Cortana vulnerability allows hackers to bypass Windows 10 passwords to install malware

Researches show that voice assist is a security risk

Cortana

Security researchers have discovered a flaw with Microsoft's Cortana voice assistant that could enable hackers to bypass the login screen in Windows 10 and infect a system with malware.

The Israeli researchers, Tal Be'ery and Amichai Shulman, found the vulnerability after finding out that Cortana is always on and responds to voice commands, even when a machine is locked.

Advertisement - Article continues below

According to reports by Motherboard, a hacker could plug in a USB stick with a network adapter into the computer, then tell Cortana to launch the computer's browser and go to an unencrypted URL (non-HTTP). This adaptor the intercepts this session to send the browser to a malicious website, downloading malware and infecting the system.

"We start with proximity because it gives us the initial foothold in [a] network. We can attach the computer to a network we control, and we use voice to force the locked machine into interacting in an insecure manner with our network," Shulman told the publication.

Hackers could also connect a targeted computer to a Wi-Fi network they control by simply clicking on a selected network with a mouse, even when the computer is locked.

"One of the things we saw was that even when a machine is locked, you can choose the network to which that machine is attached," said Shulman.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"We still have this bad habit of introducing new interfaces into machines without fully analyzing the security implications of it," said Be'ery. "Every new machine interface that we introduce creates new types of vehicles to carry an attack vector into your computer."

The researchers will present the findings in a presentation at the Kaspersky Analyst Security Summit in Cancun this week.

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now
Advertisement

Recommended

Visit/security/ransomware/356292/university-of-california-gets-fleeced-by-hackers-for-114-million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Visit/security/cyber-security/356289/australia-announces-135b-investment-in-cybersecurity
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
Visit/cloud/cloud-security/356288/csa-and-issa-form-cybersecurity-partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020
Visit/business/policy-legislation/356215/senators-propose-a-bill-aimed-at-ending-warrant-proof-encryption
Policy & legislation

Senators propose a bill aimed at ending warrant-proof encryption

24 Jun 2020

Most Popular

Visit/laptops/29190/how-to-find-ram-speed-size-and-type
Laptops

How to find RAM speed, size and type

24 Jun 2020
Visit/cloud/356260/the-road-to-recovery
Sponsored

The road to recovery

30 Jun 2020
Visit/business-strategy/it-infrastructure/356258/the-growing-case-for-it-flexibility
Sponsored

The growing case for IT flexibility

30 Jun 2020