10 ms·

> And finally, some traffic seems quite impenetrable. We configured our test virtual machine to use an HTTP and HTTPS proxy (both as a user-level proxy and a sy

> And finally, some traffic seems quite impenetrable. We configured our test virtual machine to use an HTTP and HTTPS proxy (both as a user-level proxy and a system-wide proxy) so that we could more easily monitor its traffic, but Windows 10 seems to make requests to a content delivery network that bypass the proxy. Does this mean a Win10 machine setup to use something like Tor will leak the user's actual IP back to Microsoft? If you're VPN'd, is some traffic still leaking outside of the VPN? From an engineering perspective, how is this happening? Does Microsoft have a second network interface hidden away using hardcoded settings for DNS, etc? On a somewhat related note, if a Win10 app is cert pinning, is there a way to force it to use your cert so you can MITM it?

zaroth 11y ago
What they are describing isn't necessarily cert pinning, although it's possible there is also cert pinning. It just means there are hard-coded IP addresses somewhere; either a hard-coded DNS server, or the endpoint itself. Notably, it's still possible to MITM the traffic, just not as easy as if the system respected the proxy settings. You need to spoof the destination IP and try to terminate the TLS with your own trusted cert. If the connection still fails, only then would you know there is a cert pin. I haven't heard if anyone has tried this with the "CDN"-bound traffic, or the persistent bing.com/live.com traffic. If a VPN was being used, I would expect traffic would still be routed through the VPN interface. The HTTP(S) proxy code is higher up the stack than a VPN interface. It does raise a huge red flag though, if you are not fully in control of your own network routing using standard tooling, IMO it's not an appropriate OS for any enterprise environment.
blackbeard 11y ago
I've been on Windows 10 for a couple of days now. VPN traffic doesn't leak if the default route is the VPN interface. I tried it and my firewall went silent apart from the tunnel. I have absolutely no fucking idea what it is sending out though. It's always talking to something. I've turned everything off that is documented and use a local account and remove-appxpackage'd everything. Sorry but this release is a write off. My host/vm relation is being inverted to Ubuntu as a host this week rather than a guest. If I don't know what it's doing, how can I trust it?
- Kenji 11y ago
  Can't you just redirect all that stuff it sends to 127.0.0.1 by editing your hosts file?
  - blackbeard 11y ago
    You can, but we have 450 workstations and about 600 servers. That somewhat multiplies the problems.
    - pc86 11y ago
      > somewhat Yes I can see how that would complicate things a little :)
    - EvanAnderson 11y ago
      If they're using DNS to resolve the name of the "mothership" just put a bogus record (or zone) in your DNS. If they're not using any name resolution protocol and you can isolate the IP addresses they're talking to just blackhole them at your border.
      - blackbeard 11y ago
        We're already doing that but it's hard work keeping up with it all.
        a3n 11y ago
        And then Microsoft will fix that, ...
        EvanAnderson 11y ago
        Default deny is the only viable strategy. (It's also completely impractical...)
    - drdaeman 11y ago
      1000+ machines and no way to update a file with a few commands/clicks/whatever-your-configuration-management-system-uses? (Ok, at worst, making a batch file and scheduling its launch.) If so, I suppose you have big issues with your system administration team.
ised 11y ago
Change the gateway on the Windows 10 install computer (or "default route" as another commenter calls it) to a computer _you_ control, i.e., a UNIX install, that can do IP forwarding. Turn on IP forwarding. Connect the UNIX install to the internet. Also change your default DNS servers on the Windows 10 install to point to the UNIX install. If you know how, set up DNS on this computer. I recommend using your own cache listening on 127.0.0.x, not a public one. Then monitor traffic being forwarded by the UNIX install. This is not difficult for anyone familiar with UNIX. Plenty of good and bad software to help you. Do people need instructions? If there is interest in blocking this nonsense I for one would be willing to help. There are a lot more Windows users than Apple users so this is fun to watch how the Windows users react to the incessant connections to the mothership, which is par for the course with Apple products. Would love to see the stats on how much cumulative user-purchased bandwidth Apple and Microsoft are usurping in order to track the people who have to pay for it. If you want to block this nonsense, then the easiest way to do it is from another computer acting as a gateway. Trying to block these connections from the computer on which Windows 10 has been installed will probably be an exercise in frustration for most users and they will give up. (Most Apple users do not know or care so they do not try to block.) I am sure that Microsoft is counting on their users acting like Apple users.
- chopin 11y ago
  If one can master all this, wouldn't it be easier to use a non-Windows box in the first place?
  - wtallis 11y ago
    Of course not. Setting up OpenWRT to do this is a lot less work than migrating your entire workflow to a new operating system.
  - SixSigma 11y ago
    Right when I have finished porting all of my Autodesk products....
- aluhut 11y ago
  The problem is that it is not an user friendly solution. It will only help those people who do have several OS running or are capable of understanding. The privacy settings that do not work were pretty good hidden already and many are scared away already. This second level is even worse. What we need is a simple tool where you set check boxes to fix it all. That would be a solution for the target audience.
rsync 11y ago
Look. Seriously. I don't want to be a brat, but what is the possible overlap between people caring to use Tor (for whatever reason) and people using Windows 10 as the host OS ? You're at the absolute cutting edge of spyware-in-the-home, defective by design, obscured infrastructure that was designed from the ground up to be user hostile in every conceivable dimension. And you're going to run Tor on that. There's a phrase for this and that phrase is "clown college".
- dmix 11y ago
  Indeed, Microsoft phoning home is on the lower end of your concerns here.
  - deleted 11y ago
    [deleted]
- lambda 11y ago
  > I don't want to be a brat, but what is the possible overlap between people caring to use Tor (for whatever reason) and people using Windows 10 as the host OS ? Journalists. There are many journalists who need to cover sensitive topics, who are not particularly technically literate. They need to be able to buy a system off the shelf, do some minimal and easy amount of installation of privacy protection, and be reasonably confident that it will work and they will not be outing their sources to whatever particular despot is listing in. Of course, Tails is a better solution for that. But in terms of being able to allow them to do their job as easily as possible, it would be preferable for them to be able to install the Tor browser bundle on their existing OS rather than having to learn an entirely new one (and possibly dual boot in order to run some Windows-only software, and not keep it isolated well enough and thus leak information accidentally). It apparently took a while to teach Glen Greenwald enough of how to use Tor and GPG in order for Snowden to be able to communicate with him. We need to make this process easier, not harder.
  - marcosdumay 11y ago
    Well, looks like they need to get their systems from some seller that is interested on satisfying their needs.

zaroth 11y ago

What they are describing isn't necessarily cert pinning, although it's possible there is also cert pinning. It just means there are hard-coded IP addresses somewhere; either a hard-coded DNS server, or the endpoint itself. Notably, it's still possible to MITM the traffic, just not as easy as if the system respected the proxy settings. You need to spoof the destination IP and try to terminate the TLS with your own trusted cert. If the connection still fails, only then would you know there is a cert pin. I haven't heard if anyone has tried this with the "CDN"-bound traffic, or the persistent bing.com/live.com traffic. If a VPN was being used, I would expect traffic would still be routed through the VPN interface. The HTTP(S) proxy code is higher up the stack than a VPN interface. It does raise a huge red flag though, if you are not fully in control of your own network routing using standard tooling, IMO it's not an appropriate OS for any enterprise environment.

blackbeard 11y ago

I've been on Windows 10 for a couple of days now. VPN traffic doesn't leak if the default route is the VPN interface. I tried it and my firewall went silent apart from the tunnel. I have absolutely no fucking idea what it is sending out though. It's always talking to something. I've turned everything off that is documented and use a local account and remove-appxpackage'd everything. Sorry but this release is a write off. My host/vm relation is being inverted to Ubuntu as a host this week rather than a guest. If I don't know what it's doing, how can I trust it?

Kenji 11y ago
Can't you just redirect all that stuff it sends to 127.0.0.1 by editing your hosts file?
- blackbeard 11y ago
  You can, but we have 450 workstations and about 600 servers. That somewhat multiplies the problems.
  - pc86 11y ago
    > somewhat Yes I can see how that would complicate things a little :)
  - EvanAnderson 11y ago
    If they're using DNS to resolve the name of the "mothership" just put a bogus record (or zone) in your DNS. If they're not using any name resolution protocol and you can isolate the IP addresses they're talking to just blackhole them at your border.
    - blackbeard 11y ago
      We're already doing that but it's hard work keeping up with it all.
      - a3n 11y ago
        And then Microsoft will fix that, ...
      - EvanAnderson 11y ago
        Default deny is the only viable strategy. (It's also completely impractical...)
  - drdaeman 11y ago
    1000+ machines and no way to update a file with a few commands/clicks/whatever-your-configuration-management-system-uses? (Ok, at worst, making a batch file and scheduling its launch.) If so, I suppose you have big issues with your system administration team.

ised 11y ago

Change the gateway on the Windows 10 install computer (or "default route" as another commenter calls it) to a computer _you_ control, i.e., a UNIX install, that can do IP forwarding. Turn on IP forwarding. Connect the UNIX install to the internet. Also change your default DNS servers on the Windows 10 install to point to the UNIX install. If you know how, set up DNS on this computer. I recommend using your own cache listening on 127.0.0.x, not a public one. Then monitor traffic being forwarded by the UNIX install. This is not difficult for anyone familiar with UNIX. Plenty of good and bad software to help you. Do people need instructions? If there is interest in blocking this nonsense I for one would be willing to help. There are a lot more Windows users than Apple users so this is fun to watch how the Windows users react to the incessant connections to the mothership, which is par for the course with Apple products. Would love to see the stats on how much cumulative user-purchased bandwidth Apple and Microsoft are usurping in order to track the people who have to pay for it. If you want to block this nonsense, then the easiest way to do it is from another computer acting as a gateway. Trying to block these connections from the computer on which Windows 10 has been installed will probably be an exercise in frustration for most users and they will give up. (Most Apple users do not know or care so they do not try to block.) I am sure that Microsoft is counting on their users acting like Apple users.

chopin 11y ago
If one can master all this, wouldn't it be easier to use a non-Windows box in the first place?
- wtallis 11y ago
  Of course not. Setting up OpenWRT to do this is a lot less work than migrating your entire workflow to a new operating system.
- SixSigma 11y ago
  Right when I have finished porting all of my Autodesk products....
aluhut 11y ago
The problem is that it is not an user friendly solution. It will only help those people who do have several OS running or are capable of understanding. The privacy settings that do not work were pretty good hidden already and many are scared away already. This second level is even worse. What we need is a simple tool where you set check boxes to fix it all. That would be a solution for the target audience.

rsync 11y ago

Look. Seriously. I don't want to be a brat, but what is the possible overlap between people caring to use Tor (for whatever reason) and people using Windows 10 as the host OS ? You're at the absolute cutting edge of spyware-in-the-home, defective by design, obscured infrastructure that was designed from the ground up to be user hostile in every conceivable dimension. And you're going to run Tor on that. There's a phrase for this and that phrase is "clown college".

dmix 11y ago
Indeed, Microsoft phoning home is on the lower end of your concerns here.
- deleted 11y ago
  [deleted]
lambda 11y ago
> I don't want to be a brat, but what is the possible overlap between people caring to use Tor (for whatever reason) and people using Windows 10 as the host OS ? Journalists. There are many journalists who need to cover sensitive topics, who are not particularly technically literate. They need to be able to buy a system off the shelf, do some minimal and easy amount of installation of privacy protection, and be reasonably confident that it will work and they will not be outing their sources to whatever particular despot is listing in. Of course, Tails is a better solution for that. But in terms of being able to allow them to do their job as easily as possible, it would be preferable for them to be able to install the Tor browser bundle on their existing OS rather than having to learn an entirely new one (and possibly dual boot in order to run some Windows-only software, and not keep it isolated well enough and thus leak information accidentally). It apparently took a while to teach Glen Greenwald enough of how to use Tor and GPG in order for Snowden to be able to communicate with him. We need to make this process easier, not harder.
- marcosdumay 11y ago
  Well, looks like they need to get their systems from some seller that is interested on satisfying their needs.