Cortana can be used to hack locked PC

[wasbit]

Two Israeli cyber-security experts have uncovered a serious Windows 10 security flaw, whereby the operating system’s voice assistant can be used to install malicious software.

Microsoft’s assistant Cortana can still be used while the PC is locked. The two found that by connecting a USB network adapter to the computer and engaging Cortana, they could direct the assistant to access unsafe web addresses and download malware to the device.

link

--
Regards
wasbit

Rig 1: Optiplex 3050 SFF
Rig 2: Asus ROG G20CB (rebuilt wreck)
Rig 3: HP Elitebook 8440P

Dear Starfleet, hate you, hate the Federation, taking Voyager. - Janeway

[Bob Williams]

Don’t have one of these gizmos, don’t want one. My gson’s company apparently also discovered this. They have a big contract with a national resort entertainment chain and could not initially find a problem. Traced it to the CEO’s wife using Cortana. Gson advised me that this flaw is not restricted to Cortana: all such devices might be susceptible.

‘Oh good’ was my thought, ‘something else to worry about, for those who have them’.

When the Thought Police arrive at your door, think -
I'm out.

[Dave Rice]

You have one Bob. It’s not a physical thing, it’s a Windows 10 service: Type here to Search.

[Ed P]

Having worked most of my life in an open plan environment I cannot think of anything worse than trying to control a computer using voice. If I can, it soon gets switched off in preferences even on my phone. Yelling at a light or spy-machine like Alexa/Cortana in IoT is even worse imo..

[Richard]

I do not  even have a microphone in the PC though I did find one useful when my hands were operated on and not useful for anything much. That said, training a voice set up to do all the things that I do on a PC and not those that MS lists as Cortana’s forte’s would drive me nuts. The Windows 10 search is pretty poor most of the time anyway. I have just spotted the big flaw, Cortana, which I have barred from almost everything, needs an MS account (or other details, e.g. mobile or skype.)

When listing the tree filling structure why oh why will it insist on returning you to some upper level when traversing the tree?

Why do I still really want to call it Cortina?

(The one thing I really miss is fully functional hands-free calling on a mobile. The Google version is more miss than hit most of the time, though I have successfully created a few dictated e-mails.)

[PlaneMan]

Richard wrote:

(The one thing I really miss is fully functional hands-free calling on a mobile. The Google version is more miss than hit most of the time, though I have successfully created a few dictated e-mails.)

That can depend on your device. My Shield K1 tablet hates my voice, hardly gets anything correct. My OnePlus 5T phone gets about 97% accuracy apart from when I’m half asleep.

[The Duke]

My pixel and 6p, plus the wife’s P9 are excellent. Also we are big users of Google home, that to is excellent.

I text a lot while driving with the hands free, eg “ok google, text dorris mobile, i’ll be home in 5 mins” etc..

I’m a heavy voice user.

We have an echo also, it’s just as good as the google recognition but i find the google fits better for me, given I’m neck deep in the googleverse!

[Bob Williams]

Dave, I don’t have Win10, still happily using 7. I know I will have to use 10 soon, but other matters are more pressing.

When the Thought Police arrive at your door, think -
I'm out.

[Richard]

Steve, calling home is exactly what I want hands free to do. I do not want all sorts of silly rather than calling the house phone number, texting is not much use as neither my wife or daughter has their mobile always to hand. They are either on charge or in handbags so a message might go unnoticed for hours. I have tried changing the ‘name’ associated with the number to see if things improve so I no longer get offered connections to various office buildings in London. It was all so easy with a Nokia one word and either success or a clear failure so try again, but that had no maps or navigation functions, so it is swings and roundabouts I guess. Using the driving aids and a few other odds and sods while waiting about at the hospital really used up the battery, it was down to 20% this morning, normally if it goes as low as 70% remaining I think that is a low point.

[The Duke]

If you have two numbers in yoir wife’s contact box, make sure you specify they type of number via the drop down box. Ie home, mobile, work, fax, or even under other you can write in a prefix(my girls phone i have giff gaff)

So when you want to call your wife on your home phone it would be ‘ok google, call wife home’

If for some reason you still have issues, make a new contact called home. ‘Ok google, call home’

If your driving i find it works better if you mute the radio and cost the window, thou i never mute the radio until they answer, so its not a must.

On a related note, google home was updated last week, and will now make calls to any number, trumping Amazons calling feature just between echos only. It’s really useful.

 

[Tippon]

Google’s hands free really annoys me. If the phone’s unlocked, it’s fantastic. It recognises my strong Welsh accent even when I’m bunged up, and rarely makes mistakes. If the phone’s locked though, it refuses to make calls. I’ve sorted all the settings to let me use Google Now, or Assistant when the phone is locked, but it tells me that it can’t do voice calls.

Surely that’s one of the main points of a hands free PHONE! ??

By the time I pick my phone up and unlock it, then speak the OK Google phrase and tell it who I want to ring, I could have just dialled them!

[Dave Rice]

It recognises my strong Welsh accent

Don’t get a Google vacuum cleaner, the number of times I hear South Waleans say Tidy!

[PlaneMan]

Dave Rice wrote:

It recognises my strong Welsh accent Don’t get a Google vacuum cleaner, the number of times I hear South Waleans say Tidy!

Very true Dave. My favourite is ‘now in a minute’. I have a badge on my rucksack that says ‘Apocalypse now, In a minute’

[Richard]

Well Steve today I tried calling the home phone using the freshly redefined home number as ‘Home’. the first try of

‘OK Google call home’

That told me about a television programme (I think) called ‘A placed called home’ set in Australia.

‘OK Google call home’

This second try  asked me where I wanted to call, forgetting that I had told it to call home.

‘OK Google call home’

This third try did manage to get a call to the right number.

I was sat in the more or less silent office at home actually inches from the phone in question. So Tippon I have to say hands free it ‘sort of is’, frustration free it is not! I agree that the locking habit is a pain, it is not supposed to lock when carried about or when using Bluetooth, but it often decides it knows better and locks anyway. Generally it is very slightly better when using the car’s hands free blue tooth, but it is a close run thing. Though the handset was supposed to be upgradeable to Android 7 it has never achieved that great leap, though the (unused) applications do appear to get one or other upgraded almost every day.

[The Duke]

What phone do you have. I’ve not had one for a good 5 years (pre google now), that didn’t work well.

Have you ever got it to call via voice? Have you activated the voice calling. If its not a google device, try installing the google now launcher and give it access. I dont think this should be done, but wont hurt for the experiment. Given you are altlready signed into your google (android) account, your not giving it anything it doesn’t already have. Plus you can in install after the test.

The majority of my phones come as stock with google now launcher already installed. The wife has a Huawei P9, but her first install is always google now launcher to mimic the clean ui

[Richard]

Yes Steve it is a Moto 4g Play and given a good wind it will voice call, one or two destinations appear to give it the screaming whatnots. Though it should update to Android 7.x it has not had any OS updates since February’s 2017 version.

I don’t put much on it, only a few numbers. Putting emails was a step too far though the mapping function and driving instructions are useful if I have a passenger who can use the thing. Last Thursday saw me wife break her fear of the dog and find it useful. So I guess it is not all bad. It did manage to call home after the third attempt, I guess it got bored with messing about.

[PlaneMan]

Depends on which mobile network you’re with, some are shocking at doing the updates.

Try the Android Auto app, I’ve been playing with it and it works great for me. You don’t need to be driving to use it but that’s the main idea.

[Richard]

Nolan, I am with EE and I guess that could be the issue. My daughter has a Samsung and that was updated a long time ago, but she uses it for very little, and even that is mostly via home Wi Fi. Her needs and her capabilities do not cover the likes of banking, even texts of more the a couple of words touch can unfamiliar boundaries.

[PlaneMan]

Is it a network locked phone?

If so trawl ebay for unlocking codes, feedback is the key. That Can help with the updates

[Richard]

No it was always unlocked and used for a while on Tesco mobile where it did get updates. I then obtained a new EE SIM and a large monthly allowance but in even in a busy month I do not go above about 50Mb out of a 5.5Gb allowance. Since using EE application updates have flowed but the OS remains stuck back in the dark ages, or so it feels. I guess it is probably not worth losing sleep over its decaying state but I doubt that I would go Motorola again. Samsun do appear to have things better set up in my very limited experience.

I have toyed with the idea of getting another Tesco SIM and seeing if it makes a difference but the weather is too cold and my motivation wanes too much.

Tanking you for taking an interest.

[Author]

Posts