Slashdot Mirror
wustat/wutrack.windows.com - What are they Used For?
An Anonymous Coward asks: "On Windows XP today when i ran 'netstat', I noticed an http connection to wustat.windows.com. Several minutes later when i tried again I had an http connection to wutrack.windows.com. A search on google yields few results. Since windows.com is registered to microsoft, it makes me curious to know what wustat and wutrack stand for and what their purpose is. Is it Windows Usage Statistics/Tracking?" Has anyone else seen this on their XP systems?
Maybe it stands for Windows Update, were you running that at the time?
They use that to track how many Wu Tang MP3s you've pirated.
But seriously folks, that's to track updates for Windows Update. Basically it keeps a line of communication open so that if there is an update on the windows.com website, you will be notified ASAP.
I have been pwned because my
Slashdot it!
and if we're lucky, someone will pop around to see what happened to their server that we can tie up and grill mercilessly
This is all part of Microsoft's plans for world domination. Observe:
Step 1: Use Windows XP to gather information on and track its users.
Step 2: Annex the Fatherland.
Step 3: In a twist of brutal irony, step three is a hostile takeover of Apple.
Step 4: There is no Step 4.
Happy Microserfing!
vi ~/.emacs
Perhaps it's automatic updates checking the site?
...and that's all there is to it.
I'd guesss "WU" is more likely "Windows Update" than "Windows Usage"..
- Steve
Would be that it is the Windows Update system. If you check the wrong box somewhere it will automatically check for new updates all teh time and tell you to download them. I'd bet that turning that feature off would remove that connection. After all, why would you want to be connected to Microsoft any more than you have to?
and grill him mercilessly... he's probably form wustat.windows.com.
Hurry now! Don't dwadle! Don't let him get away!
Unfortunately, I get a 403 Forbidden when trying to access that site... not even an authentication dialog, it's just denied. Someone should reverse engineer the authentication protocol so that we can REALLY Slashdot it (I would assume that valid traffic consumes more bandwidth than just sending a 403 page...???).
Just curious -- there are radio buttons under the Windows Update setting that let you choose from "whenver you feel like it, oh mighty XP" or "not on your life; I update myself". If you have it set to check it automatically own its own, it could very well do it on many of your random connections to the 'net, several times a day.
If you disable it, does this still happen?
In fact, is this reproducible enough that it happens whenver you run netstat?
Making on topic jokes are never out of fashion
Has any one w/ XP snooped the software update?
-- these are only opinions and they might not be mine.
Microsoft deserves serious criticism:
Windows XP Shows the Direction Microsoft is Going.
A rather minimalist first post. I am disappointed. Please try harder next time.
Just shut the hell up, J'Raxis. And get a decent haircut.
Oh you silly goddamned know-it-all smart kids always gotta pipe up and correct people. As if it's your duty to correct the ignorant. If you would've a.)gone to the page and b.)actually read the parent post you would realize that the page says:
...and his post said...
HTTP Error 403 - Forbidden
"Unfortunately, I get a 403 Forbidden when trying to access that site... not even an authentication dialog, it's just denied."
401 is, of course, authorization required which he explicitly said the page did not ask for. Tool. Try taking some of your own advice next time and maybe you won't look like the ignorant one. Geez.
Edit the C:\WINNT\System32\drivers\etc\hosts file so that the line reads thusly...
... and then see what breaks.. or doesn't.
127.0.0.1 localhost wutrack.windows.com wustat.windows.com
Ouch! The truth hurts!
To turn off automatic updates for your computer:
Click Start, click Control Panel, and then double-click System.
Click the Automatic Updates tab, and then click Turn off automatic updating. I want to update my computer manually.
Neck_of_the_Woods
#/usr/local/surf/glassy/overhead
Do you think that if this was something dodgey going on it would show up in WinXP's netstat command?
I don't think so.
Look again:
- Someone should reverse engineer the authentication protocol so that we can REALLY Slashdot it
..
Notice the words "authentication protocol". I'm sure a moron such as yourself can still grasp the link between "authorization protocol" and "[401] authorization required".The very fact that it was 403 and not 401 showed that the fool knew not of which he spake. You dumbasses!
Maybe WindowsXP verifies that the update has been digitally signed by Microsoft before installing it.
I can't believe I'm going to carry on with this (especially considering how swift you were to prove that you aren't willing to converse, but only to play 'I'm right, everyone else is wrong'), but I've got nothing better to do. Here's a quick rundown of the English language:
Words have meanings. Sometimes two words that look similar do not mean the same thing. Here's a very good example.
Authenticate: To prove genuine (in this case, to prove that you are allowed/able to be on wutemp.windows.com) An example would be that if it required you to be in a certain IP range to access that webpage or be of a certain type of protocol/on a certain port (i.e. smtp, IRC, etc.), and you were not, it would not authenticate you and give you a 403 error.
Authorize: Granting of authority (in this case, giving yourself access to wutemp.windows.com via a password (which we've already established it doesn't, so shut the hell up about that)). An example would be an auth challenge when entering the page or providing one in the address bar. If you gave the wrong un/pw combo or nothing at all, you would get a 401 error.
Authentication can be passive, authorization can not. So, as you pointed out, he in fact said that we should reverse engineer the authentication protocol which would in fact be accurate, operating on the assumption that this particular address provides backdoor access to Windows Update as many are suggesting. So, in conclusion, shut up. You're in over your head.
You must have a lot of time on your hands, if you went to the trouble of making that nonsense up. It is quite obvious that you are not familiar with what is known as a 'dictionary', otherwise you would not have spouted such drivel.
I can only assume that you are trolling, and thus I will not bite, as the ridiculousness of your comments is self-evident.
I stand by what I stated before, in the full arrogant knowledge that it is entirely correct. Please re-read it until you understand that it is you who is 'over your head', and get yourself a clue.
Jeez. You people truly are moronic.
Your insults mean nothing to me, 'troll'.
My only concern is for your mother, in that our intercourse three decades ago produced such a vile sub-human as yourself. She must be so ashamed.
Put down that cheese-ridden Apple Mac, get out of the basement and live a little, will you?
Jeez, what a loser.
I might, but then I'd get no response.
When I read this story on the front page, this is what caught my eye...
microsoft blah blah..
6 of 66 comments
I would imagine since Windows Update is always running (At least by default) and checks for updates occasionally, that's what you're seeing.
Just go into your "System" settings in the control panel, and then to the "Automatic Updates" tab and uncheck the box (Or change the settings to whatever suits your preferences)
This hardly seems like an interesting Ask Slashdot. For the first time in my years as a reader, this story smells a bit like aluminum foil on the head type knee-jerk paranoia.
I'm a goddamn SEXY loser! :-)
You cannot bring a common language dictionary into a discusion based upon technical jargon. Authentication and Authorization have very distinct, and _different_ meanings, in the dialect of english used for discussions in the world of software security. The meanings do not vary, but are constant in just about all the literature in the security field.
I suggest you read some of it.
-- Crutcher --
#include <disclaimer.h>
route it to a proper machine and log what comes out
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
Got anything else to say?
Anyone looked recenty on Windows Update and what there downloading? iirc they have released a new version of Critical Update check, which checks and background downloads updates...ever thought it might be to track changes on Windows Update? To clear this up probably the best way is to sniff a connection going to these sites, ive already added these sites to my snort sniffer on my firewall...lets see what it turns up eh?
"What do you mean you have no ice? Do you expect me to drink this coffee hot?" - Random Customer, Clerks
Every time I connect to Slashdot, and I check I see a connection from "images.slashdot.org"? Why are slashdot trying to hack my computer? What could they possibly be doing? I think we should publicize this on as many web sites as we can as soon as possible.
It does, however the program itself does the check, which makes it nearly pointless. Essentially, this guarantees that the file hasn't been trivially tampered with, but not that it hasn't been replaced altogether.
I stand behind everything I said. I did a scan of my article with a search program and found that I said nothing about QuickEdit. This was a mistake, there is a bug in QuickEdit that I forgot to mention. I have corrected the mistake, and updated the web page; Windows XP is buggier than I had said.
Perhaps you confused QuickEdit with Fast Paste mode. I had discussed fast paste mode:
"The fast paste mode that is in Windows 98 is gone in Windows XP. Microsoft employees say there is no plan to fix this."
This issue was confirmed in writing by a Microsoft employee, speaking officially.
START.EXE operates exactly as I said.
Perhaps you were just acting out your anger.
Exactly what are you going to replace the file with? If you replace it with some other file, it won't be signed.
Sorry, I agree with the other guy. You took way too much time to make yourself look like an ass.
This is probably just the windows update, and can be disabled.
If you are a paranoid individual, then try installing a firewall app... something like "AT Guard". Besides stopping windows from wasting your badwidth, it will also protect you from instruders, worms etc...