Open Sesame: Picking Locks with Cortana

The presentation discusses vulnerabilities in the Cortana voice assistant and the need for comprehensive security measures when introducing new interfaces.

• Cortana can be extended using skills, which are deployed and run exclusively on the cloud, with no third-party code running on the client machine.
• The presentation demonstrates several vulnerabilities in Cortana, including the ability to bypass the lock screen and access private files.
• The vulnerabilities were not due to insecure coding, but rather a lack of consideration for the overall security of the system.
• The presenters recommend disabling Cortana voice in corporate environments and implementing comprehensive security measures for voice interfaces.
• Builders and breakers should consider the overall security implications of new interfaces and features.
• The anecdote demonstrates the ability to access private files and bypass the lock screen using Cortana.

The presenters demonstrate the 'Open Sesame' vulnerability, which allows an attacker to access private photos and sensitive files using Cortana while the computer is locked. By saying 'Hey Cortana' and typing in a search query, the attacker is able to bypass the lock screen and access the desired files. This vulnerability highlights the need for comprehensive security measures when introducing new interfaces.

Many new devices are trying to fit into our life seamlessly. As a result, there’s a quest for a “universal access methods” for all devices. Voice activation seems to be a natural candidate for the task and many implementations for it surfaced in recent years. A few notable examples are Amazon’s Alexa, Google’s Assistant and Microsoft’s Cortana. The problem starts when these “Universal” access methods, aimed for maximal comfort, meet the very “specific” use-case of the enterprise environment which requires comfort to be balanced with other aspects, such as security. Microsoft Cortana is used on Mobile and IoT devices, but also in the enterprise computers as it comes enabled by default with Windows10 and always ready to respond to users’ commands even when the machine is locked. Allowing interaction with a locked machine is a dangerous architectural decision, and earlier this year, we exposed the Voice of Esau (VoE) exploit for a Cortana vulnerability. The VoE exploit allowed attackers to take over a locked Windows10 machine by combining voice commands and network fiddling to deliver a malicious payload to the victim machine. In this presentation, we will reveal the “Open Sesame” vulnerability, a much more powerful vulnerability in Cortana that allows attackers to take over a locked Windows machine and execute arbitrary code. Exploiting the “Open Sesame” vulnerability attackers can view the contents of sensitive files (text and media), browse arbitrary web sites, download and execute arbitrary executables from the Internet, and under some circumstances gain elevated privileges. To make matters even worse, exploiting the vulnerability does not involve ANY external code, nor shady system calls, hence making code focused defenses such as Antivirus, Anti-malware and IPS blind to the attack. We would conclude by suggesting some defense mechanisms and compensating controls to detect and defend against such attacks.