Futaba _ Webs 🕸🕸🎃🕸🕸

🎃 DANGER! Windows Recall

Premise 🕸🕸🎃🕸🕸

It’s no shocker that there are some ahem… “major” security related concerns that have been circulating about it for the past few weeks since its official announcement and release.

I’m going to talk a bit about how it works, and of course, like always, I’ll explain the dangers of it. In the more advanced version of the articles, I’m going to go over how some of the core API functions work, and how we can exploit them. Much like how in the DLL injection article where I mention there will be a followup article later on with live footage to show the exploit, the same will be the case with this article as well. This is to ensure you have the proper knowledge and that it marinates before we dive into the real thing.

Security is something that is HIGHLY neglected during many software development projects. I’ve talked a bit about this before, but if security is not kept in mind, it can lead to some pretty crazy stuff, like for example, OpenAuth and SSO. If you would like to see what I’m talking about in regards to that, you can check out this article here.

This article is a part of the Danger! Series, which is where I raise more Cyber Security awareness about critical flaws and vulnerabilities that exist within various system infrastructures, including any protocols and data communication methods, and the Dangers of what could happen should they be exploited to the fullest extent. I also go over various mitigation strategies that can be used to prevent them as well. If by chance there is an exploit video for me showing the full potential risk, it will be included in the advance version of this article for PAID patreon members only!

What is Windows Recall? 🕸🕸🎃🕸🕸

Windows recall is a new “snapshot” feature for Windows 11, where around every 5 seconds, the state of the system is essentially ‘screenshoted”, recording and saving the main state of the system, so that you can return back to a period in time and pick up where you left off.

The best analogy for this would be like the screenshot method for virtual machines, where you can “screenshot” where you’re currently at on the system and resume your progress later on when you need to. It’s also portable, so if you happen to snapshot the system, you can carry it to another VM of the same type and then pop it there.

Windows Recall is a part of the main Windows Copilot Runtime , which is an AI based API.

It relies on the User Activity API, which is a C# focused API, in order to create screenshots and encapsulate sessions that have to do with the end user data that is on the system: Overall user activity, data, data accounts, as well as any and all tasks that were running on the main system at the time.

What is a system screenshot? 🕸🕸🎃🕸🕸

System screenshots, often performed for virtual machines, is a mechanic that allows you to screenshot the entire state of the local system from all various endpoints: memory, tasks, running browser sessions and any cookie data with it, etc.

Think of it like “quick save” when you are playing a video game. Once you reach a certain checkpoint, OR, after a certain period of time, the game will “save” itself, in which, depending on the game, you can go back in time and pick up where you left off.

System snapshots is also a technique that is commonly used for forensics purposes, weather it be maliciously or defensively. It can be used, for example, to retrieve crypto keys that are often stored in memory while during live run time of the system. This can be vital for data recovery purposes in case you lost the keys, OR, in the eyes of an attacker, it can be used to decrypt any and al sensitive data with it to compromise a system infrastructure.