This Windows file may be secretly hoarding your passwords and emails

guest · Sep 19, 2018

This Windows file may be secretly hoarding your passwords and emails
September 19, 2018
https://www.zdnet.com/article/this-windows-file-may-be-secretly-hoarding-your-passwords-and-emails/

If you're one of the people who own a stylus or touchscreen-capable Windows PC, then there's a high chance there's a file on your computer that has slowly collected sensitive data for the past months or even years.

This file is named WaitList.dat, and according to Digital Forensics and Incident Response (DFIR) expert Barnaby Skeggs, this file is only found on touchscreen-capable Windows PCs where the user has enabled the handwriting recognition feature [1, 2] that automatically translates stylus/touchscreen scribbles into formatted text.

"In my testing, population of WaitList.dat commences after you begin using handwriting gestures," Skeggs told ZDNet in an interview. [...] "Once it is on, text from every document and email which is indexed by the Windows Search Indexer service is stored in WaitList.dat. Not just the files interacted via the touchscreen writing feature,"

This file is not dangerous unless users enable the handwriting recognition feature, and even in those scenarios, unless a threat actor compromises the user's system, either through malware or via physical access.
Click to expand...

mirimir · Sep 19, 2018

Now that's funny. Maybe using handwriting recognition for sensitive stuff is a dumb idea.

But maybe one just wipes WaitList.dat periodically.

shmu26 · Sep 20, 2018

mood said: ↑

This Windows file may be secretly hoarding your passwords and emails
September 19, 2018
https://www.zdnet.com/article/this-windows-file-may-be-secretly-hoarding-your-passwords-and-emails/
Click to expand...

Why is this more dangerous than the documents and emails themselves, which are already stored on the computer, sometimes in plain text?

guest · Sep 20, 2018

Instead of looking into each document or searching for documents, a "quick swoop" may be enough:

Skeggs says that instead of searching the entire disk for documents that may contain passwords, an attacker or malware strain can easily grab the WaitList.dat and search for passwords using simple PowerShell commands.
Click to expand...

Furthermore, even if the source file has been deleted, the content is still in the file WaitList.dat:

"If the source file is deleted, the index remains in WaitList.dat, preserving a text index of the file," he says. This provides crucial forensic evidence for analysts like Skeggs that a file and its content had once existed on a PC.
Click to expand...

mirimir · Sep 20, 2018

Yeah, what @mood said

This is just yet another Windows file that logs stuff that you don't want persisting. It's a never-ending struggle

Log in or Sign up

This Windows file may be secretly hoarding your passwords and emails

guest Guest

mirimir Registered Member

shmu26 Registered Member

guest Guest

mirimir Registered Member

Log in or Sign up

This Windows file may be secretly hoarding your passwords and emails

guest Guest

mirimir Registered Member

shmu26 Registered Member

guest Guest

mirimir Registered Member

Useful Searches