11–20 of 143 posts
That's frankly alarming. They should be doing nothing but static analysis on those binaries and if they must execute them, then certainly not giving them any network access. That's without even touching on any IP law concerns and how an end user can be unwillingly complicit in such things...
From a copyright law perspective, this seems wild. Microsoft is downloading and running binaries from entities that may have never given Microsoft license to do so, including Microsoft's competitors. All based on a permission setting configured by an unrelated third party (the user).
It's possible that they don't need it. There are fair use exemptions for reverse engineering and automated analysis. These may be the legal basis on which anti-malware research can be conducted.
> They run the executable in an environment where network connectivity is available. Why does MS run unknown executables? On the other hand, should be a nice DDoS provider for blackhats...
Perhaps it's not running the EXE but instead identifying URLs in the code, cURLing them to see what it gets, and doing so to verify what they get isn't malware?
The exe must have been running to be able to generate the proper encrypted payload and send it to right place. In this case ports 20 and 1025 over TCP.
Disclaimer: I am one of the people who wrote the software.
"This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel."
As a user, you can just disable automatic sample submission. In fact I'm pretty sure you can set it during installation, as I've never had to go through the settings to disable it, but it's still disabled on all my installations.
But the question is, from an adversary perspective, does your victim have it disabled?
Most likely they won't, so you can use Microsoft as a mule to exfiltrate data from otherwise firewalled victims.
> They run the executable in an environment where network connectivity is available. Why does MS run unknown executables? On the other hand, should be a nice DDoS provider for blackhats...
Perhaps it's not running the EXE but instead identifying URLs in the code, cURLing them to see what it gets, and doing so to verify what they get isn't malware?
Seriously, what in hell? Like always, blatant violations of users in the name of "security".
From a copyright law perspective, this seems wild. Microsoft is downloading and running binaries from entities that may have never given Microsoft license to do so, including Microsoft's competitors. All based on a permission setting configured by an unrelated third party (the user).
[0] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
[1] https://en.wikipedia.org/wiki/Economic_Espionage_Act_of_1996
I think the key quote here is "This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel." As a user, you can just disable automati…
This is actually a smart idea. Make your spyware collect & encrypt data into a (new and unknown) binary and execute it, relying on the fact that Microsoft will exfiltrate it for you. When that binary itself is run (within MS' premises) it will then reach out to you with its embedded data.
If this is Microsoft's idea of performing a security function, I have to assume that submitted executables are also going into a giant database/archive that can be turned over to the three-letter agencies with a single National Security Letter, complete with any secrets embedded therein. Like Bo Burnham says, I guess I should lower my expectations a lot.