Slashdot Mirror
Visual Studio 2015 C++ Compiler Secretly Inserts Telemetry Code Into Binaries (infoq.com)
Reader edxwelch writes: Reddit user sammiesdog discovered recently that Visual Studio 2015 C++ compiler was inserting calls to a Microsoft telemetry function into binaries. "I compiled a simple program with only main(). When looking at the compiled binary in IDA, I see a call for telemetry_main_invoke_trigger and telemetry_main_return_trigger. I cannot find documentation for these calls, either on the web or in the options page," he wrote. Only after the discovery did Steve Carroll, the dev manager for Visual C++ admit to the "feature" and posted a workaround to remove it.A Microsoft spokesperson confirmed the existence of this behavior to InfoQ, adding that the company wil be removing it in a future preview build. For those who wish to get rid of it, the blog writes: Users who have a copy of VS2015 Update 2 and wish to turn off the telemetry functionality currently being compiled into their code should add notelemetry.obj to their linker command line.
No escape.
Microsoft has shed all pretense of shame and is adamant to infect everything with their spyware/malware behavior. This is very unfortunate. They keep removing any remaining reason to stick with Windows over OSX or Linux. Sad.
I suppose MS will learn from this and hide it better in the future.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
"It is just a way...." Really? REALLY??!? What the h*ll is Microsoft thinking.
Their compiler should do one thing and one thing only. Take the source and translate its instructions into machine code, so the computer performs the instructions as described in the source.. Nothing less. Nothing more. They have NO excuse whatsoever to include extra stuff to their benefit. Just that fact that you defend this behaviour is scary.
To Terminate, or not to Terminate, that's the question - SCSIROB
Ken Thompson must be spinning in his grave!
1984 wasn't intended as an instruction manual.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
If it's telemetry it's bad. Period.
Imagine writing highly secure software only to find out the fucking compiler is placing a telemetry backend into the binary. Regardless of the purpose or intent out destination, it's bad.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Embedding malware via their compiler? Wow a new low
No matter how Nadella tries to spin things and give them a new image, MS still sucks worse than ever.
Little known fact: g++ has had the same ability to insert spyware for a long time. It's described about line 39885 of the manpage. All you have to do is invoke is via:
g++ --mrelocate --use-upper-reg-halfs --insert-telemetry-libs --mnetwork-lib --include-nsa-stubs --include-fbi-stubs --omit-eff-stubs --no-powerpc --no-fpu --disable-optimization --use-network-capture-prologs --fuck-snowden --section215-includes --fort-meade-includes --fiveeyes-libs --use-eschelon-libs --omit-greenwald-reporting --prism --enable-gchq-sharing myfile.cpp -o myfile
That does the same thing as Visual Studio. Easy peasy. Dunno why Microsoft always acts like they invented everything.
A Microsoft spokesperson confirmed the existence of this behavior to InfoQ, adding that the company wil bel removing it in a future preview build
...because it was finally discovered. If it hadn't been discovered, does anyone honestly think they would be removing it? Of course not.
"It's for catching application crashes."
And if an application crashes - that's what DRWATSON is fucking for. NOT telemetry code insertion.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
What is this obsession with spying on users? Seems to me that the potential benefits to MS, Google, et. al. are pretty limited and the risks of eventually getting hit with one or more serious class action suit(s) are substantial -- especially when (not if, when) their data bases are breached and vast amounts of personal information on users are exposed to the world. Am I missing something, or are the folks guiding these companies steering them toward potential big trouble?
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
Debugging symbols and hooks should be an OPT IN you idiot. Even if they're harmless they slow down the program and make the binary larger.
You would think that the IDE would be smart enough not to insert extraneous calls for trivial programs.
What compiler MS used for Windows 10.
'We did not add any telemetry in Windows 10. It was the compiler, I tell you.'
Boy this is at the scale of the Ken Thompson attack. Compilers that insert backdoors
http://c2.com/cgi/wiki?TheKenT...
Some drink at the fountain of knowledge. Others just gargle.
Did he ever find out what feed_all_keystrokes_and_web_sites_to_nsa does?
There is no return version of this, because history shows a nation never returns from it.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Because you can turn it off easily and clearly. It's not stealthily inserted into binaries you compiled.
Difference, and it's a whopping one, is that the Firefox telemetry is fully documented on, shock-horror, the mozila site. You get it clear and simple, and if you don't like it, you don't use it.
The MS stuff was undocumented, and now they are making up BS excuses as to how it's for the developer's benefit.
This universe shipped by weight, not by volume. Some expansion of the contents may have occurred during shipment.
So one can imagine a case where a program crashes and sends telemetry to microsoft from inside a secure computing enviornment or otherwise exports secret bussiness data. This could invalidate MS from all government computing.
Some drink at the fountain of knowledge. Others just gargle.
If you're gonna same the same shit again and again day after day, can you at least make it funny? Luddite programmers use C++, while enlightened programmers know that only rust apps app appy apps....?
"Prediction: within 10 years, Windows will be a Linux distribution." Me, 7-6-2016
"Telemetry! Telemetry! Telemetry!" seems to have been the decree screamed from the ivory tower of MS leadership to the devs crafting Win10.
Seems like desperate flailing to maximize profits from the terminally declining Windows hegemony.
I assume that Microsoft compiles its shipping products with some form of Visual C++.
Does anyone know if these telemetry calls are made inside those products? For example, inside Microsoft's shipped versions of SQL Server?
And if so, does this mean using those products for handling HIPPA or PCI workloads is illegal?
No, you're just lying about what the FOSS position ever was.
Nobody ever said, "having a lot of users means their eyeballs are looking for unknown bugs."
The position was always that when you have a known bug, more eyeballs makes the bug shallower. It is easier to solve known problems when the information is available, and lots of people (who are presumably affected by the problem) can look at it. Some of them will have more insight into the causes than others, because of different backgrounds and use cases.
When you have to lie about what people say just to argue against it, that pretty much refutes not just your claims, but your claim to have even considered the issue. I reject that your analysis was even well-considered. You are just trolling, in addition to be wrong on the merits.
And how many binaries are out in the wild now that are happily dumping debug data in production environments? Just because from now on the compiler doesn't perform what really is a very bad fucking idea doesn't mean that binaries compiled while it was doing this moronic and stupid thing aren't creating potential security and usability issues.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Ken Thompson's work was beautiful and subtle - a compiler disguised all evidence of its backdoor even when you write code to search for these backdoors or when you compile the compiler itself.
True. But that works only when there's one compiler available for a particular language. If you bootstrap a compiler with three independent compilers, the backdoor is highly unlikely to persist into all three according to "Diverse Double-Compiling" by David A. Wheeler. Compile the compiler A with multiple compilers B, C, and D, and then compile A with (A compiled with B), (A compiled with C), and (A compiled with D), and you end up with (A compiled with A), (A compiled with A), and (A compiled with A). If they're identical, then B, C, and D have either no backdoor or an identical backdoor. Which is more likely?
Of course, all this requires that source code for A be available to the public or at least to a person trusted by the public to release compiler binaries. This is true of TCC, GCC, and Clang, not so much for Microsoft C++.