My application ran away and called home from Redmond • Hacker News Board

Re: My application ran away and called home from Redmond

#51

Post by kps » Mon, Oct 07, 2019, 5:41 PM UTC

Someone1234 wrote: post #29

TeMPOraL wrote: post #21

Earlier quoted context omitted.

Software is covered by copyright; if I write some program and compile it, and they copy it off my machine behind my back to run somewhere, it is copyright violation, is it not?

Copyright infringement. It is unlikely to apply. Particularly as the infringement has no "effect [...] upon the potential market for or value of the copyrighted work." Meaning Microsoft hasn't hurt anyone else's bottom line. There's several fair usage arguments you can make. At least three strong arguments. But to be honest this would need to be tested in the courts one way or the other. I don't really think copyrigh…

> Meaning Microsoft hasn't hurt anyone else's bottom line.

How so? Microsoft spent money implementing this copying, so the copy is clearly of value to them. Why shouldn't they pay for it?

Re: My application ran away and called home from Redmond

#52

Post by Bartweiss » Mon, Oct 07, 2019, 5:51 PM UTC

kemonocode wrote: post #5

That's frankly alarming. They should be doing nothing but static analysis on those binaries and if they must execute them, then certainly not giving them any network access. That's without even touching on any IP law concerns and how an end user can be unwillingly complicit in such things...

I can understand why people are saying that network access is necessary for meaningful execution, given how much malware conditions on it. (For instance, WannaCry's kill switch.) But it's still hair-raising from a developer's standpoint since network actions you expected to control are now triggering unexpectedly. I can think of a few ways for that to get ugly.

In this case Beacon was sandboxed for security observation, but a build could easily be sandboxed for network-unsafe testing instead. Perhaps it's issuing malformed or high-volume requests to test internal functionality, safe in the knowledge that it's not actually connected to anything, and so it becomes a DoS attack when it's launched in the wild.

Or worse, maybe it's calling home to an endpoint that does something when it gets the call. It's not hard to imagine somebody putting together a binary with any required auth baked in on the logic "this only exists on my machine", and then suddenly getting it called from Redmond as well. Best practices ought to handle that alright, but it's still an awfully surprising thing to have happen to your test build.

Re: My application ran away and called home from Redmond

#53

Post by lazyasciiart » Mon, Oct 07, 2019, 5:52 PM UTC

TeMPOraL wrote: post #17

Ok, so if I compile an executable that pops up a screen with a picture I drew + lots of personal and medical information about me, and phones me whenever it's executed, and then just leave it on my machine only for it to phone home from Redmond, can I sue them for copyright, GDPR, HIPAA violations and whatnot? How good is their "new unique binaries" detection? Could I do the same with just a bunch of files wrapped in…

I'm not sure how you would invoke HIPAA with no medical professionals involved. It doesn't just magically apply because you wrote down your own medical information.

Re: My application ran away and called home from Redmond

#54

Post by unionpivo » Mon, Oct 07, 2019, 5:56 PM UTC

fortran77 wrote: post #43

unionpivo wrote: post #33

Earlier quoted context omitted.

That is exactly what happens. And it happens with any new executable. I noticed it when i was trying out how well rust works on windows.

I couldn't even get Rust to install on Windows!

rustup is your friend. install that, and then rust with rustup.

Edit: forgot link: https://rustup.rs/

Re: My application ran away and called home from Redmond

#55

Post by em-bee » Mon, Oct 07, 2019, 6:01 PM UTC

gnode wrote: post #12

AlexandrB wrote: post #2

From a copyright law perspective, this seems wild. Microsoft is downloading and running binaries from entities that may have never given Microsoft license to do so, including Microsoft's competitors. All based on a permission setting configured by an unrelated third party (the user).

> never given Microsoft license to do so It's possible that they don't need it. There are fair use exemptions for reverse engineering and automated analysis. These may be the legal basis on which anti-malware research can be conducted.

i believe fair use only applies to software that you legally acquired.

if microsoft copies an application from my computer without asking, then it did not legally acquire it.

malware is a different case. malware entered my computer with the permission of the malware creator. i didn't steal it from them, but it came to me willingly. hence i am allowed to analyze it, and i am allowed to delegate that task to someone else.

Re: My application ran away and called home from Redmond

#56

Post by zeveb » Mon, Oct 07, 2019, 6:02 PM UTC

Analemma_ wrote: post #22

gnode wrote: post #12

Earlier quoted context omitted.

> never given Microsoft license to do so It's possible that they don't need it. There are fair use exemptions for reverse engineering and automated analysis. These may be the legal basis on which anti-malware research can be conducted.

Indeed, there have to be exceptions like this. Otherwise malware authors could sue AV companies for infringement, which don’t seem to fit the intention of IP law.

> Otherwise malware authors could sue AV companies for infringement, which don’t seem to fit the intention of IP law.

'You may sue the AV company for $1 million; users who suffered from your malware will civilly sue for $100 billion, and the government will charge you with crimes and put you away for a decade. Your move.'

Re: My application ran away and called home from Redmond

#57

Post by Bartweiss » Mon, Oct 07, 2019, 6:36 PM UTC

Havoc wrote: post #38

Also seems like a viable vector to DOS something - if Microsoft runs this on some sort of cloud infra with a fat pipe

My first thought was this leading to DoS, even accidental ones.

If you're testing that your binary builds requests properly, maybe you've got it making them as fast as possible and you're running it without network permissions. Fine, until it suddenly runs with full network access and hammers whatever service you're pointing at.

Re: My application ran away and called home from Redmond

#58

Post by Bartweiss » Mon, Oct 07, 2019, 6:45 PM UTC

lazyasciiart wrote: post #53

TeMPOraL wrote: post #17

Ok, so if I compile an executable that pops up a screen with a picture I drew + lots of personal and medical information about me, and phones me whenever it's executed, and then just leave it on my machine only for it to phone home from Redmond, can I sue them for copyright, GDPR, HIPAA violations and whatnot? How good is their "new unique binaries" detection? Could I do the same with just a bunch of files wrapped in…

I'm not sure how you would invoke HIPAA with no medical professionals involved. It doesn't just magically apply because you wrote down your own medical information.

There seems to be a widespread misconception that any information covered by HIPAA is always covered, when the reality is that it's only protected health information by covered entities. There also seems to be a lot of confusion about what's a violation: as far as I know only covered entities can be liable, not people they wrongly pass information on to.

Now, if a covered medical software company accidentally let a build with accessible PHI go to Microsoft, I guess it's possible they could be HIPAA liable. But that's a pretty narrow case, and not one that's a threat to Microsoft.

Re: My application ran away and called home from Redmond

#59

Post by Bartweiss » Mon, Oct 07, 2019, 6:51 PM UTC

fortran77 wrote: post #42

bediger4000 wrote: post #40

Earlier quoted context omitted.

> I'm sure Microsoft is keeping a very close eye on what they are actually doing. This seems like a questionable assumption. Microsoft is in the media for being "better" these days, but doing this at all seems like bad judgement. MSFT has lawyers to win a fair use case, I'll agree to that, but large corporations don't have a lot of incentive to minimize negative externalities, because of the lawyers and money for law…

Oh c'mon. Microsoft takes security seriously and is genuinely trying to make sure Windows users aren't plagued with malware. And internally, Microsoft has a good track record of not having any data breeches.

Even with utter cynicism, "Microsoft hosts DOS attack on Apple" is such a disastrous headline that it's well worth avoiding, and that's before getting into any liability for botching something like this.

Re: My application ran away and called home from Redmond

#60

Post by rahuldottech » Mon, Oct 07, 2019, 7:38 PM UTC

0xcde4c3db wrote: post #8

If this is Microsoft's idea of performing a security function, I have to assume that submitted executables are also going into a giant database/archive that can be turned over to the three-letter agencies with a single National Security Letter, complete with any secrets embedded therein. Like Bo Burnham says, I guess I should lower my expectations a lot.

Haha, it's always great to see a Bo Burnham reference in the wild. He said that about love, though. Not... Microsoft.