Hagenah recently shared some important insights about security issues related to the Recall database on the TotalRecall GitHub page. He emphasized that while the overall security of Recall is strong, there’s a weak link when user data transfers to a process called AIXHost.exe—which doesn’t have the same security protections.
“The vault is solid,” Hagenah noted, “but the delivery truck is not.” This means that after you log in, your data can get intercepted during transmission.
The TotalRecall Reloaded tool takes advantage of this weakness. It uses an executable file to inject a DLL into AIXHost.exe without needing admin rights. Once you open Recall and log in, this tool can capture screenshots and other data sent to AIXHost.exe. This can even happen after you’ve logged out of Recall.
Hagenah points out that while the VBS enclave requires Windows Hello for decryption, his tool doesn’t bypass this—rather, it quietly rides along as you authenticate yourself. There are, however, some actions that can be performed without any authentication, like grabbing the latest Recall screenshot or deleting the entire Recall database.
After logging in, the TotalRecall Reloaded tool can access both current data and past records in Recall. As Hagenah put it, once authenticated, it’s like having a direct route to everything.
Interestingly, Microsoft has responded to these findings. They told Hagenah that they don’t consider this a bug and won’t be making any changes to the system. After Hagenah reported the issue to their Security Response Center on March 6, Microsoft labeled it as “not a vulnerability” by April 3.
The implications of this discovery are significant. Recall’s reliance on Windows Hello adds an additional layer of security, but its connection with AIXHost.exe presents a potential risk for users. With the rise in data breaches—recent data shows that 37% of adults in the U.S. have been affected by identity theft—it’s essential for organizations to reconsider their security measures.
While technology continues to advance, users must stay informed about the potential risks inherent in the tools they rely on. Awareness and vigilance can make all the difference in protecting personal information in an increasingly digital world.
