5 ms·

> In our tests, some of the Microsoft hosts detected in the Windows 10 HOSTS file include the following: www.microsoft.com microsoft.com telemetry.

> In our tests, some of the Microsoft hosts detected in the Windows 10 HOSTS file include the following: www.microsoft.com microsoft.com telemetry.microsoft.com wns.notify.windows.com.akadns.net v10-win.vortex.data.microsoft.com.akadns.net us.vortex-win.data.microsoft.com us-v10.events.data.microsoft.com urs.microsoft.com.nsatc.net watson.telemetry.microsoft.com watson.ppe.telemetry.microsoft.com vsgallery.com watson.live.com watson.microsoft.com telemetry.remoteapp.windowsazure.com telemetry.urs.microsoft.com I can see the argument for disallowing remapping Microsoft domains in the hosts file as a security precaution [0], but this seems a bit heavy handed. Oh well, there's always pihole. Edit: On second thought, how long before they just start hard coding IP addresses? [0]: https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/ https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-...

dvfjsdhgfv 6y ago
> Edit: On second thought, how long before they just start hard coding IP addresses? What would be the benefit of it? IP addresses are as easy to block as domain names, but the number of IP adresses available to them is much smaller than the number of possible domain names.
- deleted 6y ago
  [deleted]
- Mindwipe 6y ago
  > IP addresses are as easy to block as domain names, but the number of IP adresses available to them is much smaller than the number of possible domain names. Is it? If they wanted to be toxic they could mix the telemetry IPs around with the windows update IPs inside a fairly significant block of IPv6 addresses. It would be hard to block the entire range because you'd hit the update servers.
- DoctorOW 6y ago
  Yeah but the point of this from an anti-virus point of view is to prevent redirects. Easier to redirect a domain name via DNS than an IP address.
matoro 6y ago
They already do that. If you block these domains at the DNS level it will just skip the DNS lookup and talk to them directly by IP.
- spyder 6y ago
  Can you block them with the windows firewall? Would not trust that 100% but I'm curious if they allow it.
  - bserge 6y ago
    Well, I see compattelrunner.exe blocked in Windows Firewall (I use Malwarebytes Firewall Control in interactive mode and block/allow stuff manually), so it's likely working :D
- nominated1 6y ago
  Not that I don’t believe this is happening, but I’d love to see the Wireshark logs proving this.
slg 6y ago
>I can see the argument for disallowing remapping Microsoft domains in the hosts file as a security precaution [0], but this seems a bit heavy handed. This is a crucial point here. I would be curious to see a list of Microsoft sites that you are allowed to redirect in the HOSTS file. Having a more complete list of protected/unprotected domains would give us a better indication if this is an overly aggressive attempt to protect users from legitimate threats or a malicious attempt to protect Microsoft's access to users’ data. Because blocking redirects on microsoft.com certainly seems smart, but blocking redirect of telemetry.remoteapp.windowsazure.com seems suspicious.
- ufmace 6y ago
  I'm sure there's plenty of hackers, government agencies, etc that would just love to redirect telemetry from specific targets' Windows computers to servers they control. Not to say that it going to Microsoft is necessarily that much better, or that they may have deliberately also sabotaged people trying to redirect it to localhost, but still, it's a thing.
  - dividedbyzero 6y ago
    But could they? Verifying the host on the other end is the real deal doesn't appear to be too hard. I would be surprised if Microsoft relied solely on plain DNS for that.
  - abiogenesis 6y ago
    This is what technologies like TLS and certificate pinning are for. Watching the hosts file is only meant to be a nuisance for the end user.
- Causality1 6y ago
  Considering how Windows 10 until very recently pitched an absolute fit when the user tried to change the default browser away from Edge, I'm gonna go with the latter.
ryan29 6y ago
> Edit: On second thought, how long before they just start hard coding IP addresses? I think it’ll eventually go to DoH with hard to block IPs (ex: Cloudflare IPs are tough to block because you break too much stuff). I’ve always believed a large part of the push for TLS, DoH, eSNI, etc. is to eliminate our ability to filter network traffic. It’s sold as a freedom thing, but I’m sceptical.
- pas 6y ago
  If Windows will hard-code IPs, there will be tools to patch them out. And simply not using Windows is a very real possibility too, even if there are obvious inconveniences with going down that route (either OSX or Linux). That said TLS and other network security features are fundamental building blocks, but obviously in oppressive regimes where they stand out they have also the potential to bring the most value. And in parts of the world where network censorship is not a problem, there the features might benefit greedy corporations in a quasi-oligopoly a lot more than the users. But that's not necessarily an argument against these features.
  - AstralStorm 6y ago
    Patching Windows code will break updates and will definitely be flagged as risk. You would have to black hole the IPs on the router, as even Windows Firewall might not have the authority.
    - pas 6y ago
      The risk thing will be patched out too, naturally, I assume, just as with game cracks. And yes, the updates will just restore everything, scream and scold the user. So there will be users that don't update ...

dvfjsdhgfv 6y ago

> Edit: On second thought, how long before they just start hard coding IP addresses? What would be the benefit of it? IP addresses are as easy to block as domain names, but the number of IP adresses available to them is much smaller than the number of possible domain names.

deleted 6y ago
[deleted]
Mindwipe 6y ago
> IP addresses are as easy to block as domain names, but the number of IP adresses available to them is much smaller than the number of possible domain names. Is it? If they wanted to be toxic they could mix the telemetry IPs around with the windows update IPs inside a fairly significant block of IPv6 addresses. It would be hard to block the entire range because you'd hit the update servers.
DoctorOW 6y ago
Yeah but the point of this from an anti-virus point of view is to prevent redirects. Easier to redirect a domain name via DNS than an IP address.

matoro 6y ago

They already do that. If you block these domains at the DNS level it will just skip the DNS lookup and talk to them directly by IP.

spyder 6y ago
Can you block them with the windows firewall? Would not trust that 100% but I'm curious if they allow it.
- bserge 6y ago
  Well, I see compattelrunner.exe blocked in Windows Firewall (I use Malwarebytes Firewall Control in interactive mode and block/allow stuff manually), so it's likely working :D
nominated1 6y ago
Not that I don’t believe this is happening, but I’d love to see the Wireshark logs proving this.

slg 6y ago

>I can see the argument for disallowing remapping Microsoft domains in the hosts file as a security precaution [0], but this seems a bit heavy handed. This is a crucial point here. I would be curious to see a list of Microsoft sites that you are allowed to redirect in the HOSTS file. Having a more complete list of protected/unprotected domains would give us a better indication if this is an overly aggressive attempt to protect users from legitimate threats or a malicious attempt to protect Microsoft's access to users’ data. Because blocking redirects on microsoft.com certainly seems smart, but blocking redirect of telemetry.remoteapp.windowsazure.com seems suspicious.

ufmace 6y ago
I'm sure there's plenty of hackers, government agencies, etc that would just love to redirect telemetry from specific targets' Windows computers to servers they control. Not to say that it going to Microsoft is necessarily that much better, or that they may have deliberately also sabotaged people trying to redirect it to localhost, but still, it's a thing.
- dividedbyzero 6y ago
  But could they? Verifying the host on the other end is the real deal doesn't appear to be too hard. I would be surprised if Microsoft relied solely on plain DNS for that.
- abiogenesis 6y ago
  This is what technologies like TLS and certificate pinning are for. Watching the hosts file is only meant to be a nuisance for the end user.
Causality1 6y ago
Considering how Windows 10 until very recently pitched an absolute fit when the user tried to change the default browser away from Edge, I'm gonna go with the latter.

ryan29 6y ago

> Edit: On second thought, how long before they just start hard coding IP addresses? I think it’ll eventually go to DoH with hard to block IPs (ex: Cloudflare IPs are tough to block because you break too much stuff). I’ve always believed a large part of the push for TLS, DoH, eSNI, etc. is to eliminate our ability to filter network traffic. It’s sold as a freedom thing, but I’m sceptical.

pas 6y ago
If Windows will hard-code IPs, there will be tools to patch them out. And simply not using Windows is a very real possibility too, even if there are obvious inconveniences with going down that route (either OSX or Linux). That said TLS and other network security features are fundamental building blocks, but obviously in oppressive regimes where they stand out they have also the potential to bring the most value. And in parts of the world where network censorship is not a problem, there the features might benefit greedy corporations in a quasi-oligopoly a lot more than the users. But that's not necessarily an argument against these features.
- AstralStorm 6y ago
  Patching Windows code will break updates and will definitely be flagged as risk. You would have to black hole the IPs on the router, as even Windows Firewall might not have the authority.
  - pas 6y ago
    The risk thing will be patched out too, naturally, I assume, just as with game cracks. And yes, the updates will just restore everything, scream and scold the user. So there will be users that don't update ...