AfterDawn: Tech news

Cortana used to bypass Windows 10 security

Written by James Delahunty @ 14 Jun 2018 8:14

Cortana used to bypass Windows 10 security

Microsoft has pushed out a fix for a flaw with the Cortana assistant that could be exploited to unlock a Windows 10 computer.
McAfee reported the flaw to Microsoft back in April, and Microsoft has included an update to address the issue in this month's Patch Tuesday load of fixes and tweaks. Windows 10 devices on default settings will apply the update over the next day or so.

The flaw took advantage of the fact that Cortana listens for commands even when a Windows 10 PC is locked, coupled with the regular indexing of files on attached storage to make searching faster.

"This will come as a surprise and lies at the core of all the issues we found, but simply typing while Cortana starts to listen to a query on a locked device will bring up a Windows contextual menu," Cedric Cochin and Steve Povolny wrote on a McAfee blog post detailing a potential attack.

With a contextual menu displayed and search results coming from indexed files and applications (and in cases the contents of the file are indexed), a malicious actor could see sensitive contents of text files and other documents that has been indexed.



The McAfee team went further though and even detail a path to a password reset and login in a blog post here.

Previous Next  
Comments have been disabled for this article.

Latest news

Sideloading apps to Android gets easier, as Google settles its lawsuit Sideloading apps to Android gets easier, as Google settles its lawsuit (19 Dec 2023 11:09)
Google settled its lawsuit in September 2023, and one of the settlement terms was that the way applications are installed on Android from outside the Google Play Store must become simpler. In the future, installing APK files will be easier.
3 user comments
Roomba Combo j7+ review - Clever trick allows robot vacuum finally to tackle home with rugs and carpets Roomba Combo j7+ review - Clever trick allows robot vacuum finally to tackle home with rugs and carpets (06 Jun 2023 9:19)
Roomba Combo j7+ is the very first Roomba model to combine robot vacuum with mopping features. And Roomba Combo j7+ does all that with a very clever trick, which tackles the problem with mopping and carpets. But is it any good? We found out.
Neato, the robot vacuum company, ends its operations Neato, the robot vacuum company, ends its operations (02 May 2023 3:38)
Neato Robotics has ceased its operations. American robot vacuum pioneer founded in 2005 has finally called it quits and company will cease its operations and sales. Only a skeleton crew will remain who will keep the servers running until 2028.
5 user comments
How to Send Messages to Yourself on WhatsApp How to Send Messages to Yourself on WhatsApp (20 Mar 2023 1:25)
The world's most popular messaging platform, Meta-owned WhatsApp has enabled sending messages to yourself. While at first, this might seem like an odd feature, it can be very useful in a lot of situations. ....
18 user comments
How to Enable Bluetooth on Stadia Controller How to Enable Bluetooth on Stadia Controller (11 Feb 2023 1:04)
Google shut down its streaming game service Stadia late last month and this means that some people have Stadia controllers lying around that seem to be of no use. That is fortunately not the ....
2 user comments

News archive