My application ran away and called home from Redmond • Hacker News Board

Re: My application ran away and called home from Redmond

#91

Post by icebraining » Tue, Oct 08, 2019, 12:35 AM UTC

Silhouette wrote: post #68

lazyasciiart wrote: post #53

Earlier quoted context omitted.

I'm not sure how you would invoke HIPAA with no medical professionals involved. It doesn't just magically apply because you wrote down your own medical information.

You could replace HIPAA with GDPR again, since almost any medical information about an identifiable individual will constitute sensitive personal data that requires the stronger protections under that law.

Microsoft might claim it's a Legitimate Interest (recital 49 might be useful here, though I'm not sure it applies).

Re: My application ran away and called home from Redmond

#92

Post by wtracy » Tue, Oct 08, 2019, 12:42 AM UTC

zeveb wrote: post #56

Analemma_ wrote: post #22

Earlier quoted context omitted.

Indeed, there have to be exceptions like this. Otherwise malware authors could sue AV companies for infringement, which don’t seem to fit the intention of IP law.

> Otherwise malware authors could sue AV companies for infringement, which don’t seem to fit the intention of IP law. 'You may sue the AV company for $1 million; users who suffered from your malware will civilly sue for $100 billion, and the government will charge you with crimes and put you away for a decade. Your move.'

A tangent:

There's this fascinating (to me, anyway) line between "viruses" (including worms, Trojans, and similar malware) that antivirus programs will tackle, and adware/spyware that they usually don't.

The difference between the two is whether it not there's a corporation publicly taking credit for the program and suing antivirus companies for defamation over calling it a "virus".

Adware/spyware is limited in distribution methods and payload types by the letter of the law, but otherwise the two classes are functionally identical.

Re: My application ran away and called home from Redmond

#93

Post by Silhouette » Tue, Oct 08, 2019, 12:55 AM UTC

icebraining wrote: post #91

Silhouette wrote: post #68

Earlier quoted context omitted.

You could replace HIPAA with GDPR again, since almost any medical information about an identifiable individual will constitute sensitive personal data that requires the stronger protections under that law.

Microsoft might claim it's a Legitimate Interest (recital 49 might be useful here, though I'm not sure it applies).

I suppose it could claim that, but I suspect it would be a tough sell with the regulators if Microsoft is uploading large amounts of data the user probably didn't even know about and some of that data turned out to include sensitive personal data.

Re: My application ran away and called home from Redmond

#94

Post by lvs » Tue, Oct 08, 2019, 1:06 AM UTC

pletnes wrote: post #16

Could you do ssh -R and get shell on the testing machine in Redmond? Could make a nice tunnel for getting US netflix.

Or launch ddos on a third party with a series of unique executables.

Re: My application ran away and called home from Redmond

#95

Post by api » Tue, Oct 08, 2019, 1:07 AM UTC

MzHN wrote: post #14

I think the key quote here is "This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel." As a user, you can just disable automati…

I think the key is that Windows 10 sends all new binaries to Microsoft by default. This is a total security and privacy (they're the same thing) nightmare.

Re: My application ran away and called home from Redmond

#96

Post by mirimir » Tue, Oct 08, 2019, 1:19 AM UTC

MzHN wrote: post #14

I think the key quote here is "This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel." As a user, you can just disable automati…

Also, in the image caption ...

> Because of Windows Defender automatic sample submission, Beacon binary was uploaded to Redmond and Beacon called Home from there.

... and below ...

> They run the executable in an environment where network connectivity is available.

Why would they do that? To see what happens?

And it's not just Microsoft. Many anti-malware apps (now, probably most) upload binaries. And I'm guessing that many run them. Maybe even with network access.

SensorFu might want to repeat this test using other anti-malware apps.

Re: My application ran away and called home from Redmond

#97

Post by mirimir » Tue, Oct 08, 2019, 1:27 AM UTC

0xcde4c3db wrote: post #8

If this is Microsoft's idea of performing a security function, I have to assume that submitted executables are also going into a giant database/archive that can be turned over to the three-letter agencies with a single National Security Letter, complete with any secrets embedded therein. Like Bo Burnham says, I guess I should lower my expectations a lot.

It's already happening.[0]

Marketplace Hansa was running Bitdefender, which pwned them to Europol.

> Europol has been supporting the investigation of criminal marketplaces on the Dark Web for a number of years. With the help of Bitdefender, an internet security company advising Europol's European Cybercrime Centre (EC3), Europol provided Dutch authorities with an investigation lead into Hansa in 2016. Subsequent enquiries located the Hansa market infrastructure in the Netherlands, with follow-up investigations by the Dutch police leading to the arrest of its two administrators in Germany and the seizure of servers in the Netherlands, Germany and Lithuania. Europol and partner agencies in those countries supported the Dutch National Police to take over the Hansa marketplace on 20 June 2017 under Dutch judicial authorisation, facilitating the covert monitoring of criminal activities on the platform until it was shut down today, 20 July 2017. In the past few weeks, the Dutch Police collected valuable information on high value targets and delivery addresses for a large number of orders. Some 10 000 foreign addresses of Hansa market buyers were passed on to Europol.

0) https://www.europol.europa.eu/newsroom/news/massive-blow-to-...

Re: My application ran away and called home from Redmond

#98

Post by naikrovek » Tue, Oct 08, 2019, 1:28 AM UTC

rkagerer wrote: post #76

Nextgrid wrote: post #19

Earlier quoted context omitted.

> you can use Microsoft as a mule to exfiltrate data from otherwise firewalled victims This is actually a smart idea. Make your spyware collect & encrypt data into a (new and unknown) binary and execute it, relying on the fact that Microsoft will exfiltrate it for you. When that binary itself is run (within MS' premises) it will then reach out to you with its embedded data.

Yet another reason I'm reluctant to upgrade to Windows 10. Too many buttons and toggles to turn off to arrive at a PC that functions the way I expect it to, and an update mechanism that's likely turning new ones on faster than I can spot them.

This is a Windows Defender thing, not a Windows 10 thing.

Windows Defender on Windows 7 also submits previously unobserved binaries to Microsoft for the same reason.

Go ahead, blame Win10, though. A non-zero number of people will take your comment to heart and believe that you knew what you were talking about with their entire soul, without seeing my comment.

I am so tired of seeing communal ignorance on this topic. People believe whatever bullshit they want, if it fits the narrative they are trying to sell.

Re: My application ran away and called home from Redmond

#99

Post by zamadatix » Tue, Oct 08, 2019, 1:36 AM UTC

Animats wrote: post #78

"Microsoft Windows 10 sends all new unique binaries for further analysis to Microsoft by default." Even if you're developing? Even if you're developing proprietary applications not for public use? All your code are belong to us.

I mean it's either send all or send none, there is not really an inbetween way to do this method.

Re: My application ran away and called home from Redmond

#100

Post by zamadatix » Tue, Oct 08, 2019, 1:39 AM UTC

anonymousisme wrote: post #83

It would be a fun experiment to create a network probe executable that exfiltrates results back to you, and then push it to Microsoft in this way. I wonder how secure their test environment could be if it has Internet access...

I'd imagine the app is run in a DMZ and the internet FW blocks typical malware behavior once detected. After all the whole point of running it is to find if the executable is going to do these types of things so they'd be prepared.