Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My application ran away and called home from Redmond

medium.com

Post reply on HN
Print view View original

31–40 of 143 posts

Re: My application ran away and called home from Redmond

#31

Post by TeMPOraL »

Someone1234 wrote: post #29
TeMPOraL wrote: post #21

Earlier quoted context omitted.

Software is covered by copyright; if I write some program and compile it, and they copy it off my machine behind my back to run somewhere, it is copyright violation, is it not?

Copyright infringement. It is unlikely to apply. Particularly as the infringement has no "effect [...] upon the potential market for or value of the copyrighted work." Meaning Microsoft hasn't hurt anyone else's bottom line. There's several fair usage arguments you can make. At least three strong arguments. But to be honest this would need to be tested in the courts one way or the other. I don't really think copyrigh…

Fair. I wonder how a combo of CFAA, HIPAA and GDPR could fare here. I couldn't find whether Windows Defender automatically uploads all executables it sees, but apparently[0] non-executables deemed "suspicious" can be uploaded too.

--

[0] - https://www.reddit.com/r/Windows10/comments/8dmqdy/windows_d...

Re: My application ran away and called home from Redmond

#32

Post by zelon88 »

Nextgrid wrote: post #19
MzHN wrote: post #14

I think the key quote here is "This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel." As a user, you can just disable automati…

> you can use Microsoft as a mule to exfiltrate data from otherwise firewalled victims This is actually a smart idea. Make your spyware collect & encrypt data into a (new and unknown) binary and execute it, relying on the fact that Microsoft will exfiltrate it for you. When that binary itself is run (within MS' premises) it will then reach out to you with its embedded data.

And it all slips through the firewalls and whitelists because it looks just like official "Microsoft Telemetry" data. Wow.

Re: My application ran away and called home from Redmond

#33

Post by unionpivo »

pnako wrote: post #24

>Microsoft Windows 10 sends all new unique binaries for further analysis to Microsoft by default. Wait, what? Let's say you write code that you compile using MSVC or MinGW or whatever to an .exe file. Surely there is no way this gets automatically sent to MS?

That is exactly what happens. And it happens with any new executable. I noticed it when i was trying out how well rust works on windows.

Re: My application ran away and called home from Redmond

#34

Post by moomin »

0xffff2 wrote: post #25
GhettoMaestro wrote: post #23

Earlier quoted context omitted.

Pretty sure by you having this malware submission feature enabled you have given a limited license for them to execute the binary. You're barking up the wrong tree.

You (the user) may not have the right to grant such a license.

Assume for a second this is correct. What's to stop virus writers from embedding a ToS preventing Microsoft from running the code?

I'm not saying you're wrong, I'm saying it's really hard to work out how this is meant to work.

Re: My application ran away and called home from Redmond

#35

Post by pbhjpbhj »

TeMPOraL wrote: post #31
Someone1234 wrote: post #29

Earlier quoted context omitted.

Copyright infringement. It is unlikely to apply. Particularly as the infringement has no "effect [...] upon the potential market for or value of the copyrighted work." Meaning Microsoft hasn't hurt anyone else's bottom line. There's several fair usage arguments you can make. At least three strong arguments. But to be honest this would need to be tested in the courts one way or the other. I don't really think copyrigh…

Fair. I wonder how a combo of CFAA, HIPAA and GDPR could fare here. I couldn't find whether Windows Defender automatically uploads all executables it sees, but apparently[0] non-executables deemed "suspicious" can be uploaded too. -- [0] - https://www.reddit.com/r/Windows10/comments/8dmqdy/windows_d...

Worth noting Fair Use in Copyright is a USA thing.

In UK there have been some changes to Fair Dealing in the last couple of years that I'm not up to date on, but I don't know of anything that would make this allowed except having an explicit license from the copyright holder.

Re: My application ran away and called home from Redmond

#36

Post by undersuit »

Nextgrid wrote: post #19
MzHN wrote: post #14

I think the key quote here is "This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel." As a user, you can just disable automati…

> you can use Microsoft as a mule to exfiltrate data from otherwise firewalled victims This is actually a smart idea. Make your spyware collect & encrypt data into a (new and unknown) binary and execute it, relying on the fact that Microsoft will exfiltrate it for you. When that binary itself is run (within MS' premises) it will then reach out to you with its embedded data.

Free data uploads. You could make unique binaries that when run start seeding a torrent. Maybe MS will put the kibosh on you uploading Seinfeld_S1_E1_obfuscated.exe to their cloud, but... how about a worm serving up its own updates through MS IPs?

Re: My application ran away and called home from Redmond

#39

Post by delfinom »

TeMPOraL wrote: post #17

Ok, so if I compile an executable that pops up a screen with a picture I drew + lots of personal and medical information about me, and phones me whenever it's executed, and then just leave it on my machine only for it to phone home from Redmond, can I sue them for copyright, GDPR, HIPAA violations and whatnot? How good is their "new unique binaries" detection? Could I do the same with just a bunch of files wrapped in…

1. You can turn it off and on fresh install it even asks you for permission to upload unknown executables

2. In business/corporate environments especially, there are many options that should be group policied by a proper functioning IT team as one of their many tasks.

Re: My application ran away and called home from Redmond

#40

Post by bediger4000 »

LorenPechtel wrote: post #30
mschuster91 wrote: post #3

> They run the executable in an environment where network connectivity is available. Why does MS run unknown executables? On the other hand, should be a nice DDoS provider for blackhats...

I'm sure Microsoft is keeping a very close eye on what they are actually doing. Run them in a virtual environment, see what they do to the environment and what internet communications they make. When it's done destroy the environment. If it tried to do something like a DDoS it would be identified as doing so and marked as malware, end of test.

> I'm sure Microsoft is keeping a very close eye on what they are actually doing.

This seems like a questionable assumption. Microsoft is in the media for being "better" these days, but doing this at all seems like bad judgement. MSFT has lawyers to win a fair use case, I'll agree to that, but large corporations don't have a lot of incentive to minimize negative externalities, because of the lawyers and money for lawyers.

Post reply on HN