Kevin Beaumont, a UK security researcher, writes about malware, breaches, Windows security and threat actors.
HN commenters cite his detailed write-ups as the primary source on Windows Recall, the Notepad++ updater compromise and IT outsourcing risks.
> The security concerns apply regardless of Recall existing.
Not quite. Because there is a world of difference between an attacker being able to grab information that is being entered or temporarily present, or permanently present and encrypted, and an attacker being able to, within seconds, grab everything the user ever did, watched, saw, entered, etc. on his machine in one fell swoop:
https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e
Quote from the Q&A Section of the post:
"Q. But if a hacker gains access to run code on your PC, it’s already game over!
A. If you run something like an info stealer, at present they will automatically scrape things like credential stores. At scale, hackers scrape rather than touch every victim (because there are so many) and resell them in online marketplaces.
Recall enables threat actors to automate scraping everything you’ve ever looked at within seconds.
During testing this with an off the shelf infostealer, I used Microsoft Defender for Endpoint — which detected the off the shelve infostealer — but by the time the automated remediation kicked in (which took over ten minutes) my Recall data was already long gone."
End Quote.
And this is THE core problem with such a system, that just hoovers up everything, everywhere, all at once: It creates a single point of failure so critical, it will instantly become the prime target of every attack, because no…
This is missing the point, and I'd strongly recommend reading Kevin Beaumont's findings presented as a Q&A style post about Recall [0].
This kind of poorly controlled local access makes it significantly more dangerous to use a Windows PC, because it significantly increases the harm/value of info stealing malware and will increase the degree of interest in penetrating windows systems. The fact that it's enabled by default is horrific, especially when you consider that the people most vulnerable are also the least likely to understand or disable the feature.
Before, info stealers would look for specific words/phrases in documents because anything more would be bandwidth/compute prohibitive. Now, such stealers just need to pull the Recall DB, and all of the juiciest information is served up on a platter.
To prove his point, Kevin deployed a piece of common info stealing malware and it was able to exfiltrate the Recall data before Windows Defender could remediate the issue.
This would still be a dangerous architecture even if Windows had a reputation for being impenetrable. Given the reality, this architecture is incomprehensibly bad.
- [0] https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e
Yes, it's true that SMS-based authentication has its flaws, but it's far from useless/harmful in many contexts. The same strawman arguments used here would also find TOTP "wholly ineffective" which is an absurd conclusion.
A main goal of security engineering is to increase the difficulty level for attackers. SMS authentication has demonstrated its ability to do this in a highly accessible, albeit imperfect, manner. I feel that the author severely underestimates the practical difficulties of widely deploying "Unique Passwords and U2F".
I strongly disagree with the conclusion that "SMS-2FA is not only worthless, but harmful" and highly recommend consulting a security professional before entertaining any of the arguments or following any of the suggestions in this article. I don't like leaving negative comments, but this is at best borderline misinformation that has the potential to create severe consequences.
Some more context, if you want to consider a more balanced perspective:
https://doublepulsar.com/infosecs-fantastic-fear-of-everything-why-the-reddit-incident-shouldn-t-cause-infosec-to-throw-4bb3b7ea634f
Or cost of outsourcing / not having IT competence in your organization?
There were indications that Jaguar used the same outsourced IT org as another large company who has struggled to recover from a wide ranging hacking incident.
https://doublepulsar.com/the-elephant-in-the-biz-outsourcing-of-critical-it-and-cybersecurity-functions-risks-uk-economic-96205e0585bf
I've had contact with several companies where once outsourced IT competency and security continuity is just out the window ...
Sometimes not even the outsourcing company's "fault" as humans / organizations love to think "oh I don't have to think about that now that I outsourced it" and folks who do worry about the detail then leave (they can't use their skills) and now you got folks in charge who don't even understand what they're agreeing to with their outsourcing company. Other times, it is the outsourcing groups fault ...
Some excerpts from https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e:
----------
Q. So how does it work?
A. Every few seconds, screenshots are taken. These are automatically OCR’d by Azure AI, running on your device, and written into an SQLite database in the user’s folder.
This database file has a record of everything you’ve ever viewed on your PC in plain text. OCR is a process of looking an image, and extracting the letters.
Q. How do you obtain the database files?
A. They’re just files in AppData, in the new CoreAIPlatform folder.
Q. But it’s highly encrypted and nobody can access them, right?!
A. Here’s a few second video of two Microsoft engineers accessing the folder:
https://cyberplace.social/@GossiTheDog/112535509953161486
----------
On 2024-02-29, a PR was sent to stop linking liblzma into libsystemd [0].
Kevin Beaumont speculated [1] that "Jia Tan" saw this and immediately realized it would have neutered the backdoor and thus began to rush to avoid losing the very significant amount of work that went into this exploit; I think he's right. That rush caused the crashing seen in 5.6.0 and the lack of polish which could have eliminated or reduced the performance regressions which were the entire reason this was caught in the first place; they simply didn't have the time because the window had started to close and they didn't want all their work to be for nothing.
[0]: https://github.com/systemd/systemd/pull/31550
[1]: https://doublepulsar.com/inside-the-failed-attempt-to-backdoor-ssh-globally-that-got-caught-by-chance-bbfe628fafdd