Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My application ran away and called home from Redmond

medium.com

Post reply on HN
Print view View original

41–50 of 143 posts

Re: My application ran away and called home from Redmond

#41

Post by joosters »

MzHN wrote: post #26
MzHN wrote: post #14

I think the key quote here is "This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel." As a user, you can just disable automati…

Here's another thought. Could you use this to instead _attack_ someone from Microsoft's IP range? Maybe not DDoS, but if the range is naively whitelisted, maybe something more precise due to the fact that the victim believes the environment to be isolated.

Hopefully MS block their sandboxes from contacting known ports, e.g. < 1024, so it would be difficult to attack common services, but who knows?

Re: My application ran away and called home from Redmond

#42

Post by fortran77 »

bediger4000 wrote: post #40
LorenPechtel wrote: post #30

Earlier quoted context omitted.

I'm sure Microsoft is keeping a very close eye on what they are actually doing. Run them in a virtual environment, see what they do to the environment and what internet communications they make. When it's done destroy the environment. If it tried to do something like a DDoS it would be identified as doing so and marked as malware, end of test.

> I'm sure Microsoft is keeping a very close eye on what they are actually doing. This seems like a questionable assumption. Microsoft is in the media for being "better" these days, but doing this at all seems like bad judgement. MSFT has lawyers to win a fair use case, I'll agree to that, but large corporations don't have a lot of incentive to minimize negative externalities, because of the lawyers and money for law…

Oh c'mon. Microsoft takes security seriously and is genuinely trying to make sure Windows users aren't plagued with malware. And internally, Microsoft has a good track record of not having any data breeches.

Re: My application ran away and called home from Redmond

#43

Post by fortran77 »

unionpivo wrote: post #33
pnako wrote: post #24

>Microsoft Windows 10 sends all new unique binaries for further analysis to Microsoft by default. Wait, what? Let's say you write code that you compile using MSVC or MinGW or whatever to an .exe file. Surely there is no way this gets automatically sent to MS?

That is exactly what happens. And it happens with any new executable. I noticed it when i was trying out how well rust works on windows.

I couldn't even get Rust to install on Windows!

Re: My application ran away and called home from Redmond

#44

Post by 0xffff2 »

moomin wrote: post #34
0xffff2 wrote: post #25

Earlier quoted context omitted.

You (the user) may not have the right to grant such a license.

Assume for a second this is correct. What's to stop virus writers from embedding a ToS preventing Microsoft from running the code? I'm not saying you're wrong, I'm saying it's really hard to work out how this is meant to work.

I don't think a virus is relevant here. I'm not a lawyer, but the idea of a "terms of service" for an unwanted and maliciously installed executable seems nonsensical. Virus authors can include whatever TOS they want, but the "user" hasn't agreed to the TOS practically by definition.

Re: My application ran away and called home from Redmond

#45

Post by appleflaxen »

gnode wrote: post #12
AlexandrB wrote: post #2

From a copyright law perspective, this seems wild. Microsoft is downloading and running binaries from entities that may have never given Microsoft license to do so, including Microsoft's competitors. All based on a permission setting configured by an unrelated third party (the user).

> never given Microsoft license to do so It's possible that they don't need it. There are fair use exemptions for reverse engineering and automated analysis. These may be the legal basis on which anti-malware research can be conducted.

but until there is a court case with specific facts, that is very much a hope and a prayer by microsoft. it is, indeed, a risk they are taking.

Re: My application ran away and called home from Redmond

#46

Post by steveklabnik »

fortran77 wrote: post #43
unionpivo wrote: post #33

Earlier quoted context omitted.

That is exactly what happens. And it happens with any new executable. I noticed it when i was trying out how well rust works on windows.

I couldn't even get Rust to install on Windows!

What did you run into? Did you file a bug? That’d be helpful! I use Rust on Windows every day, though that means I’m not often re-installing it...

Re: My application ran away and called home from Redmond

#47

Post by winkeltripel »

TeMPOraL wrote: post #21
Someone1234 wrote: post #18

Earlier quoted context omitted.

You didn't explain what this has to do with copyright? CFAA[0] (or even [1]) seems like a better avenue to explore, but still likely a dead-end. Copyright seems like a misnomer. [0] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act [1] https://en.wikipedia.org/wiki/Economic_Espionage_Act_of_1996

Software is covered by copyright; if I write some program and compile it, and they copy it off my machine behind my back to run somewhere, it is copyright violation, is it not?

The License you agreed to by using Windows probably covers this explicitly, even if they didn't get covered under the explicit exception for reverse-engineering and automated analysis.

Re: My application ran away and called home from Redmond

#48

Post by ufmace »

unionpivo wrote: post #33
pnako wrote: post #24

>Microsoft Windows 10 sends all new unique binaries for further analysis to Microsoft by default. Wait, what? Let's say you write code that you compile using MSVC or MinGW or whatever to an .exe file. Surely there is no way this gets automatically sent to MS?

That is exactly what happens. And it happens with any new executable. I noticed it when i was trying out how well rust works on windows.

Seems bizarre. If I build 30 .NET binaries a day while building and testing a new feature, I guess all 30 get uploaded to MS and tested. And the same for all of the other developers doing the same sort of thing around the world. I wonder how often their test cluster goes down in flames while some C++ developer somewhere is trying to fix a memory access bug.

Re: My application ran away and called home from Redmond

#49

Post by winkeltripel »

TeMPOraL wrote: post #31
Someone1234 wrote: post #29

Earlier quoted context omitted.

Copyright infringement. It is unlikely to apply. Particularly as the infringement has no "effect [...] upon the potential market for or value of the copyrighted work." Meaning Microsoft hasn't hurt anyone else's bottom line. There's several fair usage arguments you can make. At least three strong arguments. But to be honest this would need to be tested in the courts one way or the other. I don't really think copyrigh…

Fair. I wonder how a combo of CFAA, HIPAA and GDPR could fare here. I couldn't find whether Windows Defender automatically uploads all executables it sees, but apparently[0] non-executables deemed "suspicious" can be uploaded too. -- [0] - https://www.reddit.com/r/Windows10/comments/8dmqdy/windows_d...

HIPAA would end up falling on your neck, not theirs. The users of windows are required to turn that setting off if you're in HIPAA land, among probably a hundred other things.
Post reply on HN