A (Terrifying) Traffic Analysis of Windows 10 – Spying on you

Text “Note: Some readers have commented that the original source for the article is of questionably validity. If anyone can confirm or refute the original author’s finding with actual data, please let me know in the comments, and I’ll update this post accordingly.

 

Some Czech guy did a traffic analysis of data produced by Windows 10, and released his findings the other day. His primary thesis was that Windows 10 acts more like a terminal than an operating system — because of the extent of the “cloud” integration, a large portion of the OS functions are almost dependent on remote (Microsoft’s) servers. The amount of collected information, even with strict privacy settings, is quite alarming.

Information transmitted:

All text typed on the keyboard is stored in temporary files, and sent (once per 30 mins) to:

oca.telemetry.microsoft.com.nsatc.net

pre.footprintpredict.com

reports.wes.df.telemetry.microsoft.com

 

There isn’t a clear purpose for this, considering there there’s no autocorrect/prediction anywhere in the OS (There is autocorrect in certain text fields, but the supposed purpose for transmitting these keystrokes is to improve autocorrect across devices. Whether a full keylog is necessary for this (as opposed to just corrections) is questionable. Furthermore, this appears to still occur even if the user is not signed in to a Microsoft account, eliminating the “across devices” benefit. Perhaps there is a global autocorrect dictionary that benefits all users, but the privacy implications of an un-disableable always-on keylogger outweigh these potential benefits.). The implications of this are significant: because this is an OS-level keylogger, all the data you’re trying to transmit securely is now sitting on some MS server. This includes passwords and encrypted chats. This also includes the on-screen keyboard, so there is no way to authenticate to a website without MS also getting your password.

Telemetry is sent once per 5 minutes, to:

vortex.data.microsoft.com

vortex-win.data.microsoft.com

telecommand.telemetry.microsoft.com

telecommand.telemetry.microsoft.com.nsatc.net

oca.telemetry.microsoft.com

oca.telemetry.microsoft.com.nsatc.net

sqm.telemetry.microsoft.com

sqm.telemetry.microsoft.com.nsatc.net

 

You might think that “telemetry” has to do with OS usage or similar… turns out it’s telemetry about the user. For example, typing a phone number anywhere into the Edge browser transmits it to the servers above.

In another example, typing the name of any popular movie into your local file search starts a telemetry process that indexes all media files on your computer and transmits them to:

df.telemetry.microsoft.com

reports.wes.df.telemetry.microsoft.com

cs1.wpc.v0cdn.net

vortex-sandbox.data.microsoft.com

pre.footprintpredict.com

 

It’s hard to imagine any purpose for this other than the obvious piracy crackdown possiblities.

When a webcam is first enabled, ~35mb of data gets immediately transmitted to:

oca.telemetry.microsoft.com

oca.telemetry.microsoft.com.nsatc.net

vortex-sandbox.data.microsoft.com

i1.services.social.microsoft.com

i1.services.social.microsoft.com.nsatc.net

Everything that is said into an enabled microphone is immediately transmitted to:

oca.telemetry.microsoft.com

oca.telemetry.microsoft.com.nsatc.net

vortex-sandbox.data.microsoft.com

pre.footprintpredict.com

i1.services.social.microsoft.com

i1.services.social.microsoft.com.nsatc.net

telemetry.appex.bing.net

telemetry.urs.microsoft.com

cs1.wpc.v0cdn.net

statsfe1.ws.microsoft.com

 

If this weren’t bad enough, this behaviour still occurs after Cortana is fully disabled/uninstalled. It’s speculated that the purpose of this function to build up a massive voice database, then tie those voices to identities, and eventually be able to identify anyone simply by picking up their voice, whether it be a microphone in a public place or a wiretap on a payphone.

Interestingly, if Cortana is enabled, the voice is first transcribed to text, then the transcription is sent to:

pre.footprintpredict.com

reports.wes.df.telemetry.microsoft.com

df.telemetry.microsoft.com

 

If Windows is left unattended for ~15 mins, a large volume of traffic starts being transmitted to various servers. This may be the raw audio data, rather than just samples.

Other concerns…

While the inital reflex may be to block all of the above servers via HOSTS, it turns out this won’t work: Microsoft has taken the care to hardcode certain IPs, meaning that there is no DNS lookup and no HOSTS consultation. However, if the above servers are blocked via HOSTS, Windows will pretend to be crippled by continuously throwing errors, while still maintaining data collection in the background. Other than an increase in errors, HOSTS blocking did not affect the volume, frequency, or rate of data being transmitted. ( via aeronet.cz )” copied.

0 replies

Leave a Reply

Want to join the discussion?
Feel free to contribute!

Leave a Reply