s admission that a product is too dangerous or defective to be left on the market in its current form—seems more appropriate.