Windows 11 Recall Feature is a Privacy Nightmare; Major Security Flaw Surfaces

Microsoft announced the Recall AI feature on Windows 11 with much fanfare at the Surface event recently. It’s the headline AI feature coming to Windows 11 version 24H2, and launching exclusively on Copilot+ PCs, powered by Snapdragon X series processors. Microsoft says Recall processing is done locally on the device using the dedicated NPU. And the Recall vector database is encrypted using BitLocker.

However, Kevin Beaumont, a security researcher, points out that the Recall feature is a security “disaster”. He says that the local Recall database can be easily hacked by malicious actors. The vector index is actually a SQLite database, saved inside the “AppData” folder. The researcher further demonstrates that the Recall database can be viewed in plain text as well.

Not only that, Beaumont mentions in his blog that the database can also be accessed by another user on the same PC which is a major concern. He further states that BitLocker encryption only helps in case someone steals your laptop and tries to access the Recall database.

However, after you are logged into your PC, all files and programs are decrypted. If you run a malicious program by mistake, it can access your Recall database and send all your sensitive data to a cloud checkpoint within seconds.

In most attacks, sensitive browser data including passwords, session tokens, and cookies are stolen by a type of malware called Info stealers. This kind of attack is increasingly rising as we have seen popular YouTube accounts getting hijacked by hackers.

To tackle this widespread problem, Google is working to bring DBSC (Device Bound Session Credentials) to Chrome, which will bind the session token with your device using TPM. So when companies are looking to close loopholes, Microsoft’s implementation of Recall raises several questions. With Recall, Microsoft is effectively opening a new attack vector for cybercriminals.