Cortana has security vulnerabilities when it operates on the lock screen
Microsoft has launched a security update to prevent hackers from entering PC via Cortana, the digital assistant integrated into each version of Windows 10. Researchers with information security training found that Cortana could be activated from a lock screen in order to index files from other addresses and run them.
These files could be executable programs or scripts that can perform commands capable of restart the password settings for PCs with Windows 10. This attack form is based on the ability of Cortana to execute commands from the PC lock screen, and relies on the fact that the operating system indexes files to make them compatible with the search interface that Cortana has access to.
Specialists from the International Institute of Cyber Security recommend disabling Cortana on the lock screen to prevent this attack variant, which is particularly constant in business environments. While Microsoft has solved this vulnerability with its latest security updates, released from yesterday, lots of computers will not run the latest updates yet.
Information security specialist, currently working as risk infrastructure specialist & investigator.
15 years of experience in risk and control process, security audit support, business continuity design and support, workgroup management and information security standards.
