Slashdot Mirror
Even With Telemetry Disabled, Windows 10 Talks To Dozens of Microsoft Servers (voat.co)
An esteemed reader writes: Curious about the various telemetry and personal information being collected by Windows 10, one user installed Windows 10 Enterprise and disabled all of the telemetry and reporting options. Then he configured his router to log all the connections that happened anyway. Even after opting out wherever possible, his firewall captured Windows making around 4,000 connection attempts to 93 different IP addresses during an 8 hour period, with most of those IPs controlled by Microsoft. Even the enterprise version of Windows 10 is checking in with Redmond when you tell it not to — and it's doing so frequently.
Is anybody surprised by this?
Microsoft has pretty clearly telegraphed they don't give a shit about what the people who own the machines want, and they're going to do whatever the fuck they want.
That Microsoft is doing this is surprising in no way to me.
Microsoft simply can't be trusted to not just do what they please here.
Lost at C:>. Found at C.
For the enterprise version we really need it predictable so it can be managed. Even if talking to MS is harmless and overall a good thing, it means you are having your computer talk to something you may not want too.
At work we are still on Windows 7 with little chance going over to 10 because of stuff like this. (I would prefer Linux, but our management is stuck in the 1990s)
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
The Microsoft shills normally go down one of these paths:
1)- "You can turn it off if you pay for it"
(this ignores that you can't really buy enterprise and is malicious behavior in general, ignores that you can't turn stuff off in pro- but now it ALSO ignores that EVEN ENTERPRISE HAS NO TOGGLES!)
So it's BIG news because it means that even Enterprise is tucked into their botnet.
2)- "But google does this on their phone OS"
(this ignores that a phone OS isn't the same as a desktop OS, ignores that phones are pretty terrible at privacy and that this is due to several vendor lock-ins that don't have good outs, ignores that there's phones that DON'T do this, and is just generally so full of false equivalences that it's ludicrous on the face of it)
3)- "I have nothing to hide / you're old if you care"
(this is something a marketer would say, not a rational person- no one actually wants to buy or use spy tech)
4)- 'You can turn it off"
(this article is the latest showing that NO YOU CANNOT- someone will post one of the scripts or spybots or whatever that purports to disable it, and might even, but if you need some crazy tech solution to get your OS to MAYBE not spy on you ludicrously, it's a terrible OS)
So finding it in Enterprise destroys (1) even further, and is interesting for (4) as well.
I'm sure it won't stop them shills shilling though.
Has anyone analyzed the data being sent? Or is this a big assumption? Could this be other apps that were installed by default 'calling home'? I'm not doubting that MS might do this, but in all fairness, this seems example seems like unsubstantial speculation....and a pretty weak 'test to boot. Remember that high school class who put sprouts by a wifi router and found the 'closer plants died'? I did the same thing for fun, and found the closer sprouts actually grew faster and more abundantly, probably since they were warmer. Shouldn't we suspend judgement until further tests and confirmation is made...?
If you block connections, what would have normally been one successful connection can become many connection attempts. It's also possible that retries for the same thing would use different IP addresses. Someone needs to try an experiment like this without the blocking. A log of the data being transmitted would also be interesting. A lot of that is probably encrypted, but https monitoring via wildcard certificate MITM could capture some in decrypted form.
One problem with the approach used is that the firewall is configured to drop all connections. This is not a realistic picture.
An analysis of the content would also be interesting because even with telemetry disabled, there are plenty of reason for connecting to Microsoft servers such as software updates. Most of them are port 80 and port 443. Port 80 is normal http traffic and is easy to analyse, port 443 is encrypted so it is a bit harder but if you can add your own certificate authority to the windows install, you can try doing man-in-the-middle. There is also UDP port 3544 which is related to IPv4 - IPv6 transition, which in itself is probably harmless but may hide other connection attempts (that's one of the reasons why you won't get a realistic picture by dropping everything).
The only thing this experiment tells us is that Windows communicates with MS servers even with telemetry disabled. It smells but without further analysis, it is not very useful information.
> If MS was collecting information like that wouldn't they be in equally as much trouble?
NO! Read your Windows 10 EULA. It points to the privacy agreement, and that says that you give legal permission for all your keystrokes to be sent to Microsoft, along with pretty much everything else. Microsoft believes they are covered legally- the EULA grants vastly more invasive stuff than the software provides... so far...
LOL Except Windows 10 doesn't actually use the hosts file for this. They're hard-coded IP addresses and you can't block them with the hosts file. You can add 'em all you want, it won't help. Folks have shown video of this. They've added the domains to the hosts file and then used Wireshark (that's what the interface looked like, as I recall) and there's still outbound communication with the very same IP addresses at the very same level. Nope, hosts isn't gonna cut it.
"So long and thanks for all the fish."