{"id":620,"date":"2024-06-02T00:24:45","date_gmt":"2024-06-01T22:24:45","guid":{"rendered":"https:\/\/threedots.ovh\/blog\/?p=620"},"modified":"2024-06-02T23:31:38","modified_gmt":"2024-06-02T21:31:38","slug":"recall-random-notes-about-the-security-model","status":"publish","type":"post","link":"https:\/\/threedots.ovh\/blog\/2024\/06\/recall-random-notes-about-the-security-model\/","title":{"rendered":"Recall: random notes about the security model"},"content":{"rendered":"\n

Disclaimer: As everything on this blog is, this is my own opinion, and not my employer’s.<\/em><\/p>\n\n\n\n

The conventional Unix security model is based around users, not applications. This implies that every application running in a given user context has access to all user data, even if that’s not related at all to what the app actually needs. And administrator users have access to all data within the system.<\/p>\n\n\n\n

Today, when a hacker hacks an average Windows system to administrative privileges1<\/a><\/sup>, they get access to browser history, its cache and other local data. What Recall does is add a searchable activity log that includes regular snapshots2<\/a><\/sup>.<\/p>\n\n\n\n

Is that a fundamental change or a change in degree?<\/em> If the latter, then I’d argue that this isn’t such a big thing, as it fits within the well understood3<\/a><\/sup> security model of Windows, which implies that access to an administrative account implies that you can see what’s going on across all of the system4<\/a><\/sup>. If the former, then Recall<\/em> is crossing the Rubicon by collating all of this data and making it searchable across a single place.<\/p>\n\n\n\n

What’s the biggest prior assumption that Recall breaks?<\/em> Recall doesn’t redact anything5<\/a><\/sup> on the screen from its dataset, except if the application or website6<\/a><\/sup> is on a deny list. Unless specifically deleted by the application7<\/a><\/sup>, snapshots are kept. There’s no way8<\/a><\/sup> for a website to signal that some data is too sensitive to keep by default9<\/a><\/sup>. This breaks the assumption that data on screen is only recorded when the user explicitly initiates a recording session or takes a screenshot. Special care has to be taken by applications10<\/a><\/sup> to delete an activity when the underlying data is11<\/a><\/sup>. However, there’s no current documentation12<\/a><\/sup> covering that aspect of the security model, and we’re around two weeks away from launch.<\/p>\n\n\n\n

Does Recall allow an attacker with administrative access to have access to more info than they could collect otherwise?<\/em> I’d argue yes. Browser caches expire, might not cover uncached pages, and are not deterministic in data collection the way Recall is. When data is deleted from the system13<\/a><\/sup>, Recall might still retain a copy unless proper integration is done to also revoke<\/em> those snapshots from the Recall side.<\/p>\n\n\n\n

Do other desktop operating systems have ways to make a folder inaccessible even if you are an administrator?<\/em> macOS does, through System Integrity Protection. Rootless<\/em>14<\/a><\/sup> systems do not allow even an administrator to access to folders protected by SIP, even if running as root<\/code>. SIP also restricts debugging of signed binaries except if those explicitly allow them to be debugged. This makes exfiltration of data from folders protected by SIP significantly harder15<\/a><\/sup>.<\/p>\n\n\n\n

If I’m a business, should I care?<\/em> Yes, you very likely have data retention and accuracy requirements16<\/a><\/sup>. Recall can make compliance with those significantly harder, especially as your line of business applications are probably<\/em> not integrated with Recall APIs. Customer data might as a result linger on decentralised systems significantly longer than necessary, heightening business risks.<\/p>\n\n\n\n

edit on June 2: Added the “What’s the biggest assumption that Recall breaks?” and “If I’m a business, why should I care?” sections.<\/em><\/p>\n\n\n

  1. I’d argue that a lot of Windows systems are single-user, with UAC being the only boundary to administrative access. UAC is not a security boundary<\/em> is a saying that’s often pronounced in some circles, not without reason. \u21a9\ufe0e<\/a><\/li>
  2. Screenshots, enhanced by data provided by the application through activity APIs. \u21a9\ufe0e<\/a><\/li>
  3. At least I hope so. It’s not something new. \u21a9\ufe0e<\/a><\/li>
  4. Protected processes (incl. light) and VSM trustlets exist. The former are used for csrss<\/code> since Windows 8.1 and DRM workloads notably, and the latter are used for Credential Guard and biometric data protection on some systems. However, I’m not aware of Windows components using those to protect bulk<\/em> user data on a given machine. \u21a9\ufe0e<\/a><\/li>
  5. DRMed content goes through the Protected Media Path, and as such is not accessible to Recall. \u21a9\ufe0e<\/a><\/li>
  6. When using Microsoft Edge \u21a9\ufe0e<\/a><\/li>
  7. Activity APIs provide a way for an application to delete an activity or all activities associated to it, see https:\/\/learn.microsoft.com\/en-us\/uwp\/api\/windows.applicationmodel.useractivities.useractivitychannel.deleteactivityasync?view=winrt-22621<\/a> \u21a9\ufe0e<\/a><\/li>
  8. Hmm, the website can perhaps use a hardware-backed DRM solution to display 2FA recovery codes for example. But that’s not exactly the wisest idea. \u21a9\ufe0e<\/a><\/li>
  9. Users ideally must<\/em> be able to override this if they want to. \u21a9\ufe0e<\/a><\/li>
  10. And utilities. Are you really<\/em> sure that your print preview window is covered too? \u21a9\ufe0e<\/a><\/li>
  11. An activity can directly be associated with an underlying file location: https:\/\/learn.microsoft.com\/en-us\/uwp\/api\/windows.applicationmodel.useractivities.useractivity.contenturi?view=winrt-22621<\/a> \u21a9\ufe0e<\/a><\/li>
  12. The only developer docs about Recall right now are at https:\/\/learn.microsoft.com\/en-us\/windows\/ai\/apis\/recall<\/a>. For a feature with such an impact, this is very lacking. Application developers should have told much earlier and given enough time to adapt their applications. \u21a9\ufe0e<\/a><\/li>
  13. Or the server. \u21a9\ufe0e<\/a><\/li>
  14. Systems where SIP is enabled, which is the default. \u21a9\ufe0e<\/a><\/li>
  15. Historically, there were quite a few SIP bypasses. However, SIP is still generally effective. \u21a9\ufe0e<\/a><\/li>
  16. In plenty of jurisdictions, customers have the right to correct errors in business records. Does that include everything that Recall might have about a given customer? \u21a9\ufe0e<\/a><\/li><\/ol>","protected":false},"excerpt":{"rendered":"

    Disclaimer: As everything on this blog is, this is my own opinion, and not my employer’s. The conventional Unix security model is based around users, not applications. This implies that every application running in a given user context has access to all user data, even if that’s not related at all to what the app… Read More »Recall: random notes about the security model<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":"[{\"content\":\"I'd argue that a lot of Windows systems are single-user, with UAC being the only boundary to administrative access. UAC is not a security boundary<\/em> is a saying that's often pronounced in some circles, not without reason.\",\"id\":\"a84975cc-94bb-4424-9aeb-7491757d57b7\"},{\"content\":\"Screenshots, enhanced by data provided by the application through activity APIs.\",\"id\":\"05779bcf-47ec-49a3-a07d-721f730fbd85\"},{\"content\":\"At least I hope so. It's not something new.\",\"id\":\"f9e95b43-c37a-4fd2-8151-ba1bde9933aa\"},{\"content\":\"Protected processes (incl. light) and VSM trustlets exist. The former are used for csrss<\/code> since Windows 8.1 and DRM workloads notably, and the latter are used for Credential Guard and biometric data protection on some systems. However, I'm not aware of Windows components using those to protect bulk<\/em> user data on a given machine. \",\"id\":\"fe9a2cef-a42f-4e6d-9136-cbb726f2b420\"},{\"content\":\"DRMed content goes through the Protected Media Path, and as such is not accessible to Recall.\",\"id\":\"593d5ca2-d1c6-4630-b4ea-40d3e9f94f42\"},{\"content\":\"When using Microsoft Edge\",\"id\":\"7cce477c-fdfd-44e2-9b3b-43f6ce240861\"},{\"content\":\"Activity APIs provide a way for an application to delete an activity or all activities associated to it, see https:\/\/learn.microsoft.com\/en-us\/uwp\/api\/windows.applicationmodel.useractivities.useractivitychannel.deleteactivityasync?view=winrt-22621<\/a>\",\"id\":\"aee4243c-79a3-493b-803f-11464b72c518\"},{\"content\":\"Hmm, the website can perhaps use a hardware-backed DRM solution to display 2FA recovery codes for example. But that's not exactly the wisest idea.\",\"id\":\"12d45077-3456-4ceb-8a63-68fb0a30dfd3\"},{\"content\":\"Users ideally must<\/em> be able to override this if they want to.\",\"id\":\"5f0bc878-8bec-4ffa-8798-615899dab91c\"},{\"content\":\"And utilities. Are you really<\/em> sure that your print preview window is covered too?\",\"id\":\"9802bc56-b974-4385-857b-5662bede9ac1\"},{\"content\":\"An activity can directly be associated with an underlying file location: https:\/\/learn.microsoft.com\/en-us\/uwp\/api\/windows.applicationmodel.useractivities.useractivity.contenturi?view=winrt-22621<\/a>\",\"id\":\"07fa962f-84f5-47b3-89f3-093f726ec0e4\"},{\"content\":\"The only developer docs about Recall right now are at https:\/\/learn.microsoft.com\/en-us\/windows\/ai\/apis\/recall<\/a>. For a feature with such an impact, this is very lacking. Application developers should have told much earlier and given enough time to adapt their applications.\",\"id\":\"0bdabd77-f40d-40fe-b37b-4fe5d53018e0\"},{\"content\":\"Or the server.\",\"id\":\"c3ac3227-39eb-4818-ab58-45962225ed15\"},{\"content\":\"Systems where SIP is enabled, which is the default.\",\"id\":\"d4d36b45-be09-48ee-9c14-2bb56fae6050\"},{\"content\":\"Historically, there were quite a few SIP bypasses. However, SIP is still generally effective.\",\"id\":\"f28629e4-0ad5-492c-80a0-3b72e41b747e\"},{\"content\":\"In plenty of jurisdictions, customers have the right to correct errors in business records. Does that include everything that Recall might have about a given customer?\",\"id\":\"e7047019-8085-4fba-a992-56353bd6479a\"}]"},"categories":[1],"tags":[],"class_list":["post-620","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/threedots.ovh\/blog\/wp-json\/wp\/v2\/posts\/620","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threedots.ovh\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threedots.ovh\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threedots.ovh\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/threedots.ovh\/blog\/wp-json\/wp\/v2\/comments?post=620"}],"version-history":[{"count":4,"href":"https:\/\/threedots.ovh\/blog\/wp-json\/wp\/v2\/posts\/620\/revisions"}],"predecessor-version":[{"id":627,"href":"https:\/\/threedots.ovh\/blog\/wp-json\/wp\/v2\/posts\/620\/revisions\/627"}],"wp:attachment":[{"href":"https:\/\/threedots.ovh\/blog\/wp-json\/wp\/v2\/media?parent=620"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threedots.ovh\/blog\/wp-json\/wp\/v2\/categories?post=620"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threedots.ovh\/blog\/wp-json\/wp\/v2\/tags?post=620"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}