Microsoft Fixes a Major Cortana Vulnerability

Microsoft Fixes a Major Cortana Vulnerability

One limitation is that attackers can not pass command line parameters to the malicious code in question, and the payload has to be indexed by Windows. Fortunately, Microsoft just fixed it.

McAfee uncovered and documented the security flaws in a lengthy blog post, with one simple issue being the fact that you could trigger the voice assistant from the lock screen (assuming Cortana is enabled in this respect, on default settings), and bring up a contextual Windows 10 menu simply by typing while Cortana is listening to a query.

McAfee suggested turning off Cortana on the Windows 10 lockscreen on systems that haven't been patched.

"The vulnerability was submitted to Microsoft as part of the McAfee Labs Advanced Threat Research team's responsible disclosure policy, on April 23. This led to some interesting behavior and ultimately vulnerabilities allowing arbitrary code execution", explained the security researchers at McAfee yesterday. "An attacker who successfully exploited the vulnerability could execute commands with elevated permissions". "The security update addresses the vulnerability by ensuring Cortana considers status when [retrieving] information from input services".

By dropping an executable file through phishing or another vector, or a PowerShell script, the researchers found they were able to run code at the privilege level of the logged in user, but this "probably does not represent much of an attack vector", they said. The locked screen could be bypassed by using a voice command in Cortana. The researchers also explained different techniques that an attacker having physical access to a Windows 10 PC could use to execute code from the lock screen, including a full password reset. Windows Latest makes no claims, guarantees about the accuracy or completeness in this article, and shall not be held responsible for anything we say in this article.

Related Articles

  • The Shining sequel: Ewan McGregor to headline movie

    The Shining sequel: Ewan McGregor to headline movie

    Getting sober revives Danny's powers, and he tries to put them to good use by working with terminally ill hospice patients. Now, however, it is thought to be one of the great horror classics and has a built-in fan base ready for a sequel.
    APA Group a $13bn Chinese takeover target

    APA Group a $13bn Chinese takeover target

    The company has offered to divest all of APA's Western Australian gas pipeline assets before or following the acquisition. The proposal offers a 33 per cent premium to the $8.27 price prior to Wednesday's market open.
    Polio is making a comeback in Venezuela

    Polio is making a comeback in Venezuela

    Part of an indigenous community in Venezuela's northeastern state of Delta Amacuro, the child had not been vaccinated against polio, the statement noted.
  • Telltale is working on a Stranger Things game

    Telltale is working on a Stranger Things game

    It's going to happen, and probably sooner than you think, but Netflix has no apparent intention of diving into that space. It is even possible that Netflix will announce the streaming game service and the new Stranger Things title all at once.
    Unofficial TWRP now available for Snapdragon Samsung Galaxy S9/Galaxy S9+

    Unofficial TWRP now available for Snapdragon Samsung Galaxy S9/Galaxy S9+

    Both LG and Samsung are apparently developing this technology now and will have production-level hardware by "early next year". Samsung asked users around the world to "immediately" return their existing Galaxy Note 7 and get a replacement.
    Unemployment drops to 5.4pc despite 21,000 full-time jobs being lost

    Unemployment drops to 5.4pc despite 21,000 full-time jobs being lost

    But like the national figures, a drop in the participation rate helped bring down the State's jobless rate. Participation rate decreased by 0.2 pts to 65.5%.
  • Argus Raises Boston Scientific (BSX) Price Target to $36.00

    Argus Raises Boston Scientific (BSX) Price Target to $36.00

    Also, there are 0 buy, 0 sell and 0 strong sell ratings, collectively assigning a 1.36 average brokerage recommendation. Boston Scientific Corporation's institutional ownership is 93.4%, while its institutional transactions stand at -0.08%.
    The Inbetweeners star scores winning Soccer Aid goal

    The Inbetweeners star scores winning Soccer Aid goal

    Carter laid on a flawless cross for the World XI's first goal of the match scored by Irish football worldwide Robbie Keane. England is known for buckling under pressure in professional penalty shootouts for the World Cup and Euros.
    Jaguar E-Pace gets new entry-level 197bhp 2.0 litre petrol engine

    Jaguar E-Pace gets new entry-level 197bhp 2.0 litre petrol engine

    This suspension monitors vehicle movements every two milliseconds and calculates the required damping force every 10 milliseconds. Although adaptive suspension isn't new to Jaguar , it wasn't available with the E-Pace when it was launched a year ago .
  • Net neutrality ends today

    Net neutrality ends today

    However, Congress can still pass a law to simply reverse the repeal or even improve on the previous net neutrality rules. The Federal Trade Commission will be able to investigate if internet providers engage in anticompetitive behavior.
    Facebook may ban businesses that mislead users about products

    Facebook may ban businesses that mislead users about products

    That will include giving businesses them "guidance" on how to improve customer satisfaction and better meet their expectations. According to reports, Facebook is experimenting with a new option that will allow Page admins to A/B test their posts .
    Patent filed by Uber for machine to tell if passengers are drunk

    Patent filed by Uber for machine to tell if passengers are drunk

    In a statement, the company told KTVU the idea is in the early stages and that it has no immediate plans to implement the system. To some, the concept may be counterintuitive to why they choose to hail an Uber .