One of the most basic steps a computer user can take to secure their system against someone with physical access to it is to configure it to password-lock after an interval of inactivity. This prevents nosy office colleagues and Starbucks patrons from peering at your screen when you step away, and also helps protect against most "evil maid" attacks—where a malicious hotel worker, airport security agent, or someone else with brief access to your machine plugs a malicious USB stick into it to implant spyware.
But two independent Israeli researchers found a way for an attacker to bypass the lock protection on Windows machines and install malware by using voice commands directed at Cortana, the multi-language, voice-commanded virtual assistant that comes embedded in Windows 10 desktop and mobile operating systems.
Edit:The attack Be'ery and Shulman designed works because Cortana allowed direct browsing to web sites, even when a machine was locked—or at least it did until Microsoft fixed the problem after the researchers disclosed it to the company.
Edited by JohnC_21, 09 March 2018 - 03:19 PM.