Data management
Microsoft Spyware Now Being Installed On Win 7
If you’re the sort of person who isn’t entirely happy about the idea of Microsoft claiming the right to copy your personal files, photos, emails, chat logs, diary entries, medical records, etc over to their own servers to sell to whoever they want for whatever they can get for your personal data – into markets that already exist for insurance companies to deny you insurance based on algorithmic analysis of your habits or your friends habits or for financial institutions to set your interest rates based on similar criterion, or perhaps even for law enforcement to investigate you without a warrant, then OBVIOUSLY you would never, ever install Windows 10 under any circumstances.
Well, Microsoft seems to have fully jumped on the Google/Facebook gravy train and is now completely invested in stealing your data and selling it to the highest bidder (Apple has been exfiltrating your data for a long time, but so far for internal use). I’ve become more suspect of Microsoft’s updates since they made the Windows 10 advertisement an important (not optional) update (important for what? their bottom line, obviously). Turns out that the latest updates to Windows 7 are pushing Microsoft’s new business model of stealing your data for profit to Windows 7 and 8.
Staying safe is going to require ever more vigilance. It may be possible to block windows components from reaching out to microsoft’s servers at the personal firewall level and certainly it can be done at the corporate firewall level (and should be), but blocking Microsoft is a somewhat complex issue. You can’t run Windows safely without installing security patches because the underlying OS is so completely insecure that new, critical, exploitable flaws are discovered every single week. If you don’t constantly patch these security failures, you will be hacked by people other than microsoft. If you install the wrong microsoft patch, you will be hacked by microsoft. Debian anyone? Also, software developers developing enterprise software, please, please, please stop developing for that horrible, insecure, performance hobbling abomination of a tarted-up single-user OS “Server” and focus on a secure, stable server OS like FreeBSD. Please. I hate, hate having to fork over $1k to microsoft for each box to run their horrible OS just so I can run your software. Why do you support that extortion? Do you despise your customers that much? Stop.
If you care about corporate governance and data security or HIPAA compliance, you are probably violating some critical requirements by installing windows 10 or these new updates to your existing Win7/8 base if you do not block data exfiltration to Microsoft’s servers. This is spyware. These updates are stealing your data and sending it to Microsoft. If your business is subject to data privacy laws, these updates put you in violation of those laws. Microsoft is doing something that is extremely significant and extremely evil and completely wrong. Take action or you may very well be facing personal or corporate consequences. srsly.
I am a strong believer in data privacy and extremely suspect of what I consider highly disingenuous business practices like Google’s but I recognize that there are reasonable people out there who think Google isn’t evil. However, this windows 10 issue, now being pushed to windows 7, goes well beyond Google taking advantage of people’s historical assumptions about the security of email to offer them a free look-alike honey trap to gather their data. Windows 10 and these Win 7 updates are intrusive, not merely misleading. Do not update. Srsly. Do not update. Block the spyware “hotfixes.”
- Russia considers banning windows 10
- Bit torrent trackers ban Windows 10 users
- Windows 10 steals so much data it breaks your data plan and costs you money
- Windows 10 is spyware, plain and simple, including a keylogger.
Stop Gap Fixes
In researching these updates, I came across this article on techworm that has a nice summary of the Malware updates Microsoft is pushing out (with some additional amendments I found):
- KB2952664 (this one reappears no matter how often you unselect it or hide it – so memorize it as evil)
- KB2976978
- KB2977759
- KB2990214
- KB3021917
- KB3022345
- KB3035583
- KB3044374
- KB3068708
- KB3075249
- KB3080149
- KB3112343
- KB3123662
- KB3123862 (new)
- KB3173040 NEW – “final” full screen nag advertisement for Win10 malware
With a whiff of irony, this google search “telemetry site:https://support.microsoft.com/en-us/kb” shows these patches and many more…
Do not automatically install Microsoft updates. You must turn that feature off or you will keep getting additional spyware installed. Go to windows update and verify your settings. I have mine set so windows downloads the updates (so the updates are waiting locally), but I don’t let windows install them automatically. That gives me a chance to review the updates and look for spyware.
When you get updates, you now have to check each one of them to find out if it is spyware or not. The list above is current as far as I know, but clicking on the “more information” link to the right of the updates list will get you microsoft’s marketing speak obfuscation of the true purpose. Any update that “adds telemetry points” or something like that is spyware. Uncheck the install and hide the update. Note that some of these were moved from “optional” to “important.” Microsoft is absolutely intent on stealing your data and is taking some pretty underhanded steps to make it difficult for you to avoid it.
If updates get past you or it turns out later that a seemingly important or innocuous update was spyware (the fun part is that you now have to be vigilant and look all this stuff up), then you can uninstall them from the “installed updates” control panel.
Work to be done
I’ll start looking into firewall settings to block communication to microsoft’s servers. This is a standard anti-malware technique and should work here, except that microsoft has so many servers it is more challenging to block them than your typical malware botnet.
We need something like a variant of Peer Guardian to block microsoft’s servers using the standard P2P crowd-sourcing model to keep the list up to date. I’m not aware of anything like this yet, but I’m looking. Microsoft has become more of an enemy to privacy than the RIAA ever was.
UPDATE: this superuser answer includes a list of telemetry endpoints to block at your firewall or router. Alternatively you can edit your hosts file and add these entries from DSL reports.
Larger Significance
This shift in business focus by Microsoft from providing a product people are willing to pay for to stealing data from people to sell on the commercial market has some significant lessons for the entire software model.
It isn’t just that Microsoft is now adopting Google’s business model of giving away “free” goodies as traps to collect product (you) to sell to the highest bidder, but that the model of corporate trust that underpins most of the security assumptions the internet is built on is manifestly false and unsustainable. If any hacker tried to create these spyware updates, locked-down computers that only install signed code would refuse to install them. Ignoring for the moment that the signed code model is idiotically flawed as signing keys are stolen all the time, this microsoft spyware is properly signed with legitimate keys. It will be installed on locked down computers without complaint and will not show up in commercial anti-virus software. But it is spyware. It contains keyloggers and extremely productive data exfiltration code that is currently copying wholesale data dumps from unfortunate victims to Microsoft’s servers in such volume that their data caps are being hit.
If a non-commercial third party (e.g. “hacker”) did this, they’d be prosecuted. It makes no difference to you that your data is being stolen by Microsoft rather than by some clever teenager in a former eastern block country: your data is being stolen. But the model that has been promoted, a model of centralized corporate trust to validate the “security” of your system has been utterly and irrevocably shattered. This isn’t an accident, isn’t something that better data management might have prevented, this is an intentional ex post facto rewrite of the usual, customary, and regular assumptions we have about the privacy of our computer systems and one that significantly impacts the security of almost everyone in the world: military, medical, legal, fiduciary, as well as personal.
And even if you trust Microsoft (for whatever bizarre, irrational reason), Microsoft is creating a whole series of security holes in their already crappy and insecure operating system that will be exploited by third parties. By adding keyloggers and data exfiltration tools to the core OS, they’re making it even easier for non-corporate hackers to jump on the data theft gravy train. Everyone profits but you. You lose.
Ending Free Speech to Protect Obsolete Industries
In 1998 I gave a talk at DefCon 6 titled “Copyright vs. Free Speech,” the gist of which was that in order to protect the profits of the publishing industry in the face of technology which obsoleted centralized publishing, publishers had begun to buy from congress increasingly draconian legislation to protect their obsolete business model.
They have been patient and effective, implementing a long-term program of carefully designed disinformation to turn an effective method of promoting the progress of science and the useful arts into a weapon to aid extorting profit from the people’s commons.
Due to the success of their propaganda campaigns, it bears repeating that authors have no right to profit from their works. They do not “own” ideas. They, nor their assignees, have any right to control the reproduction, reuse, or dissemination of ideas and inventions once they’ve chosen to make them public. We the people have chosen to gift them with a temporary monopoly on commercial exploitation of their inventions as a mechanism the founding fathers thought would serve to maximize the availability of freely usable ideas in the public domain; that is, to promote the progress of science and the useful arts. A premise they have utterly perverted.
Any law which expands copyright steals from the public domain and gives exclusive right to commercial exploitation to the beneficiary. The copyright industry has been incredibly successful in bribing politicians into allowing them to graze their cattle in our public parks without any additional compensation to the public. Indeed, new copyright laws don’t even pay lip service to the public good and focus entirely on maximizing profits at the expense of the public domain. These legislative disasters are prima facia unconstitutional.
A new agreement, endorsed by the White House, effectively implements the dystopian warnings I gave in my 1998 talk: ISPs will begin to directly enforce copyright, acting as the muscle for the new business model the copyright industry has turned to now that publishing is obsolete: direct shakedowns.
It was clear in 1998 that if our economy was turning to the then touted model of an “information economy” (and not making things) it would become necessary to police the flow of information to block the unauthorized exchanges of ideas lest someone freely share an idea for which a private entity has been granted a monopoly and undermine the profitability of the imaginary economy.
Aside from the loss of privacy and retarding progress and the useful arts, a problematic consequence of the monitoring necessary to ensure the exchange of ideas is taxed is that citizens must always be monitored, and now directly and intrusively by their ISPs. Monitoring has a chilling effect on free speech as people are naturally disinclined to openly dissent, to only speak privately of ideas that challenge entrenched interests. Intrusive monitoring is an effective tool of totalitarianism by destroying the privacy in which informed dissent grows strong enough to overcome the entrenched.
There is no practical way to implement an effective monopoly enforcement scheme at the ISP level without active monitoring of every digital interaction, from every website visited to every message exchanged, lest one hide a privatized bit. ISP monitoring undermines the foundations of democracy, at least the significant portion which has migrated to digital forums. This is a massive implementation of the same monitoring technology and concepts used in Syria and China to control dissidents, applied here merely to further enrich a few petty plutocrats.
ACTA: Alliance for Covert Totalitarian Action
ACTA is apparently going into force this month, implementing still secret rules that will make everyone with an internet connection an international criminal in order to protect people with obsolete business models. Since the cost and value of publication, editorial review, and syndication have dropped to near zero thanks to the invention of broad direct distribution, the “recording” industry is obsolete. Why do we need an industry to make records when nobody buys records any more? The industry has changed business plans to extortion.
But the recording industry has historically made a lot of money and people with money hate giving it up and won’t do so without a fight. If the population won’t buy the recording industry’s products any more, choosing instead to shoulder the incremental cost of self-publication in a collaborative model, then the recording industry, naturally, turns to increasingly draconian efforts to preserve their revenue stream. It is far more cost-effective to co-opt the government and exploit public-funded investigatory and prosecutorial resources than to, say, pay private security to break into people’s houses and businesses: as a bonus working though the courts they can seize children’s college funds: keeping kids out of school means they won’t grow up to found competing industries. If there’s nobody left capable of innovating, there’s no point in the government enforcing that obsolete constitutional thing about “promoting the progress of science and the useful arts.”
Peer-to-peer communications and especially self-publication technologies have always been a threat to the copyright industry. The DMCA was a huge victory for a dead industry and helped preserve it well beyond any economic utility at a tremendous cost to innovation and progress. But the copyright industry may still win a losing battle by shifting the cost of prosecuting civil infringement to the public and other industries by creating a new class of crime: not optimizing copyright industry profits.
Fight ACTA
https://www.eff.org/issues/acta
