4 ms·

Site seems overloaded. Here are the KB links from an earlier discussion (https://news.ycombinator.com/item?id=10110316 https://news.ycombinator.com/item?id=101

Site seems overloaded. Here are the KB links from an earlier discussion (https://news.ycombinator.com/item?id=10110316 https://news.ycombinator.com/item?id=10110316). Thanks vetinari. https://support.microsoft.com/en-gb/kb/3068708 https://support.microsoft.com/en-gb/kb/3068708 https://support.microsoft.com/en-gb/kb/3075249 https://support.microsoft.com/en-gb/kb/3075249 https://support.microsoft.com/en-gb/kb/3080149 https://support.microsoft.com/en-gb/kb/3080149 Also found: https://support.microsoft.com/en-gb/kb/2976978 https://support.microsoft.com/en-gb/kb/2976978

JimmaDaRustla 11y ago
Some of those look like they'd be used to upgrade to Win10? Compatibility checking, diagnostics, etc. Nothing seems malicious, but you never know.
0x0 11y ago
The list of files modified (to add telemetry hooks?) in kb 3080149 is crazy. NTOSKrnl, NtDll, Lsass, winload.exe etc... Are they really adding spyware/telemetry hooks all the way down to the kernel? What happens next time there's a security patch for the kernel, do we get an ntoskrnl with all these "optional updates" included as well?
- kstrauser 11y ago
  Pretty much, yes. As I mentioned elsewhere, they enable spying on kids by default if they're logged in through a Microsoft account. If they're going to spy on kids, adults get the same mechanisms installed.
  - acqq 11y ago
    kstrauser refers to: https://news.ycombinator.com/item?id=10111271 https://news.ycombinator.com/item?id=10111271
- acqq 11y ago
  I remember some months ago where they only claimed fixing something minor (like, something that's not even an executable but some text-based or at least data file) in the patch and the list included also a huge amount of files including cryptwhatever.dll (not the actual name). "Backdoor time" thought I. As little as I checked however, it didn't look like a real smoking gun then. It seems a common practice somehow that since some time their updates aren't "hand picked" but generated by the computer without too much human control or that the programmers don't have time, or simply nobody cares there anymore. I'd be glad if somebody would sensibly explain all that. Including these recent "everything you type will be transferred" and "the list of all your files will be made" claims.
  - 0x0 11y ago
    It would be interesting to see what someone knowledgable would report back on by taking something like zynamics bindiff onto pre- and post this KB.
    - acqq 11y ago
      I've never seen the proof of the claims from the article discussed here three days ago: https://news.ycombinator.com/item?id=10099180 https://news.ycombinator.com/item?id=10099180 "Information transmitted: All text typed on the keyboard is stored in temporary files, and sent (once per 30 mins) to: oca.telemetry.microsoft.com.nsatc.net pre.footprintpredict.com reports.wes.df.telemetry.microsoft.com" On another side, MSFT never issued the statement what they actually collect, probably because their lawyers will need a month or two to clear that up. If the quote is true, it's a real full-blown keylogger. It's hard to believe. But there should be the pressure to find out the truth. The worst thing is that it seems the users also don't care. Do read kstrauser's top post in this discussion regarding automatic snooping of kids and emailing the parents, implemented by MSFT in Windows 10. https://news.ycombinator.com/item?id=10111271 https://news.ycombinator.com/item?id=10111271 He posted the snapshot later. Unbelievable. But it seems they really do this. Built in spying, then sending reports by e-mail.
      - morganvachon 11y ago
alinspired 11y ago
Quick check if you have any of these installed: systeminfo|findstr /LI "3068708 3075249 3080149 2976978"

JimmaDaRustla 11y ago

Some of those look like they'd be used to upgrade to Win10? Compatibility checking, diagnostics, etc. Nothing seems malicious, but you never know.

0x0 11y ago

The list of files modified (to add telemetry hooks?) in kb 3080149 is crazy. NTOSKrnl, NtDll, Lsass, winload.exe etc... Are they really adding spyware/telemetry hooks all the way down to the kernel? What happens next time there's a security patch for the kernel, do we get an ntoskrnl with all these "optional updates" included as well?

kstrauser 11y ago
Pretty much, yes. As I mentioned elsewhere, they enable spying on kids by default if they're logged in through a Microsoft account. If they're going to spy on kids, adults get the same mechanisms installed.
- acqq 11y ago
  kstrauser refers to: https://news.ycombinator.com/item?id=10111271 https://news.ycombinator.com/item?id=10111271
acqq 11y ago
I remember some months ago where they only claimed fixing something minor (like, something that's not even an executable but some text-based or at least data file) in the patch and the list included also a huge amount of files including cryptwhatever.dll (not the actual name). "Backdoor time" thought I. As little as I checked however, it didn't look like a real smoking gun then. It seems a common practice somehow that since some time their updates aren't "hand picked" but generated by the computer without too much human control or that the programmers don't have time, or simply nobody cares there anymore. I'd be glad if somebody would sensibly explain all that. Including these recent "everything you type will be transferred" and "the list of all your files will be made" claims.
- 0x0 11y ago
  It would be interesting to see what someone knowledgable would report back on by taking something like zynamics bindiff onto pre- and post this KB.
  - acqq 11y ago
    I've never seen the proof of the claims from the article discussed here three days ago: https://news.ycombinator.com/item?id=10099180 https://news.ycombinator.com/item?id=10099180 "Information transmitted: All text typed on the keyboard is stored in temporary files, and sent (once per 30 mins) to: oca.telemetry.microsoft.com.nsatc.net pre.footprintpredict.com reports.wes.df.telemetry.microsoft.com" On another side, MSFT never issued the statement what they actually collect, probably because their lawyers will need a month or two to clear that up. If the quote is true, it's a real full-blown keylogger. It's hard to believe. But there should be the pressure to find out the truth. The worst thing is that it seems the users also don't care. Do read kstrauser's top post in this discussion regarding automatic snooping of kids and emailing the parents, implemented by MSFT in Windows 10. https://news.ycombinator.com/item?id=10111271 https://news.ycombinator.com/item?id=10111271 He posted the snapshot later. Unbelievable. But it seems they really do this. Built in spying, then sending reports by e-mail.
    - morganvachon 11y ago

alinspired 11y ago

Quick check if you have any of these installed: systeminfo|findstr /LI "3068708 3075249 3080149 2976978"