On May 20, 2024, Microsoft introduce feature Recall (which previously we may have known as AI Explorer). Recall itself is a feature timeline which is supported by several AI models that function as photographic memory.
Also Read: It turns out this is how the recall feature works in Windows 11
In general, Recall can see whatever happens on the device, but users can of course regulate the application and what exceptions to this Recall feature. In fact, Microsoft has shared Privacy Details regarding this feature because of course there are many users who are worried about the security of their data and privacy.
However, recently a security researcher named Kevin Beaumont has published blog post detailed where he thinks with recalls users can steal everything that users see and type on the device very easily.
According to Beaumont, he claims that the idea of Recall is an interesting feature that requires “incredibly careful communication, cybersecurity, engineering, and implementation“. Unfortunately, Recall allegedly doesn't have all of these things.
The recall itself is processed locally, but according to Beaumont, all the information processed is not immune hackers And malwarewhere if if hackers has user credential information, then hackers You can get everything without exception from this Recall feature.
Well, as we know, Recall works by taking snapshots of everything that happens on the device every few seconds, then the OCR (recognizes optical characters) system will enter the data into a database in the user's folder, according to Beaumont everything is stored in plain text, and no system or administrator rights are required to access it.
All Data Sorted By Application!
Now what's interesting is, everything the user has ever seen on the device is sorted by application, everything even every bit of text the user sees. There do seem to be some minor exceptions though (like Microsoft Edge InPrivate mode seems to be excluded, but strangely Google Chrome is not).
Also Read: Copilot vs Recall, What's the Difference?
With that, if the malware is successfully installed and… infostealer it works, then hackers or other bad actors who have credentials Users can steal all data stored in the local database directly, completely and in order.
And because of this, Beaumont claims Microsoft “must withdraw the Recall” and reworked the feature to address all privacy concerns, especially considering Satya Nadella said engineers should prioritize security above other priorities.
So, the fact revealed by Beaumont is indeed a bitter fact, but will Microsoft overcome it and withdraw the Recall again, or will it still release it? we'll see later guys.
Data Will Remain Safe As Long As Users Pay Attention!
One more thing, although according to Beaumont the Recall feature is very vulnerable, it comes back to the user himself, as long as the user remains attention, aware and don't install applications and download them haphazardly, your data should remain safe.
Besides that Microsoft Defender itself is enough to block malware attacks, so if Microsoft ignores the findings published by Beaumont, users must be more careful with each of their actions, especially in installing and downloading files from unofficial and pirated sites.
What do you think? Comment below guys, you can read the Beaumont report on the page following.
Source link
