Microsoft’s latest Patch Tuesday fixes Cortana flaw allowing hackers to bypass your lock screen

2 min. read

Published onJune 13, 2018

published onJune 13, 2018

Share this article

Read our disclosure page to find out how can you help Windows Report sustain the editorial teamRead more

This month’s Patch Tuesday for Windows 10 came with an important security update for Cortana, Microsoft’s digital assistant that is built into the OS. Indeed, Microsoft patched a“Cortana Elevation of Privilege Vulnerability”that has been discovered by theMcAfee Labs Advanced Threat Research team, which allowed hackers to get access to a Windows 10 PC by using Cortana on the lock screen.

“In Windows 10, on the most recent build at the time of submission, we observed that the default settings enable “Hey Cortana” from the lock screen, allowing anyone to interact with the voice-based assistant. This led to some interesting behavior and ultimately vulnerabilities allowing arbitrary code execution,” explained the security researchers at McAfee yesterday.

The report details three different vectors of attack, the first one being an information leak leveraging Windows indexing and the “Hey Cortana” voice command. The researchers also explained different techniques that an attacker having physical access to a Windows 10 PC could use to execute code from the lock screen, including a full password reset.

McAfee encourages Windows 10 users to install this month’s security update as soon as possible, though turning off Cortana on the lock screen is also a good mitigation. “The attack surface created by vocal commands and personal digital assistants requires much more investigation; we are just scratching the surface of the amount of research that should be conducted in this critical area,” the researchers said.

Radu Tyrsina

Radu Tyrsina has been a Windows fan ever since he got his first PC, a Pentium III (a monster at that time).

For most of the kids of his age, the Internet was an amazing way to play and communicate with others, but he was deeply impressed by the flow of information and how easily you can find anything on the web.

Prior to founding Windows Report, this particular curiosity about digital content enabled him to grow a number of sites that helped hundreds of millions reach faster the answer they’re looking for.

User forum

0 messages

Sort by:LatestOldestMost Votes

Comment*

Name*

Email*

Commenting as.Not you?

Save information for future comments

Comment

Radu Tyrsina

With KB5043178 to Release Preview Channel, Microsoft advises Windows 11 users to plug in when the battery is low#

Copilot in Outlook will generate personalized themes for you to customize the app#

Microsoft will raise the price of its 365 Suite to include AI capabilities#

Death Stranding Director’s Cut is now Xbox X|S at a huge discount#

Outlook will let users create custom account icons so they can tell their accounts apart easier#

Microsoft’s latest Patch Tuesday fixes Cortana flaw allowing hackers to bypass your lock screen#

With KB5043178 to Release Preview Channel, Microsoft advises Windows 11 users to plug in when the battery is low

Copilot in Outlook will generate personalized themes for you to customize the app

Microsoft will raise the price of its 365 Suite to include AI capabilities

Death Stranding Director’s Cut is now Xbox X|S at a huge discount

Outlook will let users create custom account icons so they can tell their accounts apart easier

Microsoft’s latest Patch Tuesday fixes Cortana flaw allowing hackers to bypass your lock screen