Slashdot Mirror
'WaitList.dat' Windows File May Be Secretly Hoarding Your Passwords, Emails (zdnet.com)
A file named WaitList.dat, found only on touchscreen-capable Windows PCs, may be collecting your sensitive data like passwords and emails. According to ZDNet, in order for the file to exist users have to enable "the handwriting recognition feature that automatically translates stylus/touchscreen scribbles into formatted text." From the report: The handwriting to formatted text conversion feature has been added in Windows 8, which means the WaitList.dat file has been around for years. The role of this file is to store text to help Windows improve its handwriting recognition feature, in order to recognize and suggest corrections or words a user is using more often than others. "In my testing, population of WaitList.dat commences after you begin using handwriting gestures," [Digital Forensics and Incident Response expert Barnaby Skeggs] told ZDNet in an interview. "This 'flicks the switch' (registry key) to turn the text harvester functionality (which generates WaitList.dat) on." "Once it is on, text from every document and email which is indexed by the Windows Search Indexer service is stored in WaitList.dat. Not just the files interacted via the touchscreen writing feature," Skeggs says.
Since the Windows Search Indexer service powers the system-wide Windows Search functionality, this means data from all text-based files found on a computer, such as emails or Office documents, is gathered inside the WaitList.dat file. This doesn't include only metadata, but the actual document's text. "The user doesn't even have to open the file/email, so long as there is a copy of the file on disk, and the file's format is supported by the Microsoft Search Indexer service," Skeggs told ZDNet. "On my PC, and in my many test cases, WaitList.dat contained a text extract of every document or email file on the system, even if the source file had since been deleted," the researcher added. Furthermore, Skeggs says WaitList.dat can be used to recover text from deleted documents.
Since the Windows Search Indexer service powers the system-wide Windows Search functionality, this means data from all text-based files found on a computer, such as emails or Office documents, is gathered inside the WaitList.dat file. This doesn't include only metadata, but the actual document's text. "The user doesn't even have to open the file/email, so long as there is a copy of the file on disk, and the file's format is supported by the Microsoft Search Indexer service," Skeggs told ZDNet. "On my PC, and in my many test cases, WaitList.dat contained a text extract of every document or email file on the system, even if the source file had since been deleted," the researcher added. Furthermore, Skeggs says WaitList.dat can be used to recover text from deleted documents.
Sources also tell us there might be some links to KGB hackers injecting code thru backdoor Windows vulnerabilities to read this file to gain access/information to election systems and voters themselves.
Discuss.
Someone, a slashdot reader, as probably at least vaguely exemplary of most slashdot readers, (as contrasted with, say, underwater basket weavers in Nepal, an Amish carpenter, or whatever,) should, just as a feasibility study, swear-off all high-tech stuff, to see if a modern life can be lived without going online at all.
Naturally I would do it myself, but that would involve having to live without my various devices and gadgets, and... hahaha, yeah, right.
I am literally writing this with my thumbs, while sitting on a toilet. Give up my devices?!? Yeahno.
Would think it is newsworthy that a search index stores copies of the stuff it indexed or that another process that wants to use that index might want a copy of it for when the index file is locked for updating
holy Christ
best free email ever
I get where the concern is of "omg it's got muh emails!", but where do passwords come in?
Plan9 OS, your beautiful friend.
I just did a search on my machine and there is no WaitList.dat file. Nada, not a thing.
What? Another Linux guy pulling shit out of their armpit.
Windows on tablets sucks and security has become a punchline under Nutella, now here is Holly with the forecast...."the sun will come up tomorrow, back to you Chuck".
I mean is ANYBODY at this point surprised? Really? The first thing Nutella did when he took over was fire the QA and testing teams and make the users the beta testers (because that worked SOOO well for the games industry) and what have we seen from Redmond ever since? They can't put out a rolling release without breaking so many pieces of common hardware and software that its now more buggy than a Linux alpha build, security is a damned joke, and now we find surprise surprise they are storing sensitive info in a fricking .DAT file like its 1996...sigh.
I told ya you'd end up missing the Sweaty Monkey, at least all he did was try to steal Apple's "make it all pretty and shit" but that crap was easily stripped out and it was still a solid OS underneath the tacky paint, under Nutella? Its a clusterfuck, its all of Google's bad habits without any of their engineering skills.
ACs don't waste your time replying, your posts are never seen by me.
Nothing super threatening--you have to opt-in. Nobody known was affected. And Microsoft will have a patch out within like, two weeks.
I mean, it's good to know about this stuff to watch for trends. But this will have zero effect on anyone's lives, nor Microsoft's stock. Like a murderer, goes on trial, and goes to jail. You can talk about trends maybe, but the murderer is already in jail. He's not a direct threat to any of us. So it's not like "tonight at 10. this thing in your house WILL KILL YOUR CHILDREN if you don't know about it."
It was not introduced in windows 8 like the OP says. Now, this could be a newer feature of the handwriting service that was introduced in 8, I don't know. Also mentioned is a registry key that activates this feature, so you could use that to disable it.
An idea that I just had involves taking ownership of that file (or create an empty one in its place), set it to read only, and revoke permissions from every user, including SYSTEM. That may prevent the file from getting populated (search or handwriting features may no longer work as expected)