Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My application ran away and called home from Redmond

medium.com

Post reply on HN
Print view View original

111–120 of 143 posts

Re: My application ran away and called home from Redmond

#111

Post by TYPE_FASTER »

It looks like you can manually upload submissions here:

https://www.microsoft.com/en-us/wdsi/filesubmission

This may be outdated, but you can also configure Defender to always prompt before sending:

https://docs.microsoft.com/en-us/windows/security/threat-pro...

It would be interesting to set it to always prompt and see what triggers it. There must be some level of fingerprinting done on the client (hash of the binary? network activity, etc.) that can be used to compare against known threats.

Re: My application ran away and called home from Redmond

#112

Post by paxys »

AlexandrB wrote: post #2

From a copyright law perspective, this seems wild. Microsoft is downloading and running binaries from entities that may have never given Microsoft license to do so, including Microsoft's competitors. All based on a permission setting configured by an unrelated third party (the user).

> that may have never given Microsoft license to do so

I'm willing to bet it is in the license agreement for Windows and Windows Defender, so you have likely allowed Microsoft to do this

Re: My application ran away and called home from Redmond

#113

Post by mirimir »

fiblye wrote: post #110
naikrovek wrote: post #98

Earlier quoted context omitted.

This is a Windows Defender thing, not a Windows 10 thing. Windows Defender on Windows 7 also submits previously unobserved binaries to Microsoft for the same reason. Go ahead, blame Win10, though. A non-zero number of people will take your comment to heart and believe that you knew what you were talking about with their entire soul, without seeing my comment. I am so tired of seeing communal ignorance on this topic.…

>This is a Windows Defender thing, not a Windows 10 thing. So Windows Defender isn't bundled as a part of Windows 10?

Sure. But Windows users often installed it on Windows 7. And on Windows XP, as I recall.

Also, other anti-malware apps typically upload novel binaries. And their test machines likely run them, with network access, for the same reasons that Microsoft does.

So this exfiltration channel may well have existed for decades. Whether it's been used or not is an open question, though.

Edit: style

Re: My application ran away and called home from Redmond

#114

Post by mirimir »

mikepurvis wrote: post #108
Nextgrid wrote: post #19

Earlier quoted context omitted.

> you can use Microsoft as a mule to exfiltrate data from otherwise firewalled victims This is actually a smart idea. Make your spyware collect & encrypt data into a (new and unknown) binary and execute it, relying on the fact that Microsoft will exfiltrate it for you. When that binary itself is run (within MS' premises) it will then reach out to you with its embedded data.

Seems nuts that they'd just randomly run every binary that comes to them in a crash report.

I don't think that this is about crash reports.

Windows Defender, like many anti-malware apps, checks hashes of binaries. Anything that's new gets uploaded for testing.

Re: My application ran away and called home from Redmond

#115

Post by crummy »

Silhouette wrote: post #93
icebraining wrote: post #91

Earlier quoted context omitted.

Microsoft might claim it's a Legitimate Interest (recital 49 might be useful here, though I'm not sure it applies).

I suppose it could claim that, but I suspect it would be a tough sell with the regulators if Microsoft is uploading large amounts of data the user probably didn't even know about and some of that data turned out to include sensitive personal data.

Are many folks compiling sensitive personal data into binaries?

Re: My application ran away and called home from Redmond

#116

Post by csande17 »

> Microsoft Windows 10 sends all new unique binaries for further analysis to Microsoft by default.

Interestingly, Apple's now doing sort of the opposite of this. Instead of having the end-user's computer upload all executables to Apple for analysis, Apple requires the developer send them over and have them "notarized" before they run.

Re: My application ran away and called home from Redmond

#117

Post by wolrah »

fiblye wrote: post #110
naikrovek wrote: post #98

Earlier quoted context omitted.

This is a Windows Defender thing, not a Windows 10 thing. Windows Defender on Windows 7 also submits previously unobserved binaries to Microsoft for the same reason. Go ahead, blame Win10, though. A non-zero number of people will take your comment to heart and believe that you knew what you were talking about with their entire soul, without seeing my comment. I am so tired of seeing communal ignorance on this topic.…

>This is a Windows Defender thing, not a Windows 10 thing. So Windows Defender isn't bundled as a part of Windows 10?

> So Windows Defender isn't bundled as a part of Windows 10?

It was also bundled as part of Windows 8.1, Windows 8, Windows 7, and Windows Vista on top of being available as a free download for Windows XP (and even 2000 during the beta phase).

The current form, after the Microsoft Security Essentials package was merged in, didn't come about until Windows 8 but Windows Defender as a product dates back to Microsoft's purchase of GIANT Software.

Either way you call it, XP or 8, saying Defender is a Windows 10 thing is like saying Firefox is an Ubuntu 19.04 thing. Sure, Ubuntu 19.04 does bundle Firefox, but so did many versions prior.

---

It's also worth noting that almost every antimalware product has an option to submit unknown binaries for analysis, and almost every one of those either enables it by default or very strongly suggests that you do so during setup to the point that I'd imagine most installations that aren't managed under corporate policy are submitting samples.

Re: My application ran away and called home from Redmond

#118

Post by LeoPanthera »

hiccuphippo wrote: post #64
pletnes wrote: post #16

Could you do ssh -R and get shell on the testing machine in Redmond? Could make a nice tunnel for getting US netflix.

You could use it for crypto mining.

Assuming they only run it once, in one sandbox, that would probably not be particularly profitable.

Re: My application ran away and called home from Redmond

#120

Post by ZiiS »

paxys wrote: post #112
AlexandrB wrote: post #2

From a copyright law perspective, this seems wild. Microsoft is downloading and running binaries from entities that may have never given Microsoft license to do so, including Microsoft's competitors. All based on a permission setting configured by an unrelated third party (the user).

> that may have never given Microsoft license to do so I'm willing to bet it is in the license agreement for Windows and Windows Defender, so you have likely allowed Microsoft to do this

Just because I have a license to run a program does not mean I have a license to sub-license it to Microsoft.
Post reply on HN