My application ran away and called home from Redmond • Hacker News Board

Re: My application ran away and called home from Redmond

#21

Post by TeMPOraL » Mon, Oct 07, 2019, 2:43 PM UTC

Someone1234 wrote: post #18

AlexandrB wrote: post #2

From a copyright law perspective, this seems wild. Microsoft is downloading and running binaries from entities that may have never given Microsoft license to do so, including Microsoft's competitors. All based on a permission setting configured by an unrelated third party (the user).

You didn't explain what this has to do with copyright? CFAA[0] (or even [1]) seems like a better avenue to explore, but still likely a dead-end. Copyright seems like a misnomer. [0] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act [1] https://en.wikipedia.org/wiki/Economic_Espionage_Act_of_1996

Software is covered by copyright; if I write some program and compile it, and they copy it off my machine behind my back to run somewhere, it is copyright violation, is it not?

Re: My application ran away and called home from Redmond

#22

Post by Analemma_ » Mon, Oct 07, 2019, 2:44 PM UTC

gnode wrote: post #12

AlexandrB wrote: post #2

From a copyright law perspective, this seems wild. Microsoft is downloading and running binaries from entities that may have never given Microsoft license to do so, including Microsoft's competitors. All based on a permission setting configured by an unrelated third party (the user).

> never given Microsoft license to do so It's possible that they don't need it. There are fair use exemptions for reverse engineering and automated analysis. These may be the legal basis on which anti-malware research can be conducted.

Indeed, there have to be exceptions like this. Otherwise malware authors could sue AV companies for infringement, which don’t seem to fit the intention of IP law.

Re: My application ran away and called home from Redmond

#23

Post by GhettoMaestro » Mon, Oct 07, 2019, 2:47 PM UTC

TeMPOraL wrote: post #21

Someone1234 wrote: post #18

Earlier quoted context omitted.

You didn't explain what this has to do with copyright? CFAA[0] (or even [1]) seems like a better avenue to explore, but still likely a dead-end. Copyright seems like a misnomer. [0] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act [1] https://en.wikipedia.org/wiki/Economic_Espionage_Act_of_1996

Software is covered by copyright; if I write some program and compile it, and they copy it off my machine behind my back to run somewhere, it is copyright violation, is it not?

Pretty sure by you having this malware submission feature enabled you have given a limited license for them to execute the binary. You're barking up the wrong tree.

Re: My application ran away and called home from Redmond

#24

Post by pnako » Mon, Oct 07, 2019, 2:48 PM UTC

>Microsoft Windows 10 sends all new unique binaries for further analysis to Microsoft by default.

Wait, what? Let's say you write code that you compile using MSVC or MinGW or whatever to an .exe file.

Surely there is no way this gets automatically sent to MS?

Re: My application ran away and called home from Redmond

#25

Post by 0xffff2 » Mon, Oct 07, 2019, 2:52 PM UTC

GhettoMaestro wrote: post #23

TeMPOraL wrote: post #21

Earlier quoted context omitted.

Software is covered by copyright; if I write some program and compile it, and they copy it off my machine behind my back to run somewhere, it is copyright violation, is it not?

Pretty sure by you having this malware submission feature enabled you have given a limited license for them to execute the binary. You're barking up the wrong tree.

You (the user) may not have the right to grant such a license.

Re: My application ran away and called home from Redmond

#26

Post by MzHN » Mon, Oct 07, 2019, 2:52 PM UTC

MzHN wrote: post #14

I think the key quote here is "This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel." As a user, you can just disable automati…

Here's another thought. Could you use this to instead _attack_ someone from Microsoft's IP range?

Maybe not DDoS, but if the range is naively whitelisted, maybe something more precise due to the fact that the victim believes the environment to be isolated.

Re: My application ran away and called home from Redmond

#27

Post by LorenPechtel » Mon, Oct 07, 2019, 2:52 PM UTC

kemonocode wrote: post #5

That's frankly alarming. They should be doing nothing but static analysis on those binaries and if they must execute them, then certainly not giving them any network access. That's without even touching on any IP law concerns and how an end user can be unwillingly complicit in such things...

Malware often checks to see if it has internet access and doesn't activate if it doesn't--to keep it from running in a test environment.

Re: My application ran away and called home from Redmond

#28

Post by TeMPOraL » Mon, Oct 07, 2019, 2:54 PM UTC

GhettoMaestro wrote: post #23

TeMPOraL wrote: post #21

Earlier quoted context omitted.

Software is covered by copyright; if I write some program and compile it, and they copy it off my machine behind my back to run somewhere, it is copyright violation, is it not?

Pretty sure by you having this malware submission feature enabled you have given a limited license for them to execute the binary. You're barking up the wrong tree.

Perhaps. It seems that this option is enabled by default, though. I imagine something about this is buried in the pile of agreements you have to click through when installing Windows. What's the status of current legal understanding of the reality that EULAs are bullshit and nobody ever reads them? Maybe I could win something from Europe via GDPR complaint if I compiled an executable containing my PII only for it to be exfilled by Microsoft?

Re: My application ran away and called home from Redmond

#29

Post by Someone1234 » Mon, Oct 07, 2019, 2:54 PM UTC

TeMPOraL wrote: post #21

Someone1234 wrote: post #18

Earlier quoted context omitted.

You didn't explain what this has to do with copyright? CFAA[0] (or even [1]) seems like a better avenue to explore, but still likely a dead-end. Copyright seems like a misnomer. [0] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act [1] https://en.wikipedia.org/wiki/Economic_Espionage_Act_of_1996

Software is covered by copyright; if I write some program and compile it, and they copy it off my machine behind my back to run somewhere, it is copyright violation, is it not?

Copyright infringement. It is unlikely to apply. Particularly as the infringement has no "effect [...] upon the potential market for or value of the copyrighted work." Meaning Microsoft hasn't hurt anyone else's bottom line.

There's several fair usage arguments you can make. At least three strong arguments. But to be honest this would need to be tested in the courts one way or the other.

I don't really think copyright conceptually is a very fruitful argument here. CFAA is likely stronger.

Re: My application ran away and called home from Redmond

#30

Post by LorenPechtel » Mon, Oct 07, 2019, 2:56 PM UTC

mschuster91 wrote: post #3

> They run the executable in an environment where network connectivity is available. Why does MS run unknown executables? On the other hand, should be a nice DDoS provider for blackhats...

I'm sure Microsoft is keeping a very close eye on what they are actually doing. Run them in a virtual environment, see what they do to the environment and what internet communications they make. When it's done destroy the environment.

If it tried to do something like a DDoS it would be identified as doing so and marked as malware, end of test.