- PewDiePie calls Lilly Singh an ‘idiot’ for wondering why female YouTubers aren’t top earners 9 Months Ago
- Jack Dorsey had an amazing birthday in Myanmar, where social media enabled genocide 9 Months Ago
- Peter Griffin eulogizes Carrie Fisher’s character on ‘Family Guy’ Today 8:59 AM
- Trump can’t spell ‘smoking’ in latest tweet attacking Russia probe Today 8:25 AM
- Subtle Asian Traits brings wave of culture-specific memes to Facebook Today 8:00 AM
- The ‘universal language’ of Esperanto is thriving on the internet Today 7:30 AM
- NASA is helping Marvel rescue Tony Stark from space Today 7:07 AM
- Swipe This! My ex is thriving on Instagram—and it’s making me miserable Today 6:30 AM
- What life is like inside the right-wing Twitter bubble Today 6:30 AM
- The best Spanish movies on Netflix Today 6:00 AM
- Gavin McInnes is out at Blaze Media Sunday 7:07 PM
- Anthony Scaramucci praised QAnon during American Priorities conference Sunday 5:44 PM
- Report: FBI investigating fake net neutrality comments Sunday 4:36 PM
- The first professional U.S. transgender boxer just won his first fight Sunday 2:18 PM
- Twitch streamer apparently hits partner on video Sunday 1:45 PM
Ajibola Okubanjo/Flickr (CC-BY)
Microsoft has resolved the issue, but more could be on the way.
Researchers discovered a way to bypass the Windows lock screen and infect a computer with malware using voice-commands via the Cortana virtual assistant.
First reported by Motherboard, independent researchers Tal Be’ery and Amichai Shulman noticed Cortana, which comes preinstalled on Windows 10, listens and responds to certain voice commands even after a computer goes to sleep. It does enough to let someone with physical access insert a USB drive and run malicious software.
Using voice commands, hackers can tell Cortana to open a web browser and pull up an unprotected webpage, or one that doesn’t encrypt web traffic. The USB network adapter then listens in and redirects the computer to another malicious website where malware downloads onto the system. All of this happens while the passcode-protected computer innocently displays its lock screen.
That’s not all. The hacker can then connect the computer to their Wi-Fi network by simply clicking on it, even when the machine is locked. Once a hacker gains control, they can use the computer to remotely spread malware to other nearby machines connected to the same local network. They do this by playing a sound file on the first infected computer that tells those machines to access a certain website. For example, it might say “Hey Cortana, go to Microsoft.com.” Using a proxy called Newspeak, the hackers can intercept all commands sent from nearby computers and redirect them to malicious sites.
You can get an idea of how a locked computer can be accessed via Cortana from this YouTube video Motherboard unearthed.
Microsoft fixed the vulnerability after the researchers informed them of the issue. Be’ery and Shulman told Motherboard that Cortana still responds to certain commands when locked, and they’re researching if other vulnerabilities exist.
We’ve seen hackers take over machines by infecting wireless accessories, like a keyboard or mouse. But the only incident we’re familiar with that involves voice assistants requires advanced techniques. In September, Scientists from China’s Zheijiang University published research demonstrating the use of ultrasonic, or inaudible high-frequency sounds, to break into voice assistants like Siri, Alexa, or Cortana. It’s an interesting technique, but not a viable method for most hackers.
The issue that plagued Windows machines is much more alarming and proves that even the latest technologies create new security vulnerabilities for hackers to exploit.
Phillip Tracy is a former technology staff writer at the Daily Dot. He's an expert on smartphones, social media trends, and gadgets. He previously reported on IoT and telecom for RCR Wireless News and contributed to NewBay Media magazine. He now writes for Laptop magazine.