- Actor Amanda Seales pushes back on #FreeRodneyReed movement Monday 10:58 PM
- Netflix thriller ‘Earthquake Bird’ can’t solve its own mystery Monday 4:45 PM
- Goop is selling an expensive ‘restraining arts’ BDSM kit Monday 4:17 PM
- Body positivity actress Lili Reinhart calls out Photoshopping app Monday 3:42 PM
- ‘Rick and Morty’ zeroes in on connections and leans into familiar territory Monday 3:30 PM
- People are sharing photos of how much they’ve changed in a decade Monday 2:30 PM
- A few of our favorite things on Newegg are on sale for Black Friday Monday 2:15 PM
- Disney adds ‘Bob’s Burgers’ movie back to release schedule after accidentally yanking it Monday 2:02 PM
- Ocasio-Cortez launches petition demanding Stephen Miller’s resignation Monday 1:24 PM
- Prince Andrew’s defense against child sex crimes stokes conspiracy theory flames Monday 1:20 PM
- More people may be looking to cancel Disney+ than Netflix Monday 1:09 PM
- Monday Night Football: How to stream Chiefs vs. Chargers live Monday 1:00 PM
- After days of deadly protests, Iran implements ‘largest internet shutdown ever’ Monday 12:55 PM
- ‘Disney Plus and thrust’ is apparently the new Netflix and Chill Monday 12:32 PM
- Woman fired, sued after coworker shared their sexts Monday 12:22 PM
Researchers discovered a way to bypass the Windows lock screen and infect a computer with malware using voice-commands via the Cortana virtual assistant.
First reported by Motherboard, independent researchers Tal Be’ery and Amichai Shulman noticed Cortana, which comes preinstalled on Windows 10, listens and responds to certain voice commands even after a computer goes to sleep. It does enough to let someone with physical access insert a USB drive and run malicious software.
Using voice commands, hackers can tell Cortana to open a web browser and pull up an unprotected webpage, or one that doesn’t encrypt web traffic. The USB network adapter then listens in and redirects the computer to another malicious website where malware downloads onto the system. All of this happens while the passcode-protected computer innocently displays its lock screen.
That’s not all. The hacker can then connect the computer to their Wi-Fi network by simply clicking on it, even when the machine is locked. Once a hacker gains control, they can use the computer to remotely spread malware to other nearby machines connected to the same local network. They do this by playing a sound file on the first infected computer that tells those machines to access a certain website. For example, it might say “Hey Cortana, go to Microsoft.com.” Using a proxy called Newspeak, the hackers can intercept all commands sent from nearby computers and redirect them to malicious sites.
You can get an idea of how a locked computer can be accessed via Cortana from this YouTube video Motherboard unearthed.
Microsoft fixed the vulnerability after the researchers informed them of the issue. Be’ery and Shulman told Motherboard that Cortana still responds to certain commands when locked, and they’re researching if other vulnerabilities exist.
We’ve seen hackers take over machines by infecting wireless accessories, like a keyboard or mouse. But the only incident we’re familiar with that involves voice assistants requires advanced techniques. In September, Scientists from China’s Zheijiang University published research demonstrating the use of ultrasonic, or inaudible high-frequency sounds, to break into voice assistants like Siri, Alexa, or Cortana. It’s an interesting technique, but not a viable method for most hackers.
The issue that plagued Windows machines is much more alarming and proves that even the latest technologies create new security vulnerabilities for hackers to exploit.
Phillip Tracy is a former technology staff writer at the Daily Dot. He's an expert on smartphones, social media trends, and gadgets. He previously reported on IoT and telecom for RCR Wireless News and contributed to NewBay Media magazine. He now writes for Laptop magazine.