{"id":89585,"date":"2018-06-12T10:15:28","date_gmt":"2018-06-12T17:15:28","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=89585"},"modified":"2025-06-08T19:29:41","modified_gmt":"2025-06-09T02:29:41","slug":"want-to-break-into-a-locked-windows-10-device-ask-cortana-cve-2018-8140","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/want-to-break-into-a-locked-windows-10-device-ask-cortana-cve-2018-8140\/","title":{"rendered":"Want to Break Into a Locked Windows 10 Device? Ask Cortana (CVE-2018-8140)"},"content":{"rendered":"

June\u2019s \u201cPatch Tuesday\u201d (June 12) is here, but it is likely many Windows 10 users have not yet applied these updates. If you have not, just be sure not to leave your laptop lying around! The patches in this cycle fix a code execution vulnerability using the default settings for Windows 10 and the \u201cCortana\u201d voice assistant. We\u2019ll detail how this vulnerability can be used to execute code from the locked screen of a fully patched Windows 10 machine (RS3 at the time of our original submission, and confirmed on RS4 prior to this patch cycle). The vulnerability was submitted to Microsoft as part of the McAfee Labs Advanced Threat Research team\u2019s responsible disclosure policy<\/a>, on April 23. Attribution for this vulnerability submission goes to Cedric Cochin, Cyber Security Architect and Senior Principal Engineer.<\/p>\n

In this post, we will address three vectors of research that have been combined by Microsoft and together represent CVE-2018-8140. The first of these is an information leak, but we\u2019ll culminate with a demo showing full code execution to log in to a locked Windows device!<\/p>\n

Using \u201cHey Cortana!\u201d to Retrieve Confidential Information<\/strong><\/h2>\n

Personal digital assistants such as Siri, Alexa, Google Assistant, and Cortana have become commodities in many technologically inclined houses. From telling jokes, to helping with the grocery list, to turning on the kitchen lights, these robotic voices are beginning to feel oddly more and more personal as they expand their roles in our daily lives. However, we should consider the increased risk of built-in digital personal assistants when looking at new attack vectors for laptops, tablets, and smartphones. Our research on Microsoft\u2019s Cortana voice assistant began after reading about the \u201cBadUSB\u201d attacks demonstrated by industry researchers. We decided to take this a step further and ended up finding and reporting to Microsoft several issues related to Cortana.<\/p>\n

If you have spoken with Cortana, you may have noticed that \u201cshe\u201d is very helpful for a number of simple tasks: providing definitions, or looking up corporations, movies, artists, or athletes. She can even do math! In Windows 10, on the most recent build at the time of submission, we observed that the default settings enable \u201cHey Cortana\u201d from the lock screen, allowing anyone to interact with the voice-based assistant. This led to some interesting behavior and ultimately vulnerabilities allowing arbitrary code execution.<\/p>\n

We begin this analysis with a quick look into Windows indexing. If you have ever opened the advanced view of the Windows Indexing control panel, and navigated to the File Types tab, you will see a long list of file extensions. For each of them you will find details about the associated filter used by the indexing process. Essentially you have the \u201cfile properties filter\u201d and several other filters that could all be summarized as \u201cfile properties and file content filter.\u201d<\/p>\n

This means the index process will crack open the files and index their content, including some strings present in these documents. Let\u2019s keep that in mind for later as we continue.<\/p>\n

Using this knowledge, we wanted to try to access the same menu that you would see when using a Cortana search on an unlocked device.<\/p>\n

This will come as a surprise and lies at the core of all the issues we found, but simply typing<\/strong> while Cortana starts to listen to a query on a locked device will bring up a Windows contextual menu, as shown below:<\/p>\n

 <\/p>\n

On top: the result of typing \u201cpas\u201d in the Cortana search field on an unlocked computer.
\nAbove: the result of asking \u201cHey Cortana, P A S\u201d and using a whitespace keyboard sequence.<\/em><\/p>\n

In the preceding example, we queried Cortana for the term pas,<\/em> no preamble to the question, just speaking the three letters, P. A. S. Why not \u201cpass\u201d? Because Cortana can be quite picky with verbal statements and there is no dictionary definition for \u201cpass,\u201d leading to Cortana inviting us to continue in Edge after unlocking the device. Alternatively, instead of issuing a verbal statement, we could click on the \u201ctap and say\u201d button and just start typing this text, for example.<\/p>\n

We now have a contextual menu, displayed on a locked Windows 10 device. What could go wrong?<\/p>\n

Remember that all the results presented by Cortana come from indexed files and applications, and that for some applications the content of the file is also indexed. Now we can simply hover over any of the relevant matches. If the match is driven by filename<\/strong> matching, then you will be presented with the full path of the file. If the match is driven by the file content<\/strong> matching, then you may be presented with the content of the file itself.<\/p>\n

Keep in mind that the entire user folder structure is indexed, which includes the default location for most documents but also for mappings like OneDrive.<\/p>\n

Example of data leakage using voice command with Cortana and the whitespace keyboard sequence.<\/em><\/p>\n

Armed with this knowledge, you can use your imagination to come up with specific keywords that could be used to start harvesting confidential information from the locked device.<\/p>\n

Code Execution from the Windows Lock Screen (User Interaction May be Required)<\/strong><\/h2>\n

Next, we asked the question: Could we go a step further and get code execution in the context of the authenticated user? Remember we are using only a combination of voice commands and mouse\/touchpad\/touchscreen to gain access to the contextual menu at this point. We observed that just by hovering over a file, the full path or content of the file would be displayed. What happens if we were to click on it? That depends on the target. If the file being opened is an application or an executable (such as notepad or calc.exe), the file will run and be accessible only after the user properly logs in. If it is a document, script, or text file, it will be opened by an editor instead of being executed. At this point we can execute various preloaded Windows utilities such as calculator, but we cannot pass any parameters to the command line. We can open scripts including PowerShell, but instead of being executed, they will be opened in a text editor (notepad). The lack of parameters is a limitation for a \u201clive off the land\u201d attack, which uses current tools and content to achieve a malicious purpose; however, there are plenty of malicious activities that could be performed even with these restrictions. For example, many uninstallers will happily remove software without any need for parameters.<\/p>\n

Let\u2019s return to our goal: code execution from the lock screen. The only requirement for something to show up in the contextual menu is for it to be indexed.<\/p>\n

Public folders indexed by default.<\/em><\/p>\n

There are multiple ways for an unauthenticated attacker to get results to show up in the index of an authenticated user. One method relies on OneDrive. As the root of the OneDrive directory structure is in the user folder, all the OneDrive content is indexed by default. Basically, if you ever share a folder or file with \u201cedit\u201d rights, the person you share it with, as well as any other recipients of a forwarded link, can now drop a file that will be indexed. With the file indexed we have multiple options to proceed.<\/p>\n

Option 1: Drop an Executable File<\/strong><\/h2>\n

This method assumes you can write an executable file to the disk; it does not require you to have executed it. Via a phishing attack or another vulnerability, an attacker could drop a backdoor (for example, Cobalt Strike Beacon or Meterpreter) and be in business. If you need to execute the payload as an administrator, you can simply right-click (for a touchscreen this is a longer-hold screen press) and select \u201cRun as administrator.\u201d<\/p>\n

When running applications that do not have the Auto-Elevate Privilege, you will trigger a user account control (UAC) prompt and nothing will execute. This could still result in a valid attack because users rarely check the content of the prompt and often proceed through the warning dialog box. The attacker would have to execute the program, and then wait for the authenticated user to log in and finish the job. If the application has auto-elevate privileges, there will be no UAC prompt and the application will execute at high integrity.<\/p>\n

This is interesting behavior, but on its own not a very likely attack scenario, so let\u2019s continue to explore our options. Why not simply use a USB key to drop the payload because we have physical access? The content of the USB key is not indexed, so it would not be presented as a result of the search query (although there are other ways to use a USB device; see below).<\/p>\n

Option 2: Drop a non-PE Payload<\/strong><\/h2>\n

Portable executable (PE) backdoors are great, but can we gain execution with a non-PE payload, for example, a PowerShell script? \u00a0We can use the same right-click capability to assist, but with a small twist. The right-click menu is not always the same, even for a given file type.<\/p>\n

When you ask Cortana about \u201cPS1,\u201d you will be presented with your indexed PowerShell scripts. A right click will allow you to \u201copen file location\u201d or \u201ccopy full path,\u201d but with no means of execution.<\/p>\n

If you click on the file as we already mentioned, the file will open in edit mode. Curiously, it will not open the default editor (PowerShell ISE) for PowerShell scripts; instead, it will open the script in notepad. We assume this was intended as a security measure because notepad cannot execute scripts, unlike PowerShell ISE.<\/p>\n

The default right-click menu for PS1 files.<\/em><\/p>\n

Remember we mentioned that Cortana changes results based on your input query? When properly logged in, if you ask Cortana about \u201ctxt\u201d using the query \u201cHey Cortana\u201d followed by the letters \u201cT,\u201d \u201cX,\u201d \u201cT,\u201d she will present you with text documents, Notepad, and the most recent documents open by Notepad. Yet the right-click menu for items in the Recent category is different than the right-click menu for the same item in the Documents category.<\/p>\n

 <\/p>\n

At top:the context menu for a Recent item; above: the context menu for a Document item.<\/em><\/p>\n

We follow a three-step process:<\/p>\n

    \n
  • Land a PowerShell script in a location that will be indexed\n
      \n
    • Public folder, public share, or OneDrive<\/li>\n<\/ul>\n<\/li>\n
    • Execute a search query that will show the document and click on it\n
        \n
      • \u201cHey Cortana, PS1\u201d<\/li>\n
      • Select the PowerShell script you just indexed and left click<\/li>\n
      • The PowerShell script opens in Notepad<\/li>\n<\/ul>\n<\/li>\n
      • Execute a search query that will show the recent documents, right click, and\u2026\n
          \n
        • Using Cortana, type or search in the contextual menu for \u201ctxt\u201d<\/li>\n
        • Right click on the PowerShell script in the Recent category under the Apps tab at the top (not Documents)<\/li>\n
        • Click \u201cRun with PowerShell\u201d<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

          \u201cRun with PowerShell\u201d right-click menu option for Recent items.<\/em><\/p>\n

          We now have local code execution with the payload of our choosing, without any exploit, even if the device is encrypted, on an up-to-date locked Windows 10 device.<\/p>\n

          This technique helps us understand some of the differences between apps, documents, extensions, and the way Windows handles them from a locked or unlocked screen. Yet it probably does not represent much of a real-world attack vector. Then again, we are not finished.<\/p>\n

          Logging into a Locked Device with no User Interaction<\/strong><\/h2>\n

          Finally, we have local code execution, but with some real limitations. We need to get our payload indexed but we cannot pass command-line parameters. This could be a limiting factor for our PowerShell attack vector because the execution policy may prevent its execution, and without command-line parameters we cannot pass an \u201c-ExecutionPolicy Bypass\u201d (or any other flavor). We would also have to find a way to land a PS1 script on the victim\u2019s box, and <\/em>have remote access to the physical machine or the login screen.<\/p>\n

          The techniques we have described so far are far too complicated compared with the simplicity and effectiveness of what comes next.<\/p>\n

          You recall the use of the keyboard-timing sequence to trigger the contextual search menu from a locked screen while querying Cortana. Any keystroke can trigger the menu from the time when Cortana begins to listen to when the answer is displayed. Press any key at this point; we like to use the spacebar because you cannot backspace and Windows will nicely ignore or trim out the space in its text results anyways. Invoke keyboard input too early or before Cortana is listening and you will be prompted to enter your password; invoke too late and Cortana goes back to sleep or returns normal results without a context menu.<\/p>\n

          It is not very intuitive to use the keyboard in addition of voice commands, but you can type your search the same way you do on an unlocked device, assuming that you triggered Cortana to listen.<\/p>\n

          The following screenshot demonstrates this behavior:<\/p>\n

            \n
          • Trigger Cortana via \u201cTap and Say\u201d or \u201cHey Cortana\u201d<\/li>\n
          • Ask a question (this is more reliable) such as \u201cWhat time is it?\u201d<\/li>\n
          • Press the space bar, and the context menu appears<\/li>\n
          • Press esc, and the menu disappears<\/li>\n
          • Press the space bar again, and the contextual menu appears, but this time the search query is empty<\/li>\n
          • Start typing (you cannot use backspace). If you make a mistake, press esc and start again.<\/li>\n
          • When done (carefully) typing your command, click on the entry in the Command category. (This category will appear only after the input is recognized as a command.)<\/li>\n
          • You can always right click and select \u201cRun as Administrator\u201d (but remember the user would have to log in to clear the UAC)<\/li>\n<\/ul>\n

            You can use the following example of a simple PowerShell command to test. Enjoy the soothing beeps that demonstrate code execution from a locked device.<\/p>\n

            What can we do at this point? You name it. Our demo below shows a password reset and login on a Windows 10 build, using only this simple technique.<\/p>\n