Microsoft Answers Security Concerns Over Its New Recall Feature

On May 20 Microsoft introduced its new line of windows 11 Copilot+ PCs. These new AI enabled PCs include an Neural Processor Unit (NPU) providing optimized processing power for AI functions. As a component of the Windows 11 Copilot+ operating system a new feature, Recall, will be released on June 20. Recall takes a screenshot of everything you do on your computer every few seconds. This allows users to retrace their steps to retrieve items they would like to revisit but do not remember where or when they accessed the information. The data is stored locally and not stored in the cloud.

Almost immediately, security experts sounded the alarm on the privacy ramifications of capturing every action a user takes on their PC. What if that data could be retrieved by an unauthorized party? Microsoft assured the community that adequate security had been built into the product to prevent that from happening.

However, that was quickly put to the test by others in the security community. Kevin Beaumont published a blog on May 31 digging into Microsoft's claims and debunking many of them. In the article he claimed to be able to access the local database and the screenshots easily. He used an off the shelf info stealer to scrape the database. Although Microsoft Defender found the info stealer, it had already completed its task before detection. Additionally, a group uploaded code to Github for a simple program called "Total Recall" which can parse the Recall database and extract interesting artifacts.

One aspect of the tool that has critics upset is that, in the initial preview, Recall is on by default. Users cannot easily disable the feature, although users can access the settings after install and disable the feature.

Well, Microsoft has responded to the blowback. On June 7, Microsoft released an update providing information on new features being implemented into Recall. First and foremost, Recall will now be disabled by default. Users will need to actively enable Recall to use it. Secondly, Windows Hello authentication will be required to enable Recall. Finally the image data will encrypted at all times until the users decides to access it with "just in time" decryption. Windows Hello Enhanced Sign-In Security (ESS) will be required to for the decryption. Likewise, the search index database is now encrypted.

Additional security features are being included in the Windows 11 Copilot+ PCs such as the MS Pluton security processor providing zero trust principles at the core.

With less than a week to go before release we'll see what the reaction to updated features will be.