Information that has been copied to Windows 10's clipboard can be accessed in the login screen of the operating system, a Norwegian security researcher discovered. The method makes use of possibility to connect to a Wifi network from the lock screen.
Security researcher Oddvar Moe shows in a video how it works. Data on the clipboard can be accessed by pasting it in the security key field of any of the available Wifi networks. The key field normally doesn't show the actual text but there is an icon that can be clicked to reveal what the actual text in the field is.
Moe adds that it's not possible to paste data in the username and password screen, it only works for the Wifi network key field.
Obviously this isn't directly a serious threat, and this is also what Microsoft's Security Response Center (MSRC) replied Moe when he informed them about the issue, "In general, MSRC does not consider issues that require physical access to be exploited as security vulnerabilities (immutable law #3). If the issue allows for direct code execution bypassing the logon screen of a locked computer, we may consider that a security vulnerability on a case-by-case basis."
It can be fun to check what colleagues have on their clipboard when they're out for lunch but that's probably the worst thing that can happen, as Moe concludes, "I don’t think this is a serious issue, but I would assume that it would be easy for Microsoft to prevent this with a few lines of code."
