If you've been tempted to download the Bing Wallpaper app to spice up your Windows 11 desktop backgrounds, you may want to think twice.

The Bing Wallpaper app - itself [1]not a new product - was recently [2]added to the Microsoft Store for simpler download and installation. Going on a gut feeling to investigate it when the app appeared on the store, Rafael Rivera discovered a heap of concerning capabilities that he [3]said on X essentially make it a piece of Microsoft-developed "malware."

"Who makes a dedicated wallpaper app these days?" Rivera posited to The Register in response to questions about his findings, which answer the question for him.

[4]

"That [question] led me to take a look using basic tools, such as ILSpy for code decompilation and Windows Sandbox for testing and observation," Rivera said. "The code revealed concerning capabilities."

[5]

[6]

According to the self-identified Microsoft MVP alum, the Bing Wallpaper app includes undocumented features that enable it to alter Chrome browser extension preferences, and decrypt and read "all major browser cookies for user tracking purposes." It can also display user prompts with configurable timing to reduce annoyance, utilize encrypted configuration storage, and detect or intercept browser launches "to promote extensions and launch arbitrary URLs" that prompt users to switch to Bing and Edge inside their default browser.

In his thread on X, Rivera noted that the app also installs Bing Visual Search on host PCs without asking users.

[7]

"I've only scratched the surface," Rivera told us. "A full audit would be quite time-intensive and isn't where I want to focus my energy."

Feel free to audit it yourself, of course - but ESET already [8]considers it a potentially unwanted program if that helps solidify the degree to which Bing Wallpaper is trusted.

Microsoft denies decrypting all cookies

When asked to disprove Rivera's claims, Microsoft assured us that "the Bing Wallpaper app does not peruse and decrypt all [emphasis added] user Edge and Chrome cookies," a distinction Rivera dismissed as "splitting hairs" - and notably, Redmond doesn't mention Firefox.

"The app locates where Google Chrome, Microsoft Edge, and Mozilla Firefox store their cookies, queries for cookies with names they are interested in (such as MUID), retrieves their encrypted content, and then proceeds to decrypt them, all without user intervention," Rivera said in response to Microsoft's claims. "The cookie values then appear to get sent to or are used by Microsoft."

Microsoft further noted that the app performs a Bing cookie check to avoid repeatedly offering users the Bing app if it's already installed, but didn't otherwise address the app's handling of cookies.

[9]Microsoft is a national security threat, says ex-White House cyber policy director

[10]So how's Microsoft's Secure Future Initiative going?

[11]Recall the Recall recall? Microsoft thinks it can make that Windows feature palatable

[12]Microsoft security tools questioned for treating employees as threats

Redmond also told us that the Bing Wallpaper app isn't new, and the version added to the Microsoft Store didn't include any new functionality or changes from previous versions.

Rivera noted that Bing Wallpaper is distributed through multiple channels and in various forms that include the ability for it to be remotely reconfigured. "It's not immediately clear, or documented, which configurations do and do not offer/install certain features," he told us.

[13]

In short, you might want to take a pass on installing this one - it's another in a long line of [14]questionable data gathering practices by Microsoft that show [15]no sign of slowing down - after all, if the app is free, the company will surely seek some way to monetize it.

"What I find deeply troubling is Microsoft's willing development and distribution of what is essentially malware," Rivera said. "It's heartbreaking to see one of my favorite tech giants deliberately create software that undermines user privacy and autonomy." ®

Get our [16]Tech Resources



[1] https://onmsft.com/news/microsoft-launches-bing-wallpaper-app-windows-10/

[2] https://apps.microsoft.com/detail/xpfp7f8rl7mb1w?ocid=pdpshare&hl=en-us&gl=US

[3] https://x.com/WithinRafael/status/1858769565054062772

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z0X-sTfmiQq7f-id6OA7eQAAARE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z0X-sTfmiQq7f-id6OA7eQAAARE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z0X-sTfmiQq7f-id6OA7eQAAARE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z0X-sTfmiQq7f-id6OA7eQAAARE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[8] https://support.eset.com/en/kb2629-what-is-a-potentially-unwanted-application-or-potentially-unwanted-content

[9] https://www.theregister.com/2024/04/21/microsoft_national_security_risk/

[10] https://www.theregister.com/2024/09/23/microsoft_secure_future_initiative/

[11] https://www.theregister.com/2024/09/27/microsoft_has_some_thoughts_about/

[12] https://www.theregister.com/2024/08/27/microsoft_workplace_surveillance/

[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z0X-sTfmiQq7f-id6OA7eQAAARE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[14] https://www.theregister.com/2015/11/26/microsoft_renamed_data_slurper_reinserted_windows_10/

[15] https://www.theregister.com/2024/11/22/microsoft_recall_release/

[16] https://whitepapers.theregister.com/