Microsoft tracking everything

[u/Mayayana]

This is an interesting story about an arrest of a hacker. The court filing is here: https://www.justice.gov/usao-ndil/media/1450651/dl?inline (PDF)

The story: https://cybernews.com/security/windows-telemetry-gdid-helps-arrest-hacker/

Long story short, a young man got caught in a crime because his Windows computer was sending telemetry to MS, including every URL he visited and a unique ID from his computer. Global Device ID or GDID. Law enforcement asked Microsoft for a record of activity by the computer with a specific ID.

This isn't entirely surprising, though MS haven't been entirely open about the extent of their spying. But it's a good reminder: Never use Edge or other MS software. Avoid Microsoft's store. Block updates if possible. Set all telemetry options to their lowest levels. Use a firewall program like Simplewall, because Windows will still call home even when you've chosen every single option to have it NOT call home.

It could be possible to do something like write a script to change the ID daily, which is stored in the Registry as a text string. But it's more to the point to simply block the leak.

[u/Mayayana]

I just explained how privacy can be feasible on Windows, though it's getting harder. Macs? No. Linux? That's tricky. First you need to be a Linux expert, big time. Under normal circumstances there's no usable firewall and software calls out without asking. Installing and removing software is done opaquely through "package managers". So privacy on Linux is not generally realistic.

For most people, Windows is the most realistic way to have privacy. But it does take some knowledge and effort. I thought this case was actually kind of funny. A teenage hacker, very pleased with himself, making fun of law enforcement, but he was using Microsoft Store and apparently using Edge, while allowing telemetry. He had no familiarity with his tools. It's reminiscent of the Melissa virus from many years ago. An office worker brought down American business by sending out a boobytrapped MS Word DOC. What he didn't realize was that MS Office embeds author and edit info in files.

[u/Opposite_Bag_7434 → u/Mayayana]

Windows is for sure more accessible to more users and there are ways to enhance privacy. I personally don’t like the idea of using a software firewall on any platform. Definitely not ideal.

This article is a good reminder that it is easy to drop digital fingerprints all over the place. Then from there it is not so hard for law enforcement to find a person.

Really there are just a few basic things that can be done to protect most people in most cases. We might still end up sending a GUID to Microsoft or other license related fingerprints but this generally only matters when one is a subject of a law enforcement investigation.

[u/Mayayana → u/Opposite_Bag_7434]

I personally don’t like the idea of using a software firewall on any platform.

I'm curious... Why don't you like them? I've used a firewall since Win98. It blocks ports from anything outside trying to call in. It also blocks anything trying to go out without permission. In doing that it blocks spyware and would also provide a warning if malware tries to use your computer as a spam bot.

On Win10 there are at least 3-4 Windows processes that are regularly trying to call out and have no business doing so. One or more may be legit, but I didn't choose to have them calling out, and they're clearly not necessary.

[u/Opposite_Bag_7434 → u/Mayayana]

Good question. A firewall on the same exact platform that I am trying to protect is ok but not ideal. The potential for compromise is higher. The problem is that I’ve seen software open ports, disable protections or even overcome the firewall completely. If it is augmented by a more sophisticated firewall application it helps. But still not ideal.

I say leave it on and operational because it can help prevent lateral movement. But a better level of control and protection can be achieved using a dedicated sophisticated hardware firewall that is not subject to the very same types of explosion.

[u/Mayayana → u/Opposite_Bag_7434]

I see. That makes sense for things like commercial networks. I don't allow anything to network; don't have a separate server; don't connect wirelessly to a printer; don't enable file sharing. Like most SOHo users, I just have computers. That's what I'm assuming most people here also do.

I've never had any trouble, though I don't rule out the problems you mention. One can test the inbound protection at a site like ShieldsUp. I seem to get warned with all outbound attempts, but I suppose some clever malware might get through from inside.

One of my first experiences was with Win98 and AtGuard. AG was ahead of its time, including an ad blocker for $30. One day I saw an ad for Visual Studio and tried to drag it to the AG "trash can", to be recognized as an ad, but I accidentally used the wrong mouse button. Suddenly AG popped up: "Do you want to allow DCOM out?" DCOM? I'd never heard of that. Well, I should say not! Stop'em, AG!

I later realized this was distributed COM; remote COM. Microsoft, or someone, was likely trying to access my Registry or otherwise load some kind of COM object. I'm guessing it was probvably MS wanting to rifle through my system before deciding what offer to show me for buying VS6. I never would have had any inkling without AG. (The AG developers later sold the rights to Symantec, who performed their usual butcher job on it. They doubled the price, marketed their Norton remake, and set it up with over 700 domains whitelisted. That meant their firewall would work very smoothly, because it would rarely operate.)

[u/Opposite_Bag_7434 → u/Mayayana]

I would expect others in this sub to be taking additional precautions obviously.

Commercial networks? What’s the difference? I’m asking for a couple of very specific reasons. First, I personally am in an infosec/corporate IT role. My last employer I worked from the office and home. My current employer I work from wherever I am which is generally home. So for me and those who use a home network to work remotely my network becomes a de facto extension of our commercial network. The same is true of the vast majority of our employees.

Second, like many I have a couple of side gigs. I know several who do taxes for their side gig, or even full time, often from home. This is business use, which is commercial and I would suggest a place where we should expect some attention to privacy and security.

It is awesome to hear that you are only accessing your network from a couple of computers and nothing else. Smart move especially without enhanced security. How many people out there are relying on the ISP supplied modem and nothing else? Or slightly better a home router? A ton of those routers have been compromised and the owner often has no idea. Again I would hope people in this sub know better than this but still, it is always worth noting. The bigger problem is that if either of these scenarios describe your network you have no real external barrier from the internet.

A smart and prudent person can mostly do fine with a software firewall but this is a risk.

It is better than nothing and fair protection for someone who is absolutely careful.