3 ms·
Easiest way to block this for sure is probably going to be harvest a list of hostnames and/or IPs microsoft are using and block them at your border gateway/rout
by nly 11y ago
Easiest way to block this for sure is probably going to be harvest a list of hostnames and/or IPs microsoft are using and block them at your border gateway/router.
I've recently considered setting up a separate wifi SSID where everything outbound except DNS, and tcp 80/443 is blocked, as well as TLS SNI and plain HTTP logging just so this sort of thing can be monitored.
- kardos 11y agoThat's a fragile solution at best. One update could change the IP/hosts of the data harvesting servers. Surely the data will be transmitted using TLS or equivalent; HTTP logging won't do you much good unless you can (a) MITM the TLS setup, or (b) extract the keys that the spyware is using.
- JadeNB 11y agoIt's not what you said, but note that some of the phone-home behaviour is very deep rooted, ignoring proxy settings (http://arstechnica.com/information-technology/2015/08/even-when-told-not-to-windows-10-just-cant-stop-talking-to-microsoft http://arstechnica.com/information-technology/2015/08/even-w...): > We configured our test virtual machine to use an HTTP and HTTPS proxy (both as a user-level proxy and a system-wide proxy) so that we could more easily monitor its traffic, but Windows 10 seems to make requests to a content delivery network that bypass the proxy.
- rasz_pl 11y agoWindows internal firewall blocks everything just fine. So far there are no secret allow lists present. Enable 'Deny all outgoing' and start adding your own Egress filtering rules.