5 ms·

>>I've deactivated all reporting and services that call back home (at least which I was aware of). In addition I've installed glasswire to check the network act

by smtddr 11y ago

>>I've deactivated all reporting and services that call back home (at least which I was aware of). In addition I've installed glasswire to check the network activities. I'm going to recommend to you, or anyone, wanting to verify Windows 10 network behavior to do it without depending on software running on the OS itself. Try verifying it again using network analyzing software on linux or macosx, running downstream of your network setup. e.g., a router that's running linux you can ssh into and run "ngrep"(kinda like a commandline version of wiresahrk) and verify from there.

danlindley 11y ago
Could you recommend a resource that would provide some good information on this? I keep hearing about ways to modify routers to operate this way, but have yet to come across something that clearly describes how this is done.
- asdfaoeu 11y ago
  The cheap and easy way to do this is to buy a hub and plug it into your router the computer you want to analyse and another computer.
  - lewiseason 11y ago
    Or buy/make something like this: http://hakshop.myshopify.com/products/throwing-star-lan-tap http://hakshop.myshopify.com/products/throwing-star-lan-tap and a couple of USB-Ethernet adaptors
  - mikeash 11y ago
    If you happen to have a computer with both WiFi and ethernet (many/most laptops these days), set it up as a bridge, connect the Windows machine to one of those interfaces and use the other one to connect to the internet.
  - BuildTheRobots 11y ago
    Even easier (buying hubs is hard) and possibly cheaper (switches with mirror ports aren't the cheapest) is to just stick two network cards into your linux box, set up a layer-2 bridge and sniff everything going between. CentOS/RedHat derivitives: https://www.banym.de/linux/centos/setup-bridge-device-on-centos https://www.banym.de/linux/centos/setup-bridge-device-on-cen... Debian/Ubuntu: https://wiki.debian.org/BridgeNetworkConnections https://wiki.debian.org/BridgeNetworkConnections
- bitwize 11y ago
  Use a Linux box (a Raspberry Pi, for example) as a router/AP.
- xfalcox 11y ago
  The most common way is using an alternate firmware, like OpenWRT. You need a compatible router, but the official site is good enough. http://wiki.openwrt.org/toh/start http://wiki.openwrt.org/toh/start
- wrenky 11y ago
  As bitwise said, best is to use a small linux computer on the same lan. You could use any computer really, just make it different than the host you are trying to capture on!
- smtddr 11y ago
  I have a blog explaining how to watch the traffic of a Nintendo Wii console using a USB-ethernet adapter. http://smtddr.hatenablog.com/entry/2014/02/16/tvclb_part1 http://smtddr.hatenablog.com/entry/2014/02/16/tvclb_part1 It's probably overly complicated, but because I happened to have an extra router laying about it was the easiest way for me to do it. The setup ultimately looks like this: http://i.imgur.com/klNvoTS.png http://i.imgur.com/klNvoTS.png The spare router is really only needed for the smartphone. Anything with an ethernet port can be connected directly to the linux laptop.
  - danlindley 11y ago
    This has taught me a lot. Thank you.
- natep 11y ago
  As someone tech-savvy and having used WireShark, even, I'm curious to know from my sibling commenters, what are you thinking? Of course you start by buying hardware or modifying a router. Parent comment is specifically asking for "good information" and something that "clearly defines how this is done." IMO, xfalcox and lewiseason come closest to actually answering the question, because their links mention specific software. But simply installing software isn't enough, it needs to be configured. How does one set up OpenWRT or WireShark to filter for this kind of information? What pitfalls might one encounter? Do you need a CS degree in order to interpret the data? What keywords should one use when searching for more information? With vague answers like the ones so far, you're just making it seem more difficult and intimidating for anyone that has little to no experience in this area. If we want people to be more concerned about their privacy, it needs to be as easy (or easier) for people to take control of their information as it is for them to give it away. Edit: smtddr has the right idea, thumbs up. Should have hit refresh one more time before posting.
qrmn 11y ago
I'm going to recommend deadlisting/disassembly instead. Network analysis doesn't give as much context for exactly what is sent, and there seems to be - as far as I can see, yet? - a total lack of hard data and verifiable evidence about what all this "telemetry" actually is, what can be turned off, what can't, and what actually gets sent to whom, when, from what, and why. The "evidence" I have seen so far that Windows 10 communicates with its maker is, let's be honest, pretty scaremongery and includes things like LLMNR traffic - which is link-local! - and neglects to consider that Windows Update now checks much more frequently (because of the accelerated release cadence of a rolling release) and essentially torrents its updates now, P2P-style. If there's a real privacy issue - and there may well be, especially on default settings - we need reliable, detailed, hard information to see what binaries send what to where to begin to address it, and to see what can be turned off, what should be, etc. Does anyone know if anyone's begun that analysis yet? (Of course it really should be Microsoft openly discussing this, but in the absence of that, the mantle inevitably falls to independent researchers.)
fencepost 11y ago
I would be astonished to see "below the stack" communications for anything official from Microsoft, because that takes the public conversation from "look at all these features that affect privacy" to "look at how Microsoft is TRYING TO HIDE privacy invading features." Since MS knows that Windows communications are going to be under a microscope anyway the odds of them expecting to successfully hide the very existence of communications seem low to me, and once they're known to exist they WILL be inspected and publicized. I'd expect the below-stack communications to be from espionage folks instead, quite frankly.
- chemmail 11y ago
  That is just plain naiveté. Big corporations don't have the accountability as individuals or smaller companies. They can just scrapgoat someone. Just watch some docus like the enron one http://www.imdb.com/title/tt1016268/ http://www.imdb.com/title/tt1016268/. Those dystopian futures many writers romance about are going to come true soon.

by smtddr 11y ago

danlindley 11y ago

Could you recommend a resource that would provide some good information on this? I keep hearing about ways to modify routers to operate this way, but have yet to come across something that clearly describes how this is done.

asdfaoeu 11y ago
The cheap and easy way to do this is to buy a hub and plug it into your router the computer you want to analyse and another computer.
- lewiseason 11y ago
  Or buy/make something like this: http://hakshop.myshopify.com/products/throwing-star-lan-tap http://hakshop.myshopify.com/products/throwing-star-lan-tap and a couple of USB-Ethernet adaptors
- mikeash 11y ago
  If you happen to have a computer with both WiFi and ethernet (many/most laptops these days), set it up as a bridge, connect the Windows machine to one of those interfaces and use the other one to connect to the internet.
- BuildTheRobots 11y ago
  Even easier (buying hubs is hard) and possibly cheaper (switches with mirror ports aren't the cheapest) is to just stick two network cards into your linux box, set up a layer-2 bridge and sniff everything going between. CentOS/RedHat derivitives: https://www.banym.de/linux/centos/setup-bridge-device-on-centos https://www.banym.de/linux/centos/setup-bridge-device-on-cen... Debian/Ubuntu: https://wiki.debian.org/BridgeNetworkConnections https://wiki.debian.org/BridgeNetworkConnections
bitwize 11y ago
Use a Linux box (a Raspberry Pi, for example) as a router/AP.
xfalcox 11y ago
The most common way is using an alternate firmware, like OpenWRT. You need a compatible router, but the official site is good enough. http://wiki.openwrt.org/toh/start http://wiki.openwrt.org/toh/start
wrenky 11y ago
As bitwise said, best is to use a small linux computer on the same lan. You could use any computer really, just make it different than the host you are trying to capture on!
smtddr 11y ago
I have a blog explaining how to watch the traffic of a Nintendo Wii console using a USB-ethernet adapter. http://smtddr.hatenablog.com/entry/2014/02/16/tvclb_part1 http://smtddr.hatenablog.com/entry/2014/02/16/tvclb_part1 It's probably overly complicated, but because I happened to have an extra router laying about it was the easiest way for me to do it. The setup ultimately looks like this: http://i.imgur.com/klNvoTS.png http://i.imgur.com/klNvoTS.png The spare router is really only needed for the smartphone. Anything with an ethernet port can be connected directly to the linux laptop.
- danlindley 11y ago
  This has taught me a lot. Thank you.
natep 11y ago
As someone tech-savvy and having used WireShark, even, I'm curious to know from my sibling commenters, what are you thinking? Of course you start by buying hardware or modifying a router. Parent comment is specifically asking for "good information" and something that "clearly defines how this is done." IMO, xfalcox and lewiseason come closest to actually answering the question, because their links mention specific software. But simply installing software isn't enough, it needs to be configured. How does one set up OpenWRT or WireShark to filter for this kind of information? What pitfalls might one encounter? Do you need a CS degree in order to interpret the data? What keywords should one use when searching for more information? With vague answers like the ones so far, you're just making it seem more difficult and intimidating for anyone that has little to no experience in this area. If we want people to be more concerned about their privacy, it needs to be as easy (or easier) for people to take control of their information as it is for them to give it away. Edit: smtddr has the right idea, thumbs up. Should have hit refresh one more time before posting.

qrmn 11y ago

I'm going to recommend deadlisting/disassembly instead. Network analysis doesn't give as much context for exactly what is sent, and there seems to be - as far as I can see, yet? - a total lack of hard data and verifiable evidence about what all this "telemetry" actually is, what can be turned off, what can't, and what actually gets sent to whom, when, from what, and why. The "evidence" I have seen so far that Windows 10 communicates with its maker is, let's be honest, pretty scaremongery and includes things like LLMNR traffic - which is link-local! - and neglects to consider that Windows Update now checks much more frequently (because of the accelerated release cadence of a rolling release) and essentially torrents its updates now, P2P-style. If there's a real privacy issue - and there may well be, especially on default settings - we need reliable, detailed, hard information to see what binaries send what to where to begin to address it, and to see what can be turned off, what should be, etc. Does anyone know if anyone's begun that analysis yet? (Of course it really should be Microsoft openly discussing this, but in the absence of that, the mantle inevitably falls to independent researchers.)

fencepost 11y ago

I would be astonished to see "below the stack" communications for anything official from Microsoft, because that takes the public conversation from "look at all these features that affect privacy" to "look at how Microsoft is TRYING TO HIDE privacy invading features." Since MS knows that Windows communications are going to be under a microscope anyway the odds of them expecting to successfully hide the very existence of communications seem low to me, and once they're known to exist they WILL be inspected and publicized. I'd expect the below-stack communications to be from espionage folks instead, quite frankly.

chemmail 11y ago
That is just plain naiveté. Big corporations don't have the accountability as individuals or smaller companies. They can just scrapgoat someone. Just watch some docus like the enron one http://www.imdb.com/title/tt1016268/ http://www.imdb.com/title/tt1016268/. Those dystopian futures many writers romance about are going to come true soon.