8 ms·
I am surprised that they using server names like "alpha.telemetry.microsft.com". when I see something like "microsft" in an E-mail or link I immediately suspect
by maxxxxx 8y ago
I am surprised that they using server names like "alpha.telemetry.microsft.com". when I see something like "microsft" in an E-mail or link I immediately suspect that somebody is trying to fake being from Microsoft. Or are these spelling errors in the article?
Edit: these domain names are in the report too. Very strange. I would get very nervous if I saw "microsft" in a firewall log.
- pdkl95 8y ago> microsft.com https://en.wikipedia.org/wiki/8.3_filename https://en.wikipedia.org/wiki/8.3_filename
- maxxxxx 8y agoWhy would they use the short names in URLs? I thought they make sense only for file names.
- pdkl95 8y agoI'm mostly joking. However, I've been observing Microsoft since the Windows 2.0 era, and I can't completely discard the possibility that Microsoft actually would use 8.3 domain names. Using 8.3 names "for legacy compatibility" in unusual places is something they've done before.
- maxxxxx 8y agoIt could be that at some point they mapped domain names to folder names or something like that. Still looks pretty hacky (or malicious) nowadays.
- yesenadam 8y agoThat does sound like some kind of rational explanation. p.s. Further proof that history's written by the victors, from that 8.3 wiki page: "An 8.3 filename...is a filename convention used by old versions of DOS and versions of Microsoft Windows...Similar 8.3 file naming schemes have also existed on earlier CP/M, TRS-80, Atari, and some Data General and [DEC] minicomputer operating systems." "Similar naming schemes also existed"! A strange way of saying "DOS copied CP/M's drive letter + colon + 8.3 filename exactly". ..and everything else. (Disclosure: I grew up on CP/M)
- orionblastar 8y agoDOS was built on CP/M standards and I heard there was a converter program to convert CP/M to DOS programs because the system API calls were almost the same. Just like MacOS has UNIX API under it and so does Linux as they were based on Unix standards.
- yesenadam 8y agoDOS was built on CP/M standards hehe come on, DOS was a quick copy/imitation of CP/M. That seems a funny way of describing it, dignifying what was a knock-off job. As if accused forgers or plagiarists were to say "Huh? I'm building on the standards of the earlier work." I mean, fair enough (initially), Gates did try first to give the IBM gig to Kildall.
- vthriller 8y agosilly easter eggs?
- crumbshot 8y agoThat seems to be a typo, it should be microsoft.com for all these hosts.
- maxxxxx 8y agoThat would be a serious problem in the PDF they published.
- crumbshot 8y agoI don't know about serious, but it is a problem in the PDF they published.
- topspin 8y agoalpha.telemetry.microsft.com resolves and has Microsoft name servers as SOA. I see no reason to conclude this is a typo. What evidence do you have?
- MikusR 8y agodnschecker.org says it doesn't
- cwbrandsma 8y agohttps://www.whois.com/whois/microsft.com https://www.whois.com/whois/microsft.com It is owned by Microsoft, registered by MarkMonitor (MarkMonitor is a legit company)
- MikusR 8y agoYes, but just like microsoft.telemetry.elegantcode.com it has no ip address associated with it.
- crumbshot 8y agoNo A or AAAA or CNAME record exists for that name or any of the other microsft.com domains mentioned in the document. Although alpha.telemetry.microsoft.com doesn't currently exist either, others do, e.g. us.vortex-win.data.microsoft.com resolves to a Microsoft-owned IP address. It's a mistake in the report.
- userbinator 8y agohttps://www.ip-tracker.org/locator/ip-lookup.php?ip=Microsft.com https://www.ip-tracker.org/locator/ip-lookup.php?ip=Microsft... It does seem MS owns that domain, but to be actively using it --- especially for telemetry --- raises red flags for me too. Using misspellings of names is something malware often does.
- gammateam 8y ago> Using misspellings of names is something malware often does your spidey sense is telling you what you need to know, you just won’t say it
- stult 8y agoIt could be an attempt to bypass DNS blacklists. I have Microsoft domains blacklisted on my pi-hole because I find their telemetry practices so difficult to constrain otherwise. Not sure if I caught any micrsoft domains, but there were definitely some that seemed intentionally semi-obfuscated, with msft or something like that instead of the full company name.
- woolvalley 8y agoIs there a specific update url you whitelist?
- AndrewGaspar 8y agoI'd actually lean towards it being the opposite - put the thing that people and organizations would be inclined to block on a separate domain so that the core business domain isn't blocked. EDIT: Seems like there are a lot *.microsoft.com URLs, too, so disregard this theory.
- mordechai9000 8y agoI have seen internal groups use domains like this simply because the process for using the primary domain is too onerous, or corporate divisions make it otherwise problematic.
- picsao 8y agoBut it's all peer 2 peer
- darkhorn 8y agoBecause some malwares block microsoft.com.
- Myrth 8y agoMy guess, it was a typo in client and they've registered misspelled domain as easiest fix for backwards compatibility with affected old releases.
- alasdair_ 8y ago>My guess, it was a typo in client and they've registered misspelled domain as easiest fix for backwards compatibility with affected old releases. It was created in 1996, so likely not. Although that expiration date is interesting... Domain Name: MICROSFT.COM Registrar: MARKMONITOR INC. Sponsoring Registrar IANA ID: 292 Whois Server: whois.markmonitor.com Referral URL: http://www.markmonitor.com http://www.markmonitor.com Name Server: NS1.MSFT.NET Name Server: NS2.MSFT.NET Name Server: NS3.MSFT.NET Name Server: NS4.MSFT.NET Status: clientDeleteProhibited https://www.icann.org/epp#clientDeleteProhibited https://www.icann.org/epp#clientDeleteProhibited Status: clientTransferProhibited https://www.icann.org/epp#clientTransferProhibited https://www.icann.org/epp#clientTransferProhibited Status: clientUpdateProhibited https://www.icann.org/epp#clientUpdateProhibited https://www.icann.org/epp#clientUpdateProhibited Updated Date: 31-jul-2015 Creation Date: 02-sep-1996 Expiration Date: 01-sep-2016
- xeeeeeeeeeeenu 8y agoI don't know what WHOIS database are you using, but it's outdated. The real dates are: Updated Date: 2018-07-31T09:30:41Z Creation Date: 1996-09-02T04:00:00Z Registry Expiry Date: 2019-09-01T04:00:00Z
- rasz 8y ago>alpha.telemetry.microsft.com its right there with spynet2.microsoft.com and spynetalt.microsoft.com ;). Plus you have to remember W10 spy^^telemetry switches to hardcoded IPs if DNS fails.
- moviuro 8y ago> hardcoded IPs Do we have a definitive list somewhere? I'd like to block them and add them to my script [0] [0] https://gitlab.com/moviuro/moviuro.bin/blob/master/blackhole https://gitlab.com/moviuro/moviuro.bin/blob/master/blackhole
- SBArbeit 8y agoIt's probably because using microsoft.com would force every cookie from that domain to be put onto every REST call they make for sending telemetry, which would be pointless and would waste every user's outgoing bandwidth. An alternate domain that doesn't have any cookies is a better choice.
- wtallis 8y agoWhat cookies? Wouldn't Microsoft have to go out of their way to make their telemetry programs pick up and use the cookies from the user's browser?