Curated RSS Brief
Microsoft faces fresh Windows Recall security concerns
Report Close Report Posts from this topic will be added to your daily email digest and your homepage feed. Follow Follow See All Report Tech Close Tech Posts from this topic will be added to your daily email digest and your homepage feed. Follow Follow See All Tech Microsoft Close Microsoft Posts from this topic will be added to your daily email digest and your homepage feed. Follow Follow See All Microsoft Microsoft faces fresh Windows Recall security concerns A security researcher has released a new tool that can extract data from Recall. A security researcher has released a new tool that can extract data from Recall. by Tom Warren Close Tom Warren Senior Correspondent Posts from this author will be added to your daily email digest and your homepage feed. Follow Follow See All by Tom Warren Apr 15, 2026, 11:30 AM UTC Link Share Gift Image: Microsoft Tom Warren Close Tom Warren Posts from this author will be added to your daily email digest and your homepage feed. Follow Follow See All by Tom Warren is a senior correspondent and author of Notepad , who has been covering all things Microsoft, PC, and tech for over 20 years. When Microsoft tried to launch Recall, an AI-powered Windows feature that screenshots most of what you do on your PC, it was labeled a “disaster” for cybersecurity and a “privacy nightmare.” After the backlash and a year-long delay to redesign and secure Recall, it’s once again facing security and privacy concerns. Cybersecurity expert Alexander Hagenah has created TotalRecall Reloaded , a tool that extracts and displays data from Recall. It’s an update to the TotalRecall tool that demonstrated all the weaknesses in the original Recall feature before Microsoft redesigned it. Microsoft’s redesign focused on creating a secure vault for Recall data, with Windows Hello authentication and a secure environment through a Virtualization-based Security Enclave. Recall requires users to authenticate using a face or fingerprint to gain access to data and to enable snapshots to be recorded. “This restricts attempts by latent malware trying to ’ride along’ with a user authentication to steal data,” said Microsoft in a September 2024 blog post . “My research shows that the vault is real, but the trust boundary ends too early,” says Hagenah. “TotalRecall Reloaded makes that ‘latent malware’ ride along.” The TotalRecall Reloaded tool can silently run in the background and activate the Recall timeline to force a user into authenticating with a Windows Hello prompt. Once the authentication has taken place, TotalRecall Reloaded can then extract everything that Windows Recall has ever captured. “That is precisely the scenario Microsoft’s architecture is supposed to restrict,” says Hagenah . Recall stores much more than just screenshots, with the history of text that has appeared on your screen, messages, emails, documents, browsing history, and much more. Microsoft’s changes to Recall security came months after CEO Satya Nadella told employees “If you’re faced with the tradeoff between security and another priority, your answer is clear: Do security.” Related Windows feature that screenshots everything labeled a security “disaster” Microsoft’s more secure Windows Recall feature can also be uninstalled by users Microsoft launches Recall and AI-powered Windows search for Copilot Plus PCs Hagenah responsibly disclosed his latest findings to Microsoft last month, but the company closed the report and said there was no vulnerability. “We appreciate Alexander Hagenah for identifying and responsibly reporting this issue. After careful investigation, we determined that the access patterns demonstrated are consistent with intended protections and existing controls, and do not represent a bypass of a security boundary or unauthorized access to data,” says David Weston, corporate vice president of Microsoft Security, in a statement to The Verge . “The authorization period has a timeout and anti-hammering protection that limit the impact of malicious queries.” In messages to The Verge , Hagenah disputes Microsoft’s timeout protections. “I can re-poll the data, and what I am doing in my tool [is] to bypass it. And the timeout is patched out,” says Hagenah. “My biggest issue still is them saying in their official announcement that the enclave prevents ‘latent malware riding along,’ which it clearly doesn’t.” TotalRecall Reloaded can also extract the latest cached Windows Recall screenshot without Windows Hello authentication, or totally wipe the entire capture history. But the type of malware that Hagenah describes could sit in the background on a PC and take screenshots anyway, with or without Windows Recall. Microsoft doesn’t think there’s a vulnerability here because this is simply how Windows works. Regular user-mode processes have the ability to inject code into themselves as a normal and often legitimate behavior in Windows, but this flexibility also creates opportunities for abuse. A similar infostealer malware co
- Report Close Report Posts from this topic will be added to your daily email digest and your homepage feed.
- Follow Follow See All Report Tech Close Tech Posts from this topic will be added to your daily email digest and your homepage feed.
- Follow Follow See All Tech Microsoft Close Microsoft Posts from this topic will be added to your daily email digest and your homepage feed.
- Follow Follow See All Microsoft Microsoft faces fresh Windows Recall security concerns A security researcher has released a new tool that can extract data from Recall.
If you want the exact wording, examples, or full context from the publisher, open the original source article.
Open Original Article
Comments
Post a Comment