r/sysadmin • u/Illustrious-Syrup509 • Mar 14 '26
Microsoft Redesigned Windows Recall cracked again
Quick heads-up for Copilot+ users: What happened: The new, supposedly secure version of Windows Recall (now protected by VBS enclaves) has been bypassed. By whom: Security researcher Alex Hagenah (@xaitax). The issue: He managed to extract the entire Recall database (screenshots, OCR text, metadata) in plain text as a standard user process. AV/EDR solutions do not trigger any alerts. Source and confirmation by Kevin Beaumont (@GossiTheDog):
82
u/sean_hash Mar 14 '26
VBS enclaves protecting a local SQLite db of plaintext screenshots feels like putting a deadbolt on a screen door.
25
u/BoredTechyGuy Mar 14 '26
An exterior screen door, on a submarine…
3
u/smoike Mar 14 '26
I was thinking of the Simpson's when Monty burns goes through all the security and then kicks a dog out a screen door. S6E20.
8
4
1
u/anonveggy Mar 14 '26
I could be misreading but it seems as though you act as if sqlite is claiming to be secure while it's not.
For protocol sqlite does not have security features beyond encryption extensions that entirely derive from third party encryption vendors.
Just wanted to make sure sqlite is not catching undeserving strays.
13
3
u/mxzf Mar 14 '26
Pretty sure the intent was to point out that sqlite was never claimed to be secure by anyone ... other than Microsoft suggesting they could use it to securely store stuff.
1
u/Professional-Heat690 Mar 14 '26
No, I read it the complete opposite way. Sqllite has no security (screen door), vbs does (deadbolt). Easy to crash thru one without the other.
1
u/anonveggy Mar 14 '26
That exact attitude is what I meant. Is there anywhere where Microsoft claims using sqlite databases is more secure? Them changing to using it doesn't mean they are saying it is.
0
u/mxzf Mar 14 '26
Are you suggesting that Microsoft is intentionally storing the data insecurely and informing users that the data is insecure?
115
u/RunForYourTools23 Mar 14 '26
But is anyone really using this, or its just spyware?
69
u/xCharg Mar 14 '26
Consciously? Not sure. But iirc it was initially enabled by default, so I'd blindly guess many still do "use it", as in have it enabled and data being saved behind the scenes without them knowing. Especially home users.
18
u/SaltDeception Mar 14 '26
It was never enabled by default outside of the Windows Insiders channels. By the time it hit broad release, it was disabled by default. Even on the Insiders channels, it was removed entirely in a subsequent update and had to be enabled manually later.
2
u/hunter1BadPassword Mar 15 '26
By the time it hit broad release
It did? I don't think I have it on my computer. How do I find out?
-1
12
u/RunForYourTools23 Mar 14 '26
So if it's just for data collection then it's a success for Microsoft!!
-12
18
u/knightofargh Mar 14 '26
I’m pretty sure the tone-deaf execs at Big Bank LLC are getting little executive semis at the idea of being able to prove how little work people do.
There aren’t a lot of non-surveillance arguments for recall.
6
u/ImNotABotScoutsHonor Mar 14 '26
There are already dozens of solutions to monitoring your employees' screens. That isn't new and the companies that want to do this already do it.
It's not like they can view that data that Recall collects anyway, so it can't be used for that.
4
u/feeked Mar 14 '26
I’ve been testing it and it seems useful but if it’s going to be breached like this then it’s probably going to be a nonstarter
1
u/JimmyG1359 Mar 14 '26
I'd be willing to bet that the only people using this don't know it is there and enabled. Who the fuck would want their computer recording every thing they do?
181
u/DDS-PBS Mar 14 '26
Microsoft is creating a huge attack surface by giving people a feature that they do not want and will not use. It makes no sense.
36
u/marklein Mar 14 '26
I guarantee that a 3 letter government agency is pushing for this so they can see everything that people are doing after they're arrested for something.
17
u/HotTakes4HotCakes Mar 14 '26 edited Mar 14 '26
No this is definitely just more copilot shit. Yet another way they're trying to get any and everything on your local hard drive up into their cloud so they can harvest it (and yes surrender it to the cops on request).
It's just one of the many things Microsoft greenlit once AI exploded, without any second thoughts or caring what anyone actually wanted.
2
2
u/elitexero Mar 15 '26
They don't need recall for that, they can already do that. Every image you open on a windows machine is hashed and noted, with flags sent up if you open certain file hashes. Microsoft has a toolkit they offer forensics teams to basically comandeer windows machines when seized physically.
2
u/misterchief117 Mar 16 '26 edited Mar 16 '26
COFEE has been obsolete for over a decade. There's much better tools out there now for forensic imaging computers, including a bunch of open-sourced alternatives.
https://www.bluevoyant.com/knowledge-center/get-started-with-these-9-open-source-toolsAnd I'm not sure about MS flagging you if you open files with specific hashes. Can you tell me more about this? I'm not doubting MS has the ability to get a hash of all your files; They DO do this as part of MS Defender checks as far as I understand.
NIST has a database of "known" hashes for files that investigators can rule out as evidence in certain cases.
https://www.nist.gov/itl/ssd/software-quality-group/national-software-reference-library-nsrl
2
u/GroteGlon Mar 14 '26
We'll see in a couple years when someone comes up with a crazy conspiracy theory that just turns out to be true a couple years later
1
u/tejanaqkilica Mar 15 '26
Wait until Apple creates a feature like this and see all the media drooling over it with googly eyes to sell the product.
5
u/DDS-PBS Mar 16 '26
Take a look at how Apple's security has changed. Their devices are getting more secure and increasing privacy, while Windows is going in the opposite direction.
I'm not a big Apple fan, as I like to play a lot of games that are only available on Windows. However, it's been very apparent to me that Windows is coasting on the dependency the world has on it. But not for that dependency, new computer purchases would look a lot different.
-52
u/hutacars Mar 14 '26
I would use the crap out of this, and I can’t imagine I’m the only one. Honestly, this would be the first useful Windows feature in years, if they could actually get the security right.
34
u/Uncommented-Code Mar 14 '26
In a vacuum? Yeah why not. Assuming it was securely encrypted and only lived on my device with me having full control over the settings? I'd actually use it. But Microsoft has fucked with my trust so much that I'll never use them again. At most I will use a VM if I really have to.
2
u/hutacars Mar 15 '26
Very understandable. Realistically, I've moved 100% of my non-server usage to Macs these days anyways, so I'm hopeful Apple comes out with such a feature (implemented correctly) too.
6
u/Standard-Potential-6 Mar 14 '26
and if my grandmother had wheels, she would have been a bike.
2
u/syntaxerror53 Mar 16 '26
Doing your grandmother a disservice there. Are you sure she would not have been the elegant silver lady (RR)?
2
u/Logsies Mar 14 '26
Can I ask how? Why? What would this really improve for you?
1
u/hutacars Mar 15 '26
I come across or even save random things all the time on the computer, then when I go to retrieve them later, I find I've completely forgetten the context which makes the search all the more arduous. I'll remember the gist of what I was looking at, but was it an email? Was it a Slack message? Did someone send it in a Google Doc? Was it a PDF I saved somewhere? Was it one of 150 similarly-named Excel workbooks? Did I see it 6 months ago, or 12? No idea. Being able to search entirely using the little bit of "gist" I do remember would be a lifesaver.
On top of that, so many systems' search functions are completely broken. Even if I know where something is, searching for a specific Outlook email, or Confluence page, or even just Google these days is an exercise in frustration. So I am essentially assuming Recall's search would actually be any good, which may not be a valid assumption, but if it worked as advertised? I could absolutely see myself using the shit out of it*.
*Well, other than the fact that I am a Mac user these days, outside of server usage. But I presume Apple will eventually release something similar, hopefully getting the security right in the process.
2
u/uebersoldat Mar 14 '26
Explain thyself.
1
u/hutacars Mar 15 '26
I come across or even save random things all the time on the computer, then when I go to retrieve them later, I find I've completely forgetten the context which makes the search all the more arduous. I'll remember the gist of what I was looking at, but was it an email? Was it a Slack message? Did someone send it in a Google Doc? Was it a PDF I saved somewhere? Was it one of 150 similarly-named Excel workbooks? Did I see it 6 months ago, or 12? No idea. Being able to search entirely using the little bit of "gist" I do remember would be a lifesaver.
On top of that, so many systems' search functions are completely broken. Even if I know where something is, searching for a specific Outlook email, or Confluence page, or even just Google these days is an exercise in frustration. So I am essentially assuming Recall's search would actually be any good, which may not be a valid assumption, but if it worked as advertised? I could absolutely see myself using the shit out of it*.
*Well, other than the fact that I am a Mac user these days, outside of server usage. But I presume Apple will eventually release something similar, hopefully getting the security right in the process.
0
Mar 14 '26
1
u/hutacars Mar 15 '26
Assuming the feature can and eventually is properly secured, what is the downside you are seeing?
0
Mar 14 '26
2
u/whiskeytab Mar 14 '26
yeah honestly if it was proven to be completely secure you'd be nuts NOT to want the feature imo
73
u/Its_pipo Mar 14 '26
At this point Microsoft should just rename it "Windows Screenshot Collection" and be honest about what it does. Every "secure" iteration lasts what, a few weeks?
42
u/sonic10158 Mar 14 '26
“Windows Copilot Screenshot Collection”
30
7
5
1
u/sccm_sometimes Mar 16 '26
btw, anyone that uses MS Snipping Tool should be aware that it automatically saves all of your screenshots without asking you for permission! (C:\Users\username\Pictures\Screenshots)
https://x.com/NathanMcNulty/status/1808682576883953741
I take a lot of temporary screenshots and then edit out any sensitive info before sending it via email. I always close them out without saving. Discovered a few months ago that Snipping Tool was automatically saving all of the original unedited screenshots.
Switched to GreenShot and haven't looked back!
66
u/Winter_Engineer2163 Mar 14 '26
Honestly this is exactly why a lot of orgs were hesitant about Recall from the beginning. Even if the storage is encrypted or protected by VBS, the fundamental issue is still that the system is continuously collecting a very detailed history of user activity.
Once that dataset exists locally, the security model has to be absolutely perfect to prevent access. History shows that’s extremely difficult to guarantee over time.
For enterprise environments the bigger concern isn’t just attackers, it’s the potential exposure during incident response, compromised accounts, or malware running in user context. If a standard user process can extract that much data, that’s obviously going to raise questions.
I wouldn’t be surprised if many organizations simply keep Recall disabled via policy until the architecture matures a lot more. Even if the feature is interesting from a productivity standpoint, the data sensitivity is pretty extreme.
37
u/gzr4dr Mar 14 '26
I don't think my org will ever find a use case where the value of Recall exceeds the risk. It's a product that should never have been made, like many of the ideas out of Redmond these days. Now fixing or improving existing products would provide a lot of value to my org but it's hard for MS to make more money than way.
20
u/bentbrewer Mar 14 '26
I don't think my org will ever find a use case where the value of Recall exceeds the risk.
I'm 100% sure about this. I had our VP of IT come to me about Recall and ask if we are able to prevent it from running.
19
u/poedy78 Mar 14 '26
Now imagine the future where every 'windows' is a Cloud PC 365 with Recall.
I wouldn't trust them a bit, even if there's a corpo wide OFF button.
15
u/Winter_Engineer2163 Mar 14 '26
That’s exactly the concern many enterprise teams have. Even if there’s a policy switch to disable it, the question becomes whether organizations trust that the feature stays fully disabled across updates, configurations, and future integrations.
Most security teams I’ve talked to are less worried about the concept itself and more about the existence of such a rich activity dataset on endpoints in the first place.
Once something like that exists, it becomes a high-value target for malware, insider abuse, or incident response exposure. That’s why a lot of orgs are already planning to keep Recall disabled through policy unless Microsoft proves the security model is extremely solid over time.
1
3
u/s3xynanigoat Mar 14 '26
It exists locally today but the end goal and natural evolution of the product will be to have it cloud accessible.
12
u/ShadowSlayer1441 Mar 14 '26
Maybe just maybe, it's not a good idea to precollect all of the data malware would want to collect, regardless of any security measures you put on that data.
14
u/DueBreadfruit2638 Mar 14 '26
This is a rare case in which my director told me to disable Recall within days of its announcement. I didn't even have to make a pitch. I was proud.
2
u/mabhatter Mar 15 '26
But do you KNOW it's really deactivated. M$ keeps using every update to secretly turn it back on again.
2
6
u/linuxares Mar 14 '26
I honestly wait for the first malware to target the recall folder. Just a massive gold mine of data sitting there.
A malware could even be so sneaky to enable recall and lay dormant. No AV will flag Recall since it's a Microsoft process. So it can just keep sending the recall data to the host.
1
u/tdmsbn Mar 15 '26
There has to be one out there already if not working on a current version then targeting older versions.
56
Mar 14 '26
My favorite version of recall is switching over to Linux Mint and finally breaking free of the enshitification of all Microslop products
5
u/TinyBreak Mar 14 '26
My favourite version was recalling how to set up a live usb and weighing into the distro debate again.
Jesus Linux people hate on Linux more than windows fans hate their own breed.
9
11
u/AnsibleAnswers Mar 14 '26
The distro debate is weaker than ever because most of the stuff is almost identical under the hood now. It basically comes down to package manager preference.
→ More replies (3)11
Mar 14 '26
Are these people in the room with us right now?
Stop playing the victim card, it doesn't work any longer.0
u/uebersoldat Mar 14 '26
I really should sell my M$ stock. I'm so tired Nadella's garbage directions.
15
u/UltraEngine60 Mar 14 '26
Make no mistake recall is built to train AI to do your job. The security implications will always be secondary to the massive benefits to the employer.
1
u/syntaxerror53 Mar 16 '26
If only a way can be found to fake all the info AI relies on so it screws up bigtime. Like self-destructs itself after one use.
8
u/TheStig827 Mar 14 '26
Not that I'm a fan of copilot, but all these posts are from 2024, from when he cracked the original version?
7
u/Cookster997 Mar 14 '26
Check the specific post that was linked, or scroll down. There are some posts and screenshots on the same thread from March 2026.
1
6
3
6
9
5
u/shimoheihei2 Mar 14 '26
Anyone who finds this enabled by default when they didn't turn it on should be complaining loudly to their respective government body. This sort of privacy intrusion breaks the law in many jurisdictions, and the more people make noise among regulators, the more likely Microsoft will be made to pay a price for it.
2
u/mabhatter Mar 15 '26
The government don't care... all this AI data collection will be handed over to the government to "ensure public safety" and the government will let them do whatever they want. That's how all these tech companies get away with invasive privacy violations... they just make the government a customer... then it's A OK!
2
u/triponthisman Mar 14 '26
This was a horrible idea. If I was the head of a country, and my spy agency wasn’t looking at how to crack things like this, I would fire them all. Once those tools are created, it’s only a matter of time before they get out.
2
u/gokarrt Mar 15 '26
i am frankly shocked that the all-star development studio that has been unable to migrate away from cpanel/mmc over the course of a decade is struggling to implement new features into their calcified tumor of techdebt.
→ More replies (1)
4
u/Ihaveasmallwang Mar 14 '26
This is super vague. Under what context was he running this? The same user that created the database in the first place? A completely different user? If it’s the former, it seems normal that the user would have access to things that they created.
This really needs more information before jumping to conclusions.
0
Mar 14 '26
→ More replies (3)3
u/AnomalyNexus Mar 14 '26
Until it is deemed a core feature of the product that can't be stripped out/disabled. This sort of creeping introduction is classic MS
772
u/EffectiveFit8109 Mar 14 '26
It’s almost like recall is a terrible idea in principle