My application ran away and called home from Redmond
1–10 of 143 posts
Re: My application ran away and called home from Redmond
#2From a copyright law perspective, this seems wild. Microsoft is downloading and running binaries from entities that may have never given Microsoft license to do so, including Microsoft's competitors. All based on a permission setting configured by an unrelated third party (the user).
Re: My application ran away and called home from Redmond
#3> They run the executable in an environment where network connectivity is available.
Why does MS run unknown executables? On the other hand, should be a nice DDoS provider for blackhats...
Re: My application ran away and called home from Redmond
#4Cool, is kind of like STUN but for networks with almost no connectivity.
Create a binary that sends info when started, submit it and wait for it to send the info from Redmond to your server.
Too bad there is no return channel or you could make IP over windows update.
Re: My application ran away and called home from Redmond
#5That's frankly alarming. They should be doing nothing but static analysis on those binaries and if they must execute them, then certainly not giving them any network access. That's without even touching on any IP law concerns and how an end user can be unwillingly complicit in such things...
Re: My application ran away and called home from Redmond
#6> Microsoft Windows 10 sends all new unique binaries for further analysis to Microsoft by default. They run the executable in an environment where network connectivity is available.
how did the author reach to this conclusion ? is it documented somewhere ?
Re: My application ran away and called home from Redmond
#7> Microsoft Windows 10 sends all new unique binaries for further analysis to Microsoft by default. They run the executable in an environment where network connectivity is available. how did the author reach to this conclusion ? is it documented somewhere ?
He includes this screenshot[0], addressing the "send" part. The "run" part seems evident from the network traffic coming from MSFT.
Re: My application ran away and called home from Redmond
#8If this is Microsoft's idea of performing a security function, I have to assume that submitted executables are also going into a giant database/archive that can be turned over to the three-letter agencies with a single National Security Letter, complete with any secrets embedded therein.
Like Bo Burnham says, I guess I should lower my expectations a lot.
Re: My application ran away and called home from Redmond
#9> They run the executable in an environment where network connectivity is available. Why does MS run unknown executables? On the other hand, should be a nice DDoS provider for blackhats...
Perhaps it's not running the EXE but instead identifying URLs in the code, cURLing them to see what it gets, and doing so to verify what they get isn't malware?
Re: My application ran away and called home from Redmond
#10> They run the executable in an environment where network connectivity is available. Why does MS run unknown executables? On the other hand, should be a nice DDoS provider for blackhats...
Maybe not DDoS - I doubt that MS allows that service to have that much throughput, but if you wanna try to get past someone's firewall rules, like the author points out - people may whitelist those particular IP's.