This Windows 10 Flaw Allows Hackers Open Malicious Websites On A Locked PC

You may think your Windows 10 computer is locked, but do you think it is really locked?

Israeli Tech researchers Tal Be’ery and Amichai Shulman have discovered a loop in the OS by using just voice commands to make locked Windows 10 computers visit a website under the control of a malicious hacker… and potentially install a dangerous malware.

The problem lies in the Cortana inbuilt pc utility which is the voice assistant that Microsoft built into Windows 10. Unless properly controlled, these voice assistants can be a potential weakness on modern devices, opening opportunities for unauthorized users to perform malicious activities and attacks from the lock screen.

As the researchers explains; a hacker could sit at a locked Windows 10 PC and insert a USB network adapter. With that in place, a hacker can simply give a verbal command to Cortana to open the web browser and head to an unencrypted HTTP webpage from where he can install a malware into the Window 10 PC.

The adapter inserted into the USB drive intercepts the request, but redirects the browser to a malicious webpage instead.

A YouTube video demonstrates the exploit in action:

As Motherboard explains, with one computer infected in an organisation there exists the possibility for an attacker to spread  malware to other devices on the same computer network, stealing information on the individual computers.

Why does Cortana continue to listen for voice commands even when a Windows 10 PC is locked? Well, your guess might be as good as mine – but this is clearly a big problem, especially when you consider that many will not have bothered to train their PC to only obey a single user’s voice.

For that reason, I have deemed it right to recommend that Windows 10 users disable voice commands entirely when the PC is locked. Now, if you want to have a chat with your computer, then take a few seconds to unlock it first.

The truth is that if someone should get physical access to your computer, even if you have it locked, it may only take them a minute or so to install malicious code. Even if you have logged off and turned off the power, there’s still possibility for a criminal to go into your BIOS and tell the computer to temporarily boot up from a USB stick containing a dangerous computer malware.

When you come back five minutes later you really have no clue what’s been happening in your absence.

The vulnerability was responsibly disclosed to Microsoft co-operation and has already been patched by taking browser-based commands directly to the Bing search engine.

However, as there remains the possibility of Cortana to execute other commands that could perhaps be hijacked by an attacker, I find myself asking once again whether voice assistants are really that useful for the majority of us.

Now, this is the big question, Do the benefits of a a voice assistant outweigh the risks?