Slashdot Mirror
Visual Studio 2015 C++ Compiler Secretly Inserts Telemetry Code Into Binaries (infoq.com)
Reader edxwelch writes: Reddit user sammiesdog discovered recently that Visual Studio 2015 C++ compiler was inserting calls to a Microsoft telemetry function into binaries. "I compiled a simple program with only main(). When looking at the compiled binary in IDA, I see a call for telemetry_main_invoke_trigger and telemetry_main_return_trigger. I cannot find documentation for these calls, either on the web or in the options page," he wrote. Only after the discovery did Steve Carroll, the dev manager for Visual C++ admit to the "feature" and posted a workaround to remove it.A Microsoft spokesperson confirmed the existence of this behavior to InfoQ, adding that the company wil be removing it in a future preview build. For those who wish to get rid of it, the blog writes: Users who have a copy of VS2015 Update 2 and wish to turn off the telemetry functionality currently being compiled into their code should add notelemetry.obj to their linker command line.
No escape.
wow wtf Msft. Just when they were getting good about .NET and open source and their stuff was getting good as a product. Seriously stupid and not a good business decision. Sounds like that Carroll guy needs a new 'role' at Msft.
Microsoft has shed all pretense of shame and is adamant to infect everything with their spyware/malware behavior. This is very unfortunate. They keep removing any remaining reason to stick with Windows over OSX or Linux. Sad.
I suppose MS will learn from this and hide it better in the future.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
"It is just a way...." Really? REALLY??!? What the h*ll is Microsoft thinking.
Their compiler should do one thing and one thing only. Take the source and translate its instructions into machine code, so the computer performs the instructions as described in the source.. Nothing less. Nothing more. They have NO excuse whatsoever to include extra stuff to their benefit. Just that fact that you defend this behaviour is scary.
To Terminate, or not to Terminate, that's the question - SCSIROB
Ken Thompson must be spinning in his grave!
1984 wasn't intended as an instruction manual.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
If it's telemetry it's bad. Period.
Imagine writing highly secure software only to find out the fucking compiler is placing a telemetry backend into the binary. Regardless of the purpose or intent out destination, it's bad.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Embedding malware via their compiler? Wow a new low
No matter how Nadella tries to spin things and give them a new image, MS still sucks worse than ever.
Little known fact: g++ has had the same ability to insert spyware for a long time. It's described about line 39885 of the manpage. All you have to do is invoke is via:
g++ --mrelocate --use-upper-reg-halfs --insert-telemetry-libs --mnetwork-lib --include-nsa-stubs --include-fbi-stubs --omit-eff-stubs --no-powerpc --no-fpu --disable-optimization --use-network-capture-prologs --fuck-snowden --section215-includes --fort-meade-includes --fiveeyes-libs --use-eschelon-libs --omit-greenwald-reporting --prism --enable-gchq-sharing myfile.cpp -o myfile
That does the same thing as Visual Studio. Easy peasy. Dunno why Microsoft always acts like they invented everything.
A Microsoft spokesperson confirmed the existence of this behavior to InfoQ, adding that the company wil bel removing it in a future preview build
...because it was finally discovered. If it hadn't been discovered, does anyone honestly think they would be removing it? Of course not.
VC++ dev manager explained that this is not the telemetry you think it is. It is just a way to gather perf statistic that have been badly named.https://www.reddit.com/r/cpp/comments/4ibauu/visual_studio_adding_telemetry_function_calls_to/d30dmvuMS does a lot of shady things, but that isn't one of those.
Hey man. I have a bridge in Brooklyn that is for sale. You need to buy it, no really, you too can own a bridge.
Hey man. I have a deed to the moon. You need to buy it, no really, you too can own the moon.
Hey man. I have pictures of your mom. You need to.... Yeah.
Even if this telemetry were perfectly innocent (likely not, if Windows 10's spyware is any indicator), the fact of the matter is that Microsoft have now compromised their own compiler using Ken Thompson's compiler attack.
When will this madness end? Is MS now just an arm for the NSA?
"It's for catching application crashes."
And if an application crashes - that's what DRWATSON is fucking for. NOT telemetry code insertion.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
When you consider that MS backdoored OS, compromised compiler is, comparatively, much lesser sin.
What is this obsession with spying on users? Seems to me that the potential benefits to MS, Google, et. al. are pretty limited and the risks of eventually getting hit with one or more serious class action suit(s) are substantial -- especially when (not if, when) their data bases are breached and vast amounts of personal information on users are exposed to the world. Am I missing something, or are the folks guiding these companies steering them toward potential big trouble?
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
Debugging symbols and hooks should be an OPT IN you idiot. Even if they're harmless they slow down the program and make the binary larger.
You would think that the IDE would be smart enough not to insert extraneous calls for trivial programs.
What compiler MS used for Windows 10.
'We did not add any telemetry in Windows 10. It was the compiler, I tell you.'
Boy this is at the scale of the Ken Thompson attack. Compilers that insert backdoors
http://c2.com/cgi/wiki?TheKenT...
Some drink at the fountain of knowledge. Others just gargle.
Did he ever find out what feed_all_keystrokes_and_web_sites_to_nsa does?
There is no return version of this, because history shows a nation never returns from it.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Because you can turn it off easily and clearly. It's not stealthily inserted into binaries you compiled.
Difference, and it's a whopping one, is that the Firefox telemetry is fully documented on, shock-horror, the mozila site. You get it clear and simple, and if you don't like it, you don't use it.
The MS stuff was undocumented, and now they are making up BS excuses as to how it's for the developer's benefit.
This universe shipped by weight, not by volume. Some expansion of the contents may have occurred during shipment.
The naughty bit still needs twiddling.
Either one of two things happens:
1. Nothing bad happens - Company makes lots of money - C*O makes big bonus/stock options/whatever - Profit!!!
2. Bad things happen - Company is sued/destroyed/bankrupt - C*O gets fired - Golden parachute kicks in with lots of money - Profit!!!
Sometimes the "writing on the wall" is blood spatter...
Am I missing something, or are the folks guiding these companies steering them toward potential big trouble?
Surely "big trouble" is reserved for the guys who don't cooperate with NSA and friends. All of this spying is probably of some marketing value to Microsoft, but I'm thinking the real benefit is a cozy arrangement with big brother.
"If there was a gay Afro-Puertorican Linux distribution, I'd give it a try" ~lucm
It's so heartwarming to see the long-theorized 'backdoor the compiler' attack finally gaining commercial acceptance and enterprise support!
Steve Carroll, the dev manager for the Visual Studio diagnostics team, responded directly to these concerns on Reddit. The rest of that whole thread is pretty informative as well.
Visual Studio adding telemetry function calls to binary?
So one can imagine a case where a program crashes and sends telemetry to microsoft from inside a secure computing enviornment or otherwise exports secret bussiness data. This could invalidate MS from all government computing.
Some drink at the fountain of knowledge. Others just gargle.
If you're gonna same the same shit again and again day after day, can you at least make it funny? Luddite programmers use C++, while enlightened programmers know that only rust apps app appy apps....?
"Prediction: within 10 years, Windows will be a Linux distribution." Me, 7-6-2016
And this shows you why access to the source code is not enough to audit software.
Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
"Telemetry! Telemetry! Telemetry!" seems to have been the decree screamed from the ivory tower of MS leadership to the devs crafting Win10.
Seems like desperate flailing to maximize profits from the terminally declining Windows hegemony.
Excuse me? What? Why do I want MS collecting ANY statistics on MY program? Who authorized that? I don't care WHAT the MS shill is claiming...and 'poorly named my ass'...they got caught & now scrape up an excuse they think you'll buy. O, and let's be clear here, these are entirely undocumented calls, if they wanted you to know about them & make a conscious decision to use them they'd document them & require a flag to compile them (e.g. 'opt-in') NOT a flag/command to srtip them out (opt-out).
If this isn't enough reason to drop anything MS related then there is no hope for you.
And that is exactly what it does. Of course, your code probably also calls - and links in - a lot of THEIR code and THEIR code adds the extra bits. Which means you really didn't do YOUR job and think about the implications of what external code you added to yours before you released it to your customers.
Browsing at +1 - no ACs, I ignore their posts. So refreshing!
Oblivious to an undocumented telemetry function? Or oblivious to the fact that using Microsoft development tools means your sending out vulnerable binaries that send potentially unknown data to an external server on the Internet?
The world's burning. Moped Jesus spotted on I50. Details at 11.
A few years back, I was in a car wreck. Therefore, my house tried to kill me.
That's what you get for driving forward when you meant to drive out of the garage in reverse. Being drunk and beating your spouse doesn't help either. :P
There needs to be a law, if one can not be found that already can already cover this, but "faithful" generation of object code from source code is, by definition, what a compiler does. There MUST be *some* product law that covers intentionally inserting functionality without the user's knowledge.
To be honest, if they'd named them "_main_support" or "_internal", nobody would have been any the wiser.
Lucky that they left the function name, with obvious telemetry marker, in the data areas of the executable, or you'd not know or suspect what was happening without actually disassembling the thing.
Hell, surely an optimised/stripped executable wouldn't show them anyway, so you have really no way of knowing whether someone's put these into major parts of Windows, drivers or applications.
As always, without the source, you really have NO idea what these things are doing. And, hell, even an old 1MByte DOS game with plain interrupt calls and obvious code paths can take YEARS to properly disassemble and work out what it's actually doing.
Thank %DEITY% for the hacking community who I'm sure will get to the bottom of their insane bullshit with disassemblers and packet sniffers.
Unfortunately, that's not been true ever since the first version of ANSI C was released, the most common word in the spec being "undefined."
(TBH, this sounds like a storm in a teacup. So some code that, despite the name, turned out to be debugging/profiling crap got into the compiler? So what? Other than minor performance impacts that obviously are so minor nobody noticed, I'm failing to see how anyone was harmed by this.)
You are not alone. This is not normal. None of this is normal.
Is Visual Studio even a compiler? To me it sounds like an IDE. Didn't the complier used to be called "Microsoft C++"?
Of course, it's possible that the compiler is the one inserting the code, but it could also be the IDE applying a binary patch.
This is just nitpickery, as I don't use either, but the story seems to need more precision.
I think we've pushed this "anyone can grow up to be president" thing too far.
Microsoft is clearly planning to move to a future in which they, with total control of the desktop, have a better ability to spy on,and advertise to, users than companies like Google who only have access to the browser activity of users. They have seen Google become far more powerful (even becoming embedded into the White House and several other national governments) and wealthy while making and selling NOTHING as Microsoft was actually making and selling both hardware and software. They seem to have decided that the future will be a free OS with free desktop and free browser that is ubiquitous and that spies maximally and advertises mercilessly, and makes Google and Facebook etc obsolete second class citizens in a commercial sense (because THOSE companies will have far less access to user info than the company that controls the computer).
This explains why they are forcing everybody to move to Windows 10 with who-knows-what built-in spying AND who-knows-what built-in ability to quietly install more remote controls, spying and updating later. Why else would they have done so many "free" upgrades from relatively recent OS versions when in the past they changed around a hundred dollars for each upgrade? Even the tawdry update from DOS 6.2 to DOS 6.22 cost users nearly a hundred dollars for no real improvement.
To achieve their aims, they need everybody to move to the newest flavor of Windows that has been rebuilt with the modern support mechanisms they are putting in place. Users with older versions of Windows that pre-date the strategy shift and lack the new remote control/monitoring/updating/telemetry/etc capabilities need to be replaced. After everybody is on Win10, any future discovery of spying in/by Windows can be apologised for as a "misunderstanding" and then be quietly and secretly replaced by a new and different back-door in a future automatic update using the new "features" buiklt into Windows 10 and newer.
This newly-discovered junk only shows that they have reached the point of even glomming onto the applications that users and other vendors build with MS tools to run within the new "Big Brother" versions of the MS "life experience". This proves that even programs like Chrome or Firefox, when built with modern Microsoft tools and run on Windows 10 and beyond are not trustworthy and not secure.
Most of now have privacy policies where we disclose what data we collect and what we do with it. If that disclosure is defective, you're in legal jeopardy for failure to disclose. Thanks for the poison pill, MS!
And, haven't they considered that the whole Apple/FBI thing might have implications for them and their developers, just maybe? If not legal issues, then PR at the very least? Stunning!
I assume that Microsoft compiles its shipping products with some form of Visual C++.
Does anyone know if these telemetry calls are made inside those products? For example, inside Microsoft's shipped versions of SQL Server?
And if so, does this mean using those products for handling HIPPA or PCI workloads is illegal?
Actually, there *is* a solution to the problem as stated, though it's too much work to bother with when the better answer is to just use a different compiler. But you could build something to go through your binaries and dummy out all links to those libraries.
OTOH, when they control the OS, a better solution is to go elsewhere. If you MUST use MSWind, run an old version in a virtual environment with either no net access, or very tightly filtered. And to move rapidly away from any applications that depend on it.
P.S.: How long can FreeBSD be trusted now the MS is submitting code to them? And there are definitely problems with Linux security.
HINT: If you want real security, stay off the internet. Nothing else really works. If you don't need quite that much, perhaps a different one of the BSDs would suffice. But for most purposes Linux is safe enough, so far. (I am a bit paranoid about systemd, but nobody has shown that it's actually malicious rather than just autocratic. Example: I install a systemd based Linux in a separate partition and it renders my current partition unbootable until I go in and do a bit of hand editing of fstab, and then reinstall grub. [Once upon a time I would have just hand edited the grub files directly, but grub2 changed that!])
I think we've pushed this "anyone can grow up to be president" thing too far.
Oh, for christ almighty sake. Could you possibly be any more of a sellout?
The function could have been "windows_10_forced_install"
Yes Francis, the world has gone crazy.
That is an interesting article.
I'm with you AC... I insist that any programming language I use have multiple implementations that are fully and independently audited by sentient supercomputers who have proven their virtue in trial-by-combat with enraged swamp gorillas.aa.uao.ua3u3!#Pi derp
Just kidding! I pick the best tool for the job. If secure programming were paramount, then I'd (personally) be more successful in Rust then C++. YMMV. (BTW, good luck getting an independent audit for your proprietary compilers.)
-1, Too Many Layers Of Abstraction
What is this obsession with spying on users?
It all started with NSAKEY...
Looks like the solution is to statically link function stubbs. Which means a smart dynamic linker could very easily undo this. And if they were brazen enough to add this to the compiler in the first place they are brazen enough to "fix" the binary with a smart dynamic linker.
But then there really is no solution as the exec dispatcher and dynamic linker could always implement some form of telemetry.
The real solution is an OS vendor that is not going to pull tricks like this.
Wait! I know of one who doesn't...
They are acting as the same entity.
I don't understand how you deny this let alone not come to this conclusion yourself. The fact that two entities of comparable size that have been caught doing the same thing should be some clue. Not to mention the many ways that they are deeply in bed with each other.
Is it too much to put together for yourself?
There is no terrorism threat.
Complete surveillance has been brought into existence to control you, you are considered to be the potential "terrorist". Every single one of us is. The purpose is to ensure that the transition from human labor to robotic/computerized labor is "smooth". Meaning no one tries to stop the destruction of the vast majority of the population.
'But wait, what? You mean to say that people who have no use to society won't be supported by society?'
People who do not have work run amok, regardless of any comforts they have.
Consider that the psychology of the average person is a known system. Consider the example of the effectiveness of advertising or politics. It's easy to tell people what they want to hear, and even easier now because most of their thoughts are being directly monitored through surveillance and mined for patterns.
Basically these people could be convinced that everything that is bad for them is good, and it would be a short matter of time until they destroy themselves.
Genocide through manipulation.
But how on earth to describe this to anyone in such a way that they don't reject it immediately? Is there any hope?
Furthermore logging when executables start and close doesn't seem too useful when investigating performance problems. Carroll say's that the feature was abandoned, so perhaps that's why it seems mostly useless. However this feature is not useless if the purpose is to determine which programs the user runs and for how long. I'm suspicious enough about Windows 10 to suspect that's already happening at other levels.
Yep, looks it does: http://winaero.com/blog/how-to...
One way to find out if these functions were intentionally meant to explicitly spy on userland programs would be to check whether it is enabled for executables contained within Windows 10. If it is in Win10 exes, and telemetry_main_invoke_trigger is truly useless, I wonder whether it will be removed in the future when Windows gets rebuilt with a newer compiler.
What do you get when you cross a mountain-climber with a mosquito? Nothing! You can't cross a scaler with a vector.
No, you're just lying about what the FOSS position ever was.
Nobody ever said, "having a lot of users means their eyeballs are looking for unknown bugs."
The position was always that when you have a known bug, more eyeballs makes the bug shallower. It is easier to solve known problems when the information is available, and lots of people (who are presumably affected by the problem) can look at it. Some of them will have more insight into the causes than others, because of different backgrounds and use cases.
When you have to lie about what people say just to argue against it, that pretty much refutes not just your claims, but your claim to have even considered the issue. I reject that your analysis was even well-considered. You are just trolling, in addition to be wrong on the merits.
And even if it isn't telemetry in the sense that it is sending information to the mothership, it means it is still dumping debug code somewhere, even if it's just on your hard drive, which means that on every person running the bloody binary, it's dumping debug code to their hard drive, with the potential of security breach and, if nothing else, just making the application slower. It is always bad form to have debug code active in a production environment. Always.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Do you happen to know if any of the release notes with the early-preview code disclose the fact that the builds include this telemetry?
And how many binaries are out in the wild now that are happily dumping debug data in production environments? Just because from now on the compiler doesn't perform what really is a very bad fucking idea doesn't mean that binaries compiled while it was doing this moronic and stupid thing aren't creating potential security and usability issues.
The world's burning. Moped Jesus spotted on I50. Details at 11.
what about:
A ship shipping ship shipping shipping ships.
Time to offend someone
It is just a way to gather perf statistic...
What happens when you figure out that that is exactly what the complaint is? And that many consider it "shady?" ;)
Ken Thompson's work was beautiful and subtle - a compiler disguised all evidence of its backdoor even when you write code to search for these backdoors or when you compile the compiler itself.
True. But that works only when there's one compiler available for a particular language. If you bootstrap a compiler with three independent compilers, the backdoor is highly unlikely to persist into all three according to "Diverse Double-Compiling" by David A. Wheeler. Compile the compiler A with multiple compilers B, C, and D, and then compile A with (A compiled with B), (A compiled with C), and (A compiled with D), and you end up with (A compiled with A), (A compiled with A), and (A compiled with A). If they're identical, then B, C, and D have either no backdoor or an identical backdoor. Which is more likely?
Of course, all this requires that source code for A be available to the public or at least to a person trusted by the public to release compiler binaries. This is true of TCC, GCC, and Clang, not so much for Microsoft C++.
Imagine writing highly secure software only to find out the fucking compiler is placing a telemetry backend into the binary.
Many people are in a hard position here, because they have decades of bad-mouthing FLOSS and they're too embarrassed to want to say, yeah, this implies that people have to have access to the source to know if trust is reasoned.
Performance tuning is useless in a debug build.
There exist builds other than release and debug, such as profiling builds. These are in fact designed for performance tuning.
Even then the EULA might not be valid, it depends on which country you are in.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
And apparently some of these disgusting sociopathic creatures have mod points.
Here's a bit of advice, MS shill. Being a shill is the lowest activity there is. There are people that eat dog feces who I'd rate higher than a shill.
The world's burning. Moped Jesus spotted on I50. Details at 11.
No, you're just lying about what the FOSS position ever was.
I reject your premise on its face.
I know what my intent was, and it was NOT to DECEIVE. Now, I might (probably was) MISTAKEN about what some people's OPINION about what is meant by the "Many Eyes" effect; but that most assuredly does NOT mean I was "LYING".
And BTW, I wasn't.
https://support.apple.com/ipho...
Yeah they do not gather telemetry AT ALL.
I would say they are even worse than MS.
Care to post a link to something OTHER THAN the Top of the iPhone Support site?
How about THIS, for example? Simple, no legalese, all layed-out in one easy to read document.
Now, wanna compare that to Microsoft? Let me know when you get done chasing down all Links on that page...
Considering that the binaries provided by the Python project are generally compiled with Visual Studio, and considering that many if not most new comp sci / programmers now learn python, this is especially troubling.
It is my hope that the Python BDFL and Python Software Foundation will move away from Visual Studio for Python binaries before long ...
I write a standalone program. I include no network functionality whatsoever. Are you seriously telling me I should have to run a network sniffer against it because I don't know what it's doing on the network, and if I don't, it's somehow my own fault for not knowing what it's doing?
I wrote the fucking thing, and didn't tell it to communicate over the network. In what fucked up world should I expect it to make network connections, when I haven't programmed it to?!
"City hall" in German is "Rathaus" Kinda explains a few things......
VS2015 Update 2 introduced IDE support for Application Insights, an Azure-hosted desktop/web application performance and error analytics service. We use it at my work - it's great and super easy to get up and running and use. I assume these are just enabling methods for generic application-wide logging/telemetry-based functionality, and I'd put my money on them not sending any telemetry data by themselves. The word "telemetry" in the method names was probably a bad choice, considering how many of you it spooked.
Go away APK
The world's burning. Moped Jesus spotted on I50. Details at 11.
This nuisance can be disabled by linking "notelemetry.obj" though this shouldn't be necessary but just Microsoft things.
It's not always so clear and simple, as from within the browser itself, Firefox isn't always honest about how its features work.
My favorite example is the offline content feature checkbox that reads, "Tell me when a website asks to store data for offline use". In fact, if you enable that checkbox, the browser will only alert you if the web site wants to store an excessive amount of data in a single request. A special, separate config setting must be changed to "actually" alert you of any data stored. Even with this checkbox enabled, the browser would happily save offline data without notifying me, often with web pages storing in excess of 20MB of data. So, the browser will tell you when data it stored... unless it won't.
Documented or not, doing sneaky stuff in the background is just the norm these days.
Steps to follow:
Wait for all public and government organizations to install programs compiled with this.
1.) make malware that collects the local crash reports and data dumps.
2.) focus attention on crashing commonly used user interface libraries instead of the MS malware
3.) wait until a large number of users have installed your global crash vector.
4.) send signal to turn on crashing globally
5.) direct emails or background FTP of collected crash data through TOR or other obfuscation
6.) sift through the data of world governments at your leisure.
Go get em!
Why is now spyware called "telemetry"? THey should be held responsible...
Ever hear of Steve Barkto?
Il n'y a pas de Planet B.