Slashdot Mirror
A Vulnerability in Cortana, Now Patched, Allowed Attacker To Access a Locked Computer, Change Its Password (bleepingcomputer.com)
Catalin Cimpanu, reporting for BleepingComputer: Microsoft has patched a vulnerability in the Cortana smart assistant that could have allowed an attacker with access to a locked computer to use the smart assistant and access data on the device, execute malicious code, or even change the PC's password to access the device in its entirety. The issue was discovered by Cedric Cochin, Cyber Security Architect and Senior Principle Engineer at McAfee. Cochin privately reported the problems he discovered to Microsoft in April. The vulnerability is CVE-2018-8140, which Microsoft classified as an elevation of privilege, and patched yesterday during the company's monthly Patch Tuesday security updates. Further reading: Microsoft Explains How it Decides Whether a Vulnerability Will Be Patched Swiftly or Left For a Version Update.
He better have gotten a huge bug bounty for that. Remove code and auth changes via Cortana? That's gotta be worth at least the $10k PornHub paid for their PHP remote code execution (which wasn't even a PornHub bug, but a PHP one; so that company collected the PHP bounty on top of it as well).
How long before this bug is re-introduced?
It's continually blows my mind people *voluntarily* use Win10...the track record of show-stopping problems with this OS is well known.
So rise up, all ye lost ones, as one, we'll claw the clouds.
Far too integrated into the operating system for it's own good.
I thought so from the start, but when they made it so you couldn't fully disable Cortana, then I knew it for sure.
Just like Office of the Clippy era, it's introducing vulnerabilities you can't fix unless you hack the system beyond Microsoft's specifications.
The preceding post was not a Slashvertisement.
https://imgs.xkcd.com/comics/s...
How to Uninstall and remove the MS A.I. Node key logging spyware known as Cortana :
https://winaero.com/blog/how-to-uninstall-and-remove-cortana-in-windows-10/
"Microsoft has patched a vulnerability in the Cortana smart assistant that ALLOWS an attacker with access to a locked computer to use the smart assistant and access data on the device, execute malicious code, or even change the PC's password to access the device in its entirety."
The patch was released 1 day ago. This vulnerability still exists for every Cortana-equipped computer that has not yet been updated.
And how many people refuse to update because updates have a history of breaking things?
Using Windows 7 again. After the disastrous 1803 update I decided to stop playing beta operating system tester.
Religion: The greatest weapon of mass destruction of all time
Welcome to Slashdot. The first post is always something about Donald Trump, "gay n*****s", apping apps for luddites, or, if you are very very lucky, something about Golden Girls and cosmonauts.
If you are very very unlucky, it's spam about a custom hosts file.
The only time I felt that I love my country, is when my Windows 10 said that Cortana isn't support in my country or region, and never started on my PC.
Your point is interesting but let me summarize my experience with Linux so far:
In Windows up to version 7, the order is "updates accommodating the old code". The new things works but your old aplications (and some of then can be indeed very old) keeps working;
In Linux the order is "updates breaking the old code". The new things works but only luck will make your old applications work;
And now, to my dismay, the order in Windows 10 is also "updates breaking the old code".
Religion: The greatest weapon of mass destruction of all time
How to Uninstall and remove the MS A.I. Node key logging spyware known as Cortana :
https://winaero.com/blog/how-to-uninstall-and-remove-cortana-in-windows-10/
Running Process Explorer https://docs.microsoft.com/en-... if searchUI is listed Cortana is running
I dual boot Linux Mint, from there I rename the file X:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy by adding -something to the end of it.
I don't uninstall it as each update reinstalls it (last one did).
I dual boot Linux Mint, from there I rename the file X:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy by adding -something to the end of it.
I don't uninstall it as each update reinstalls it (last one did).
I've had to remove the rename, leaving the directory as it was.
This update crates a new directory with the same name adding close to 30 new .DLL's. Rebooting and removing same as it claims update didn't work. Next time I reboot it runs the update again - it's a stand off.
After updating, renamed the directory again and all is fine.
So those who uninstalled, I can only imagine the mess they are in.