There is a Windows file called WaitList.dat that secretly collects passwords and email information, with the help of the Index Search service for Windows.
Digital Forensics and Incident Response (DFIR) expert Barnaby Skeggs first discovered the information about the file in 2016, but it didn't receive much attention. However, after a new and exclusive interview with ZDNet – it appears that the file is actually quite dangerous.
People who own a Windows PC with a touchscreen or a laptop with a stylus are susceptible to the dangers of this Windows file. Specifically, users who have enabled the handwriting recognition tool, which automatically translates scribbles on the touchscreen into text, are at risk.
Essentially, the file is there to improve the accuracy of handwriting recognition so it can find better suggestions. However, while it's doing this, the file starts storing the actual text from your emails and office documents.
“Once enabled, the text from every document and email affected by the Windows Search Indexer service is stored in WaitList.dat,” says Skeggs.
Skeggs also reports that WatList.dat contains a snippet of each recognized text, even if the original file/source has been deleted or removed from the system.
In his tweet last month, Barnaby also pointed out the critical risks posed by this file. He said that if an attacker wanted to collect sensitive data from a user, instead of searching the entire disk for private information, they would only need WaitList.dat and could search for passwords using simple PowerShell commands.
The default file location is:
C:\Users\%User%\AppData\Local\Microsoft\InputPersonalization\TextHarvester\WaitList.
The handwriting recognition feature has been around since Windows 8, meaning the vulnerability has been around for many years. However, if you don't store valuable information like passwords or emails on your computer, it's unlikely you'll be significantly affected.
