Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My application ran away and called home from Redmond

medium.com

Post reply on HN
Print view View original

61–70 of 143 posts

Re: My application ran away and called home from Redmond

#61

Post by antsar »

Bartweiss wrote: post #58
lazyasciiart wrote: post #53

Earlier quoted context omitted.

I'm not sure how you would invoke HIPAA with no medical professionals involved. It doesn't just magically apply because you wrote down your own medical information.

There seems to be a widespread misconception that any information covered by HIPAA is always covered, when the reality is that it's only protected health information by covered entities. There also seems to be a lot of confusion about what's a violation: as far as I know only covered entities can be liable, not people they wrongly pass information on to. Now, if a covered medical software company accidentally let a b…

> not one that's a threat to Microsoft

Until the medical software company sues Microsoft for damages to recoup the HIPAA fine. This is probably buried in some clickwrap contract though. (IANAL; not sure how enforceable such a contract would be)

Re: My application ran away and called home from Redmond

#62

Post by antsar »

MzHN wrote: post #14

I think the key quote here is "This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel." As a user, you can just disable automati…

> But the question is, from an adversary perspective, does your victim have it disabled?

Does it even matter? Extrapolating from that quote: a submitted sample could make abusive network requests against the victim (from MSFT's network, which is "trusted"), as well as network requests back to the attacker's server for control and/or data collection.

Re: My application ran away and called home from Redmond

#65

Post by vortico »

pnako wrote: post #24

>Microsoft Windows 10 sends all new unique binaries for further analysis to Microsoft by default. Wait, what? Let's say you write code that you compile using MSVC or MinGW or whatever to an .exe file. Surely there is no way this gets automatically sent to MS?

Yes, you can test this yourself. Compile a 50MB binary and watch your bandwidth for a bit after attempting to run it.

I believe MacOS 10.15 also does this because there's a massive delay the first time I run a binary compiled with clang.

Re: My application ran away and called home from Redmond

#66

Post by Silhouette »

One of the main reasons we don't want anything to do with most recent Microsoft software at my office is concern that unspecified data we're working with -- which might include information obtained under NDAs, clients' trade secrets, sometimes personal data, etc. -- might get sent up to the mothership when one of the telemetry systems phones home.

People look at me as if we're crazy for worrying about this possibility, even though Microsoft of 2019 is notoriously vague about how any of this works and we could be flagrantly violating multiple laws and contractual obligations if it happened.

Re: My application ran away and called home from Redmond

#68

Post by Silhouette »

lazyasciiart wrote: post #53
TeMPOraL wrote: post #17

Ok, so if I compile an executable that pops up a screen with a picture I drew + lots of personal and medical information about me, and phones me whenever it's executed, and then just leave it on my machine only for it to phone home from Redmond, can I sue them for copyright, GDPR, HIPAA violations and whatnot? How good is their "new unique binaries" detection? Could I do the same with just a bunch of files wrapped in…

I'm not sure how you would invoke HIPAA with no medical professionals involved. It doesn't just magically apply because you wrote down your own medical information.

You could replace HIPAA with GDPR again, since almost any medical information about an identifiable individual will constitute sensitive personal data that requires the stronger protections under that law.

Re: My application ran away and called home from Redmond

#69

Post by scarejunba »

winkeltripel wrote: post #47
TeMPOraL wrote: post #21

Earlier quoted context omitted.

Software is covered by copyright; if I write some program and compile it, and they copy it off my machine behind my back to run somewhere, it is copyright violation, is it not?

The License you agreed to by using Windows probably covers this explicitly, even if they didn't get covered under the explicit exception for reverse-engineering and automated analysis.

Even if I were to, hypothetically, cross-compile from Linux to Windows and deny my user the right to give away software written by me?
Post reply on HN