8 ms·
Windows 10 has an undocumented certificate pinning feature
- satysin 10y agoTelemetry related of course. Shame it is not properly documented. As with all things closed source we have no idea how this works, when it is updated or if it is possible to ignore it totally.
- besselheim 10y agoLooking at the list of domains, they appear to be almost entirely unrelated to telemetry. Most likely this feature is a response to incidents such as this: https://www.wired.com/2011/03/comodo-compromise/ https://www.wired.com/2011/03/comodo-compromise/ (in which certs for login.skype.com and login.live.com were misissued by Comodo). Blocking the domains in this list to prevent telemetry, as suggested in other comments, would prevent access to most of Microsoft's online services. This includes third-party websites hosted on Azure that aren't using their own custom domain (.azurewebsites.net), and all software updates, including critical security patches.
- TazeTSchnitzel 10y agoI recall seeing a list of telemetry domains, and it's quite different. This is a list of user-facing sites.
- dirtbox 10y agoCorrect. I made a quick dump of the telemetry hosts here: https://cl.ly/hZ3q https://cl.ly/hZ3q If you have win10, you can add this to your hosts file. The optional portion of the list will block store items, the email client and even things like the Groove media player, so use it as you will.
- lightedman 10y agoGiven the OS is known to be able to ignore its own HOSTs file, you're better off doing this directly in your router, if that is a possible option.
- dirtbox 10y agoUnless you have a source that shows otherwise, I only know if it doing that if it's formatted wrongly, which is going to be a problem with most things.
- deleted 10y ago[deleted]
- Maarten88 10y agoMaybe Microsoft are trying to foil m.i.t.m. attacks against their infrastructure, by reporting back certificate errors for those domains. A hacker who is developing an attack against Windows Update will need to implement a mock version of the service, redirect dns, and create self-signed certs for those domains. I think Microsoft are interested in people/organizations doing that. Of course, this is not foolproof, and documenting the feature will just alert people they need to mock telemetry and this pinning feature first.
- akerro 10y agoDidn't Stallman warn us about it?
- Jaruzel 10y agoCould this list of domains be used as one-stop-shop to block all Windows 10 snooping?
- arm 10y agoNo guarantee you could block all tracking, although you probably cover a wide swath of the snooping by blocking the hostnames in this list (since they are owned by Microsoft). As mentioned in the article, the registry entry does seem to be regularly updated, so you’d have to keep track of any changes to it over time.
- yakult 10y agoIt's like plugging leaks on a sponge boat. You don't know that a. there isn't several lists, or b. they won't add it somewhere else with a future update or even c. they won't just steganographically insert it into other innocuous traffic to counter packet sniffing and hardware firewalls. Once you stop trusting the OS maker, you can't trust the OS.
- kobayashi 10y agoWhile MS using steganography seems a bit far fetched, I can't agree more with your final statement. I simple don't trust MS anymore, and it's a sad state of affairs.
- eDameXxX 10y ago> I simple don't trust MS anymore You just "simple" don't trust Microsoft. What about other big companies, for example Google? Do you trust them or not? Why? Do you trust Apple/Facebook/<put_here_another_big_company_with_users>? Why?
- userbinator 10y agoI certainly don't.
- iotku 10y ago
- eeZi 10y agoAn attempt to do something similar with netfilter/Linux: https://github.com/fredburger/xt_sslpin https://github.com/fredburger/xt_sslpin Recent fork: https://github.com/Enteee/xt_sslpin https://github.com/Enteee/xt_sslpin Someone's blog post about it: https://duckpond.ch/networking/security/2016/09/09/xt_sslpin.html https://duckpond.ch/networking/security/2016/09/09/xt_sslpin... /r/netsec discussion: https://www.reddit.com/r/netsec/comments/52me9w/xt_sslpin_match_ssltls_certificate_finger_prints/ https://www.reddit.com/r/netsec/comments/52me9w/xt_sslpin_ma... I like the idea.
- woliveirajr 10y ago> Edit 1 (2016-09-24): This seems to be - at least partially - related to Telemetry, as briefly mentioned at the only page I could find: https://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-telemetry-in-your-organization https://technet.microsoft.com/en-us/itpro/windows/manage/con... So some are related to telemetry, but probably not all them
- SanPilot 10y agoThis is why I always run open source software on my systems.
- divbit 10y agoIf you are taking this as an argument for e.g. linux over Windows, Certificate pinning is a good thing though? It helps prevent mitm attacks, as stated in the article.. (Not to say that you shouldn't run linux )
- RyJones 10y agointeresting that they are pinning certs for -int domains (integration testing) but not -ppe (pre production) perhaps they no longer use -ppe?
- shawkinaw 10y ago> So this very much looks like evidence of an active system-wide certificate pinning mechanism protecting against MITM attacks on high-value Microsoft domains. Which, per se, is a good thing! I feel like a broken record, but no, if you can't turn this off, it is not a good thing! It means you can never use an HTTPS proxy and know exactly what data is streaming off of your computer.
- besselheim 10y agoYou can, you just need to have someone reverse engineer the pinning mechanism first to figure out how to disable or bypass it, or alternatively, log the data being wrapped in TLS. Same as has been done on mobile platforms (e.g. HttPeek for iOS).
- userbinator 10y agoIndeed, a "MITM attack" is a good thing if you are the one inspecting the data. Obligatory story about having control over your computing enviroment: https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html
- dpark 10y agoGiven that products like Fiddler still work against live.com domains on Windows 10, either the pinning isn't enabled, Fiddler knows how to bypass it, or this isn't actually related to pinning.
- ccrush 10y agoOr maybe the pinning isn't for IE, but for Windows sending MS hidden information it doesn't want you to know about.
- dpark 10y agoThat's an awfully large list of domains for "hidden" telemetry. Hard to imagine why all of those would be specified for that. e.g. Some of those are just landing pages. Disclosure: Microsoft employee
- aceperry 10y agoWindows has lots of undocumented "features." In all seriousness, I'm not sure this is a good thing.