{"id":89635,"date":"2018-06-13T00:56:17","date_gmt":"2018-06-13T07:56:17","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=89635"},"modified":"2025-08-19T08:46:02","modified_gmt":"2025-08-19T15:46:02","slug":"cortana-vulnerability-windows-10","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/security-news\/cortana-vulnerability-windows-10\/","title":{"rendered":"New Cortana Vulnerability Could Allow Cybercriminals to Bypass Lock Screen On Windows 10"},"content":{"rendered":"

Digital assistants<\/a> help us look up the weather, play our favorite music, and allow us to quickly access a lot of our personal information. And between Amazon Alexa, Google Home, and Microsoft Cortana \u2013 these services have become all the rage these days. However, the latter service, according to the McAfee Labs Advanced Threat Research (ATR) team, can be easily compromised, which is why the team has submitted a vulnerability to Microsoft which involves the default settings for Windows 10 and the Cortana voice assistant. The vulnerability can be used to do things such as retrieve information from Cortana, start an application from the Windows lock screen, and even log into a Windows 10 device without a user interacting with the computer.<\/p>\n

To understand how someone can take advantage of this vulnerability, imagine you are sitting at your favorite coffee shop and need to use the restroom. As a security-minded individual, you lock your computer\u2019s screen thinking that would keep bad people from accessing your information. With this vulnerability, all someone would have to do is say, \u201cHey Cortana,\u201d then follow a few simple steps to gain access to the treasure trove of information, no reboot required.<\/p>\n

By taking advantage of this vulnerability, McAfee researcher Cedric Cochin<\/a> discovered that by simply typing while Cortana starts to listen to a request or question on a locked device, he could bring up a search menu. Cochin didn\u2019t even have to say anything to Cortana, but simply clicked on the \u201ctap and say\u201d button and started typing in words. At that point, he could hover over search results, which included documents and other files, and see where they led to on that computer. What\u2019s more \u2013 he was able to take it a step further and figured out a way to access certain confidential files and information.<\/p>\n

Though there are limitations to what cybercriminals could do, there are ways they can get the right file results to show up, which have been outlined in our McAfee Labs blog post<\/a> on this topic. By leveraging one of these techniques, cybercriminals could use this vulnerability to take malicious actions such as resetting passwords on a Windows 10 computer, even though the device is technically locked. In only a few seconds, an attacker has full access to a computer.<\/p>\n

Security Tips<\/h2>\n

With the discovery of this vulnerability, the next question is \u2013 what can I do to not be a victim of this? Start by following these security tips:<\/p>\n