My application ran away and called home from Redmond • Hacker News Board

Re: My application ran away and called home from Redmond

#71

Post by jmvoodoo » Mon, Oct 07, 2019, 10:13 PM UTC

joosters wrote: post #41

MzHN wrote: post #26

Earlier quoted context omitted.

Here's another thought. Could you use this to instead _attack_ someone from Microsoft's IP range? Maybe not DDoS, but if the range is naively whitelisted, maybe something more precise due to the fact that the victim believes the environment to be isolated.

Hopefully MS block their sandboxes from contacting known ports, e.g. < 1024, so it would be difficult to attack common services, but who knows?

Based on the article it seems low ports work. Port 20 was posted by the beacon.

Re: My application ran away and called home from Redmond

#72

Post by cududa » Mon, Oct 07, 2019, 10:16 PM UTC

em-bee wrote: post #55

gnode wrote: post #12

Earlier quoted context omitted.

> never given Microsoft license to do so It's possible that they don't need it. There are fair use exemptions for reverse engineering and automated analysis. These may be the legal basis on which anti-malware research can be conducted.

i believe fair use only applies to software that you legally acquired. if microsoft copies an application from my computer without asking, then it did not legally acquire it. malware is a different case. malware entered my computer with the permission of the malware creator. i didn't steal it from them, but it came to me willingly. hence i am allowed to analyze it, and i am allowed to delegate that task to someone el…

Yes but who’s to say it came to your machine under such circumstances

Re: My application ran away and called home from Redmond

#73

Post by arcboii92 » Mon, Oct 07, 2019, 10:17 PM UTC

jimnotgym wrote: post #67

I was interested in this Beacon software, but then I found you had to contact them for pricing and I gave up on the idea. Lesson: clear pricing keeps people like me in the game

I'm the same! I like to plan things, so if something doesn't allow me to fit it into my plan easily I will discard it as not an option.

Unknown costs, talking to other people, negotiating; these things produce trace amounts of anxiety. Anxiety I'd rather not deal with. A simple Pricing page solves this.

I'd rather spend an hour googling your competitors than contact someone for a quote.

Re: My application ran away and called home from Redmond

#74

Post by SteveNuts » Mon, Oct 07, 2019, 10:20 PM UTC

jimnotgym wrote: post #67

I was interested in this Beacon software, but then I found you had to contact them for pricing and I gave up on the idea. Lesson: clear pricing keeps people like me in the game

I've found a lot more software startups and SaaS companies using this method lately.

When I actually am interested enough to talk to their salespeople (and they're straightforward enough with me) they've told me it helps them target whales more easily.

They can charge a lot more to a huge Enterprise and adjust lower for SMBs.

Re: My application ran away and called home from Redmond

#75

Post by [deleted] » Mon, Oct 07, 2019, 10:22 PM UTC

[deleted]

Re: My application ran away and called home from Redmond

#76

Post by rkagerer » Mon, Oct 07, 2019, 10:22 PM UTC

Nextgrid wrote: post #19

MzHN wrote: post #14

I think the key quote here is "This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel." As a user, you can just disable automati…

> you can use Microsoft as a mule to exfiltrate data from otherwise firewalled victims This is actually a smart idea. Make your spyware collect & encrypt data into a (new and unknown) binary and execute it, relying on the fact that Microsoft will exfiltrate it for you. When that binary itself is run (within MS' premises) it will then reach out to you with its embedded data.

Yet another reason I'm reluctant to upgrade to Windows 10. Too many buttons and toggles to turn off to arrive at a PC that functions the way I expect it to, and an update mechanism that's likely turning new ones on faster than I can spot them.

Re: My application ran away and called home from Redmond

#77

Post by NewsAware » Mon, Oct 07, 2019, 10:27 PM UTC

delfinom wrote: post #39

TeMPOraL wrote: post #17

Ok, so if I compile an executable that pops up a screen with a picture I drew + lots of personal and medical information about me, and phones me whenever it's executed, and then just leave it on my machine only for it to phone home from Redmond, can I sue them for copyright, GDPR, HIPAA violations and whatnot? How good is their "new unique binaries" detection? Could I do the same with just a bunch of files wrapped in…

1. You can turn it off and on fresh install it even asks you for permission to upload unknown executables 2. In business/corporate environments especially, there are many options that should be group policied by a proper functioning IT team as one of their many tasks.

Too much FUD in this thread. Thanks for something level-headed.

Re: My application ran away and called home from Redmond

#78

Post by Animats » Mon, Oct 07, 2019, 10:43 PM UTC

"Microsoft Windows 10 sends all new unique binaries for further analysis to Microsoft by default."

Even if you're developing? Even if you're developing proprietary applications not for public use?

All your code are belong to us.

Re: My application ran away and called home from Redmond

#79

Post by Terr_ » Mon, Oct 07, 2019, 10:46 PM UTC

Havoc wrote: post #38

Also seems like a viable vector to DOS something - if Microsoft runs this on some sort of cloud infra with a fat pipe

I think that's less likely, if MS gets a thousand identical copies of a binary, they probably aren't going to bother test-analyzing more than one. There also might be some rate-limiting on what they'll do from a particular machine.

So your attack might require first controlling a swam of Windows 10 machines, in which case you might as well do it directly :P

Re: My application ran away and called home from Redmond

#80

Post by [deleted] » Mon, Oct 07, 2019, 10:51 PM UTC

MzHN wrote: post #14

I think the key quote here is "This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel." As a user, you can just disable automati…

[deleted]