Visual Studio 2015 C++ Compiler Secretly Inserts Telemetry Code Into Binaries (infoq.com)

Reader edxwelch writes: Reddit user sammiesdog discovered recently that Visual Studio 2015 C++ compiler was inserting calls to a Microsoft telemetry function into binaries. "I compiled a simple program with only main(). When looking at the compiled binary in IDA, I see a call for telemetry_main_invoke_trigger and telemetry_main_return_trigger. I cannot find documentation for these calls, either on the web or in the options page," he wrote. Only after the discovery did Steve Carroll, the dev manager for Visual C++ admit to the "feature" and posted a workaround to remove it.A Microsoft spokesperson confirmed the existence of this behavior to InfoQ, adding that the company wil be removing it in a future preview build. For those who wish to get rid of it, the blog writes: Users who have a copy of VS2015 Update 2 and wish to turn off the telemetry functionality currently being compiled into their code should add notelemetry.obj to their linker command line.

Comments

MS Spyware

[allo]

No escape.

Re:MS Spyware

[cfalcon]

> Debug performance telemetry? Yep. Clearly spyware.

While Microsoft offers a profiler, this is NOT that. I'm puzzled how someone could could confuse the two. Profilers / debuggers / all manner of code analysis tools are all hooks that allow the developer (not Microsoft) to analyze how something works in development. They are usually stripped out of release builds, but, more importantly, are only ever present at the convenience of the developer.

The mysterious telemetry calls are not even claimed by MICROSOFT to be debugging or profile hooks. "The event data can only be interpreted if a customer gives us symbol information (i.e. PDBs) so this data is only applicable to customers that are actively seeking help from us and are willing to share these PDBs as part of their investigation. ". This means that the hooks make data available to a telemetry subsystem, on production code, which Microsoft can usefully access in some fashion- while to make use of this in any way would require a developer to know about it (it is not publicized), contact the "right" part of Microsoft (which no one knows), and ask to use the data Microsoft has been collecting about their shipped code, using an undocumented system to gather unknown data.

If this was in any way benign:
1- It would have been documented: you'd know what it gathers
2- Microsoft would offer this data to the developer in some fashion, including what it is
3- It would have been opt-in: you'd have to link in the telemetry, instead of linking it OUT.
4- It wouldn't be present in secret on ALL code Microsoft compiles. This affects run times in some fashion, even if you ignore the massively spooky privacy issues.
5- The data wouldn't be available for Microsoft's use, but not the developer: what right do they have to gather data on your code as you build it, much less on your code as it runs for your customer?

This whole thing gets crazier. That Microsoft is putting hooks into as much code as they can may actually be illegal, or it may be buried in some document- all I know is, this is just what has been FOUND so far. Every couple weeks, someone finds more stuff. All of it is found by acting on some highly technical layer Microsoft hasn't been able to obscure yet. How much more is there? We really have no way to know.

Re:MS Spyware

[pagebt]

It is documented. When this whole windows 10 is spyware thing started, I started searching. The telemetry is exactly that. how many times an application is run. For how long? did it exit clean or with errors? etc... Microsoft has been giving speeches @ Dev conferences for a while now shopping this new feature set. Not a secret. it it a service called "Application Insights" https://www.visualstudio.com/e... Nothing secret, an apparently an advertised service. Another way to make money for Microsoft, not spyware for nefarious purposes.

Apparently...

[ChodaBoyUSA]

Microsoft has shed all pretense of shame and is adamant to infect everything with their spyware/malware behavior. This is very unfortunate. They keep removing any remaining reason to stick with Windows over OSX or Linux. Sad.

Re:Apparently...

[geoskd]

Or I could freely go to linux and ditch 99% of my software.

Fortunately, that is simply not true. The vast majority of software will run under Linux in one way or another. The only major exceptions are games, and even many of those will work.

The reality that Microsoft has been FUDing around for years is that Linux really is a viable alternative for almost every windows use case.

Many people have a single application that will not run under windows. Something work related or a specific game. I have two such applications, and I am constantly reminding the developers of those applications that it is a race to see which happens first: they get a Linux version working or one of their competitors gets a Linux version working. I am a relatively small fry, but I am not the only one asking about it. In the mean time, I have two PCs. I have a Linux machine that does my day to day heavy lifting, and I have the windows machine that only ever turns on when I need to run one of those applications (about once or twice a month). The windows Box had automatic updates turned off and gutted the GWX, so I can never again trust it exposed to the network, which is fine because it will never again *be* exposed to the network. I added the cost of the hardware to the cost of the two software packages and that is the end of it.

It should be noted that the free ( as in freedom ) versions of things I need run just fine on a core 2 quad with 2GB of ram, whereas the windows machine had to be an i5 or better with 4GB just to keep from pissing me off.

Most everything from a users perspective in Ubuntu is pretty simple. Although I would call myself a power user, I rarely have to resort to that level to get things done, and even then, its mostly related to experimentation and learning. For just about everything I have tried to do, a google search for "apt-get xxx" finds exactly what I want.

The user interface in Ubuntu is "good enough for grandma". With the advent of smartphones and tablets, and the radical differences between how windows works and tablets work, people have been primed to be able to learn some simple differences in UI pretty quickly. Almost everyone I have exposed to Ubuntu has taken to it easily enough. The one exception was completely computer illiterate before we started, and it took him a little longer than otherwise, because computers and tablets / etc... were all new to him.

Next time it will be hidden better

[flyingfsck]

I suppose MS will learn from this and hide it better in the future.

Re:FUD - no, TREASON

[scsirob]

"It is just a way...." Really? REALLY??!? What the h*ll is Microsoft thinking.

Their compiler should do one thing and one thing only. Take the source and translate its instructions into machine code, so the computer performs the instructions as described in the source.. Nothing less. Nothing more. They have NO excuse whatsoever to include extra stuff to their benefit. Just that fact that you defend this behaviour is scary.

Re:FUD

[MightyMartian]

If it's telemetry it's bad. Period.

Imagine writing highly secure software only to find out the fucking compiler is placing a telemetry backend into the binary. Regardless of the purpose or intent out destination, it's bad.

MS still the shitheel of the tech world

[bazmail]

Embedding malware via their compiler? Wow a new low

No matter how Nadella tries to spin things and give them a new image, MS still sucks worse than ever.

Re:MS still the shitheel of the tech world

[Anonymous Coward]

Embedding malware via their compiler? Wow a new low

No matter how Nadella tries to spin things and give them a new image, MS still sucks worse than ever.

The moment I'll believe that Microsoft has created a product that doesn't suck is when they start selling vacuum cleaners.

Re:HOLY FREAKIN' FRIP-FROP!

[vadim_t]

He's not dead yet.

g++ adds same feature!

[Anonymous Coward]

Little known fact: g++ has had the same ability to insert spyware for a long time. It's described about line 39885 of the manpage. All you have to do is invoke is via:

g++ --mrelocate --use-upper-reg-halfs --insert-telemetry-libs --mnetwork-lib --include-nsa-stubs --include-fbi-stubs --omit-eff-stubs --no-powerpc --no-fpu --disable-optimization --use-network-capture-prologs --fuck-snowden --section215-includes --fort-meade-includes --fiveeyes-libs --use-eschelon-libs --omit-greenwald-reporting --prism --enable-gchq-sharing myfile.cpp -o myfile

That does the same thing as Visual Studio. Easy peasy. Dunno why Microsoft always acts like they invented everything.

Bingo

[Anonymous Coward]

A Microsoft spokesperson confirmed the existence of this behavior to InfoQ, adding that the company wil bel removing it in a future preview build

...because it was finally discovered. If it hadn't been discovered, does anyone honestly think they would be removing it? Of course not.

Now we know

[Alumoi]

What compiler MS used for Windows 10.
'We did not add any telemetry in Windows 10. It was the compiler, I tell you.'

Ken Thompson Attack

[goombah99]

Boy this is at the scale of the Ken Thompson attack. Compilers that insert backdoors

http://c2.com/cgi/wiki?TheKenT...

Re:Ken Thompson Attack

[ljw1004]

Boy this is at the scale of the Ken Thompson attack. Compilers that insert backdoors

http://c2.com/cgi/wiki?TheKenT...

No it's not. Ken Thompson's work was beautiful and subtle - a compiler disguised all evidence of its backdoor even when you write code to search for these backdoors or when you compile the compiler itself.

If Ken Thompson had gone on stage to say "hay guys I made a compiler which inserts a call at the entrypoint of your program" -- well, that's trivial.

Re:HOLY FREAKIN' FRIP-FROP!

[geoskd]

He's not dead yet.

True, but if this doesn't give him a massive stroke, I don't know what will.

Re:Where's the outrage over Firefox's telemetry?

[Aruta]

Difference, and it's a whopping one, is that the Firefox telemetry is fully documented on, shock-horror, the mozila site. You get it clear and simple, and if you don't like it, you don't use it.

The MS stuff was undocumented, and now they are making up BS excuses as to how it's for the developer's benefit.

Classified or secure operations invalidated

[goombah99]

So one can imagine a case where a program crashes and sends telemetry to microsoft from inside a secure computing enviornment or otherwise exports secret bussiness data. This could invalidate MS from all government computing.