4 ms·

Windows users should be blocking all Microsoft spyware with a DNS blackhole, except for when they occasionally want to pull in an update. I would share mine, bu

Windows users should be blocking all Microsoft spyware with a DNS blackhole, except for when they occasionally want to pull in an update. I would share mine, but it's only running on a micro instance...

le-mark 9y ago
I rarely hear about black hole dns, and I often wonder why it's not more prevalant? Does anyone have insight into the pros and cons involved?
- lend000 9y ago
  You need to be slightly technical to set one up and make sure your devices use it, and if you use a VPN that intercepts DNS like mine does, you need to host it on a publicly addressable IP. Personally, I'm glad more people don't use it or I'm sure Microsoft would resort to hard-coded IP's and other methods, which require a very configurable router to block (like OpenWRT).
  - thesuitonym 9y ago
    pf can block by IP address, so you could just set up an OpenBSD router. Again, technical, but if it ever DID become necessary, I can't think of a good way for MS to address that.
    - danarmak 9y ago
      There are lots of ways. Think of it from an anti-malware perspective: how can the botnet agent on my PC, which has OS-level privileges, discover and communicate with the daily command-and-control server, if each day the network admin blocks the previous day's CnC server IP address? Any network communications that the OS is allowed (or that a Microsoft program or driver that the OS trusts is allowed) can be used to carry extra data about which IPs to talk to in order to exfiltrate "telemetry" or download updates. DNS and WHOIS queries (where MS can publish arbitrary queryable records), peer to peer DHT-like networks (ditto), Tor (designed not to let your router/firewall know who the OS it talking to), the list is endless.
      - __jal 9y ago
        I'd assumed win10 was already doing some of this. My one VM that runs it is still not getting network access. Doesn't need it, and I don't trust it. But good to know, thanks.
- blibble 9y ago
  depends who you're trying to thwart TV downloading updates? it'll probably work trying to stop MS from spying on you? they have engineered parts of the stack to avoid things like firewall and hosts file blocks, so presumably they have an IP hardcoded in case you block all their hostnames at the DNS level
danarmak 9y ago
Selectively pulling updates doesn't seem feasible. Consider that: * Microsoft does not disclose what (most) updates do and it's not feasible to reverse engineer all of them to check. * Multiple updates, including critical security patches, are published as a single monthly rollup and cannot be (easily) separated from one another. * The Windows 10 Update client doesn't officially support cherrypicking some updates and delaying others indefinitely; if you let it connect to the (real) Microsoft update server it will try to install all available updates. * You're not downloading individual per-update executables and checking their hashes; you're running a program (the Windows Update client) that, once it trusts the server it connects to, uncritically runs any code the server sends to it. Now consider all of that when the adversary controls not just individual update contents but the whole update server or delivery channel...
- lend000 9y ago
  You can also use a separate computer to manually install Windows updates: http://www.windowscentral.com/how-download-and-install-windows-10-cumulative-updates-manually http://www.windowscentral.com/how-download-and-install-windo... Granted, the DNS blackhole is more about blocking the spyware than isolating single updates.
  - danarmak 9y ago
    I wasn't aware of the MS Update Catalog. It's nice to know that it's an option. This does allow installing single updates without using the Microsoft Update client It's not a long-term solution, though: 1. You need to know the KB article ID of the update you're looking for. And again, the individual update descriptions or KB articles frequently just say "something was fixed" but not what. 2. Some updates will probably fail to install because previous updates to the same component weren't installed. Conversely, updates that just give you the latest version of a file or application might auto-install the older updates you wanted to skip. In any event, even if you successfully skip most updates, the main outcome will be that your system will be that much less secure and easier to take over using published vulns even without a backdoor...
yodon 9y ago
I think you're saying you intentionally use an unpatched OS with known actively exploited and patchable vulnerabilities, you do so in situations where the machine is connected to the public internet, and you think the thing you should be worried about is Microsoft attacking your machine via Windows Update. I don't think you need to worry about the number of people wanting to replicate your configuration exceeding the load your micro instance can handle.
- lend000 9y ago
  > you do so in situations where the machine is connected to the public internet Where'd you get that from? My "micro instance" is clearly not on my Windows machine. My Windows box is behind a pretty over-the-top firewall (which isn't even necessary on a private network for the exploits that are public). Not every vulnerability makes you remotely vulnerable behind your NAT, and I wish more of the people obsessed with update-hygiene understood that. Is my solution good for a corporate network? Obviously not, because you can't control the attack surface.

le-mark 9y ago

I rarely hear about black hole dns, and I often wonder why it's not more prevalant? Does anyone have insight into the pros and cons involved?

lend000 9y ago
You need to be slightly technical to set one up and make sure your devices use it, and if you use a VPN that intercepts DNS like mine does, you need to host it on a publicly addressable IP. Personally, I'm glad more people don't use it or I'm sure Microsoft would resort to hard-coded IP's and other methods, which require a very configurable router to block (like OpenWRT).
- thesuitonym 9y ago
  pf can block by IP address, so you could just set up an OpenBSD router. Again, technical, but if it ever DID become necessary, I can't think of a good way for MS to address that.
  - danarmak 9y ago
    There are lots of ways. Think of it from an anti-malware perspective: how can the botnet agent on my PC, which has OS-level privileges, discover and communicate with the daily command-and-control server, if each day the network admin blocks the previous day's CnC server IP address? Any network communications that the OS is allowed (or that a Microsoft program or driver that the OS trusts is allowed) can be used to carry extra data about which IPs to talk to in order to exfiltrate "telemetry" or download updates. DNS and WHOIS queries (where MS can publish arbitrary queryable records), peer to peer DHT-like networks (ditto), Tor (designed not to let your router/firewall know who the OS it talking to), the list is endless.
    - __jal 9y ago
      I'd assumed win10 was already doing some of this. My one VM that runs it is still not getting network access. Doesn't need it, and I don't trust it. But good to know, thanks.
blibble 9y ago
depends who you're trying to thwart TV downloading updates? it'll probably work trying to stop MS from spying on you? they have engineered parts of the stack to avoid things like firewall and hosts file blocks, so presumably they have an IP hardcoded in case you block all their hostnames at the DNS level

danarmak 9y ago

Selectively pulling updates doesn't seem feasible. Consider that: * Microsoft does not disclose what (most) updates do and it's not feasible to reverse engineer all of them to check. * Multiple updates, including critical security patches, are published as a single monthly rollup and cannot be (easily) separated from one another. * The Windows 10 Update client doesn't officially support cherrypicking some updates and delaying others indefinitely; if you let it connect to the (real) Microsoft update server it will try to install all available updates. * You're not downloading individual per-update executables and checking their hashes; you're running a program (the Windows Update client) that, once it trusts the server it connects to, uncritically runs any code the server sends to it. Now consider all of that when the adversary controls not just individual update contents but the whole update server or delivery channel...

lend000 9y ago
You can also use a separate computer to manually install Windows updates: http://www.windowscentral.com/how-download-and-install-windows-10-cumulative-updates-manually http://www.windowscentral.com/how-download-and-install-windo... Granted, the DNS blackhole is more about blocking the spyware than isolating single updates.
- danarmak 9y ago
  I wasn't aware of the MS Update Catalog. It's nice to know that it's an option. This does allow installing single updates without using the Microsoft Update client It's not a long-term solution, though: 1. You need to know the KB article ID of the update you're looking for. And again, the individual update descriptions or KB articles frequently just say "something was fixed" but not what. 2. Some updates will probably fail to install because previous updates to the same component weren't installed. Conversely, updates that just give you the latest version of a file or application might auto-install the older updates you wanted to skip. In any event, even if you successfully skip most updates, the main outcome will be that your system will be that much less secure and easier to take over using published vulns even without a backdoor...

yodon 9y ago

I think you're saying you intentionally use an unpatched OS with known actively exploited and patchable vulnerabilities, you do so in situations where the machine is connected to the public internet, and you think the thing you should be worried about is Microsoft attacking your machine via Windows Update. I don't think you need to worry about the number of people wanting to replicate your configuration exceeding the load your micro instance can handle.

lend000 9y ago
> you do so in situations where the machine is connected to the public internet Where'd you get that from? My "micro instance" is clearly not on my Windows machine. My Windows box is behind a pretty over-the-top firewall (which isn't even necessary on a private network for the exploits that are public). Not every vulnerability makes you remotely vulnerable behind your NAT, and I wish more of the people obsessed with update-hygiene understood that. Is my solution good for a corporate network? Obviously not, because you can't control the attack surface.