6 ms·

They disabled windows update because it is spyware? Are they providing their own filtered update channel?? Ok, so PSA: if you don't want "Spyware" don't use wi

by _8j50 5y ago

They disabled windows update because it is spyware? Are they providing their own filtered update channel?? Ok, so PSA: if you don't want "Spyware" don't use windows. In Forensics, you learn there are many many ways windows tracks what you do, some of which can be disabled but it is all architectures into the OS. If you looked at a specific folder in explorer, that can be proven in court, executed a specific program? At least 4-5 ways come to mind . Take a peek at c:\windows\system32\winevt\logs\ (equivalent of /var/log/) and that's just one place. I mean the spyware has measurable and valuable security benefits. If you wanna really test your malware dev skills, leave cloud submission turned on Defender and write any basic malware (harmful not just undesirable) and avoid detection for longer than a day. It was very hard when I tried it (for legit purposes). I bash on Linux because of all its problems (only because I love it and want to see it improve) but if you want privacy, use Linux, the cliche holds true. You can always use windows in vbox+seamless mode for most things or on a separate device if you can afford it.

dazhengca 5y ago
How would looking at a specific folder in explorer be proven in court?
cm2187 5y ago
Not defending this thing, but logging events and uploading them to the mothership are two very different things. To your own admission /var/log on linux.
- _8j50 5y ago
  Depends on your definition I suppose. The fact that it is sitting there to be accessed by any program is a problem for some but I agree, sending it over the network is what most people worry about. Most evtx logs are not sent to the "mothership" but other telmetry and security logs like defender logs might be by default. There is also cloud submission which sends MS random suspect files for analysis. Also, closed source means it is hard for me to be sure which of those logs are sent to MS.
  - jve 5y ago
    I'd have to check, but I'm pretty sure particular logs are NOT accessible by Builtin\Users. Particularly Security log. But comparing logging to spyware is nuts. Event logs are just one of endpoints for event tracing mechanism and event viewer is just one crappy UI for that. You can turn on/off various logging to your hearts desire, including various diagnostic/tracing info. You can go all the way to capture stack traces, cpu context switches and whatnot. Windows is pretty configurable in this regard. Also telemetry is well documented and configurable: https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization https://docs.microsoft.com/en-us/windows/privacy/configure-w... Defender doesn't hide option for cloud based scanning and it is up-front in settings. I dunno if it is enabled by default or not, but in our org, we had to explicitly rollout changes to enable it (we are pretty locked down by default)
    - _8j50 5y ago
      First, I never said any of this was hidden or in secret. Second, event logs are just one of many places where activity is tracked. Most of them are harmless but many will keep a record of what is being done on the system in a way that isn't obvious to the user of the system. Lastly, installed programs don't need to be builtin\users they can run elevated or in any group, you are assuming only accidentally opened programs are risky? The subject here is personal use, not corporate use. For example you might torrent a movie and then uninstall the torrent application, files and downloaded content. If you get sued and (i know it is rare) your windows install is submitted as evidence it can be proven that you executed the torrent program, the torrent program transferred so many bytes and that you opened the folder of the torrented content without looking at any file directly related to the torrent app or windows event logs. Or let's say you downloaded content from a site but then cleared your browing history and uninstalled your browser. Thanks to motw the downloaded files on your pc show the sites frol where you downloaded them and the referrer that lead to you visiting the download link. These are only some examples.
      - jiggawatts 5y ago
        Most operating systems log things —- it’s a feature. Most consumer software collects telemetry —- irrespective of platform. Have a look at what a typical Android phone sends out! Including your GPS location! Apple isn’t immune either because the Facebook SDK that’s included with everything would make the NSA blush. TikTok even tracks your phone motion sensor. IMHO raging about 30-year old diagnostic features is misplaced anger. Be angry about how every piece of software now goes through these stages: 1) Opt-out telemetry only collecting the important stuff, we promise! 2) Okay, collecting it synchronously was a mistake and it slowed down everything for everyone that’s not sitting in our head office. We fixed it though, don’t worry! 3) Umm.. apparently some people are behind corporate web proxies which makes the async code leak threads and melt CPUs. We fixed it though! 4) Some people have used the newly added proxy support to inspect the encrypted blob. We promise that it was an honest mistake collecting every single point of information we possibly could about your system including mouse movements and key presses. Don’t worry, we fixed it! We now “anonymise” the information. Don’t worry about why that’s in quotes. 5) Those socialist Europeans sued us when we said we deleted their data but it was still there when they reactivated their accounts. Oopsie! Our bad. We promise to “wipe” your data including telemetry when you request this form. Fill it out in triplicate and fax it to this Cayman Islands number please. 6) We can no longer sell our software in some jurisdictions. Don’t ask why or what that implies about how we treat our customers in other jurisdictions with weaker legal protections.
heyoni 5y ago
Some of us have windows just to play games, sometimes on our tv’s with a controller but that’s impossible when you have garbage popping up constantly. There’s definitely a demand for windows that can play games and do nothing else.
- AQuantized 5y ago
  Proton is incredibly impressive nowadays, even when dealing with highly invasive anticheat services. I think there are only a small handful of games in my steam library where it doesn't work well. Within 5 years I think most of the remaining friction to gaming on linux will be gone.
  - heyoni 5y ago
    It's what I'll probably end up doing when I have the energy but my wife is a bit techphobic and enjoys playing some games since setting up the PC on the TV but will abandon everything if linux starts getting in the way :D
    - yjftsjthsd-h 5y ago
      Will she abandon everything if Windows starts getting in the way?
  - alpaca128 5y ago
    Yes, but like always this is dependent on hardware and drivers. Which is a reason I'm excited about the Steam Deck and potential future devices. Hardware built by Valve has most likely the best compatibility.
- mdoms 5y ago
  It's "impossible" to play games on Windows because "you have garbage popping up constantly"? Sorry what are you talking about? I, like millions of people, play games all the time on my Windows PC and don't encounter this problem. It's most certainly not "impossible". > There’s definitely a demand for windows that can play games and do nothing else. It's called a "games console". Microsoft makes one called XBox.
getcrunk 5y ago
Can you give some more examples of the file browsing tracking ? I have timeline off
- _8j50 5y ago
  Checkout amcache and shimcache, recent files, bam/dam. https://andreafortuna.org/2017/10/16/amcache-and-shimcache-in-forensic-analysis/ https://andreafortuna.org/2017/10/16/amcache-and-shimcache-i...
- assttoasstmgr 5y ago
  Object access auditing has been around in NT since the mid-1990s, if not from the beginning. It's not some secret spyware, it is literally a feature that is widely used and is a requirement for high-security environments (e.g. government systems) when you need to be able to log or prove if someone did or did not access some sensitive information. E.g. insider threat scenario. https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-object-access https://docs.microsoft.com/en-us/windows/security/threat-pro...
  - _8j50 5y ago
    Others also seem to think I am pointing out some secret feature. None of this is a secret, just not obvious to people who didn't think to look for it. Defaults matter.
  - jiggawatts 5y ago
    It’s off by default! (Only the domain controllers enable a subset of it.) You can make it log everything, but the performance hit is noticeable. Next thing you’re going to start complaining about dtrace spying on you.
- deleted 5y ago
  [deleted]
- OminousWeapons 5y ago
  You have to register to see it, but this is a SANS poster which summarizes common Windows forensic artifacts and what data can be obtained from them: https://www.sans.org/posters/windows-forensic-analysis/ https://www.sans.org/posters/windows-forensic-analysis/
xcmac 5y ago
Your comment is Interesting to me Im a Dev. But outside of reversing games for hacks and cheats I havent done anything with Windows specifically. Any links, books, articles, etc.. you can provide to learn more about this?
IYasha 5y ago
History clearly shows us about tenth of all updates from Microsoft are bogus, if not malicious. I only install those I downloaded and checked manually.
- _8j50 5y ago
  Maybe automatic update, but entirely?
MrStonedOne 5y ago
forgotmypw17 5y ago
I don't agree that not keeping up with Windows Update is always a security risk, if one is behind NAT and only browses trusted websites (which rules out webmail, BTW.) I do agree that trying to make a consensual OS out of Windows is an uphill battle. If you're stuck using it, however, for whatever reason, a patchkit like this is better than nothing.
- jve 5y ago
  Good luck if there is any single malicious device on your network. Good luck if explorer previewed wrong file. Good luck if trusted website has been hacked and serves malicious content. Good luck if you do npm install.
  - forgotmypw17 5y ago
    I would not do any of those things.
- _8j50 5y ago
  You can disable auto update and manually check/approve. Standard enterprise practice too.
Bancakes 5y ago
"Just don't use windows" is not a solution. Ameliorated works, whether you believe in security whataboutism or not.
- _8j50 5y ago
  It's not whataboutism. Windows has a ton features spanning decades and privacy was never a priority given their paying customers' priority. Linux on the other hand was made by individuals and allows a lot more control and input from users. If privacy is your priority then Linux wind the race. If managable corporate workstation is your priority then windows wins the race.
  - Bancakes 5y ago
    And these scripts allow me to mold Windows into something more usable, no need to jump ship.
myk9001 5y ago
>> If you looked at a specific folder in explorer, that can be proven in court, executed a specific program?... You'll find most if not all of these in `.bash_history`, wouldn't you? Probably, it's possible to setup an install of Linux in such a way, that the user won't leave any traces in the system, but this is definitely not the default behavior. And the system setup in this way is likely a pain to use. But if you have a specific need, by all means, go for it. After all, with Linux you're in control. But saying Windows is spyware because it logs your activity locally is stretching it.
- _8j50 5y ago
  The OP called it spyware, not I. I pointed those out as examples of what artifacts windows logs. Bash_history much like your browing history you can clear it and be done with it. But due to the seemingly endless subsystems (new ones get discovered all the time, see my other replies) if you clear security.evtx and your browsing history there are still many reliable (as in court tested) artifacts that can prove you browsed specific sites and ran specific programs. I don't know how much of this MS collects and anyone who says they do, I would challenge them for evidence because there are many plausibly deniable and benign reasons to extract this information from the host. I would say at best windows is spyware-friendly. If I workes for the CCP and was instructed to get a list of people that used Signal so they can be sent for re-education, I would not even look to see if Signal.exe is installed in windows, I would just check prefetch and srum.
JoeMamaAME 5y ago
I do agree removing Windows Update does pose some security risk, however I don't think said risk is nearly as bad as some make it out to be, and I personally think the benefits of Windows Ameliorated greatly outweigh any security downsides. Spyware is not the same as local system logs. Spyware in this case is software that sends unnecessary or intrusive information to Microsoft. The goal of Windows Ameliorated is to remove spyware, not prove your innocence in court. You used Windows Defender as an example of a security benefit. There are alternatives to Windows Defender, and IMO If you're a tech literate power user, an AV isn't useful in most cases. If you have the time, consider reading this: https://wiki.ameliorated.info/doku.php?id=antivirus https://wiki.ameliorated.info/doku.php?id=antivirus Personally I believe antivirus software in general does more harm than good, as they are generally quite resource hungry and privacy intrusive. Also, AME does greatly help to mitigate the attack surface of Windows: Windows Ameliorated ships with a non-administrator user account by default, which mitigates ~70% of Windows vulnerabilities. (Source: https://web.archive.org/web/20210618023509/https://www.beyon https://web.archive.org/web/20210618023509/https://www.beyon...). Of course you can still do admin actions, it just requires the admin password.
- crtasm 5y ago
  Your source link has been truncated.
  - JoeMamaAME 5y ago
    Thanks for letting me know. Here's a shorter link that hopefully works: https://www.beyondtrust.com/assets/documents/BeyondTrust-Microsoft-Vulnerabilities-Report-2021.pdf https://www.beyondtrust.com/assets/documents/BeyondTrust-Mic...
logifail 5y ago
> Are they providing their own filtered update channel?? You can even update Windows offline if you want to.[0] It's quite refreshing to be able to prep a USB stick containing all the updates for a clean install of a certain build of Windows and be able to deploy them without needing to connect to the internet. [0] https://download.wsusoffline.net/ https://download.wsusoffline.net/

by _8j50 5y ago

dazhengca 5y ago

How would looking at a specific folder in explorer be proven in court?

cm2187 5y ago

Not defending this thing, but logging events and uploading them to the mothership are two very different things. To your own admission /var/log on linux.

_8j50 5y ago
Depends on your definition I suppose. The fact that it is sitting there to be accessed by any program is a problem for some but I agree, sending it over the network is what most people worry about. Most evtx logs are not sent to the "mothership" but other telmetry and security logs like defender logs might be by default. There is also cloud submission which sends MS random suspect files for analysis. Also, closed source means it is hard for me to be sure which of those logs are sent to MS.
- jve 5y ago
  I'd have to check, but I'm pretty sure particular logs are NOT accessible by Builtin\Users. Particularly Security log. But comparing logging to spyware is nuts. Event logs are just one of endpoints for event tracing mechanism and event viewer is just one crappy UI for that. You can turn on/off various logging to your hearts desire, including various diagnostic/tracing info. You can go all the way to capture stack traces, cpu context switches and whatnot. Windows is pretty configurable in this regard. Also telemetry is well documented and configurable: https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization https://docs.microsoft.com/en-us/windows/privacy/configure-w... Defender doesn't hide option for cloud based scanning and it is up-front in settings. I dunno if it is enabled by default or not, but in our org, we had to explicitly rollout changes to enable it (we are pretty locked down by default)
  - _8j50 5y ago
    First, I never said any of this was hidden or in secret. Second, event logs are just one of many places where activity is tracked. Most of them are harmless but many will keep a record of what is being done on the system in a way that isn't obvious to the user of the system. Lastly, installed programs don't need to be builtin\users they can run elevated or in any group, you are assuming only accidentally opened programs are risky? The subject here is personal use, not corporate use. For example you might torrent a movie and then uninstall the torrent application, files and downloaded content. If you get sued and (i know it is rare) your windows install is submitted as evidence it can be proven that you executed the torrent program, the torrent program transferred so many bytes and that you opened the folder of the torrented content without looking at any file directly related to the torrent app or windows event logs. Or let's say you downloaded content from a site but then cleared your browing history and uninstalled your browser. Thanks to motw the downloaded files on your pc show the sites frol where you downloaded them and the referrer that lead to you visiting the download link. These are only some examples.
    - jiggawatts 5y ago
      Most operating systems log things —- it’s a feature. Most consumer software collects telemetry —- irrespective of platform. Have a look at what a typical Android phone sends out! Including your GPS location! Apple isn’t immune either because the Facebook SDK that’s included with everything would make the NSA blush. TikTok even tracks your phone motion sensor. IMHO raging about 30-year old diagnostic features is misplaced anger. Be angry about how every piece of software now goes through these stages: 1) Opt-out telemetry only collecting the important stuff, we promise! 2) Okay, collecting it synchronously was a mistake and it slowed down everything for everyone that’s not sitting in our head office. We fixed it though, don’t worry! 3) Umm.. apparently some people are behind corporate web proxies which makes the async code leak threads and melt CPUs. We fixed it though! 4) Some people have used the newly added proxy support to inspect the encrypted blob. We promise that it was an honest mistake collecting every single point of information we possibly could about your system including mouse movements and key presses. Don’t worry, we fixed it! We now “anonymise” the information. Don’t worry about why that’s in quotes. 5) Those socialist Europeans sued us when we said we deleted their data but it was still there when they reactivated their accounts. Oopsie! Our bad. We promise to “wipe” your data including telemetry when you request this form. Fill it out in triplicate and fax it to this Cayman Islands number please. 6) We can no longer sell our software in some jurisdictions. Don’t ask why or what that implies about how we treat our customers in other jurisdictions with weaker legal protections.

heyoni 5y ago

Some of us have windows just to play games, sometimes on our tv’s with a controller but that’s impossible when you have garbage popping up constantly. There’s definitely a demand for windows that can play games and do nothing else.

AQuantized 5y ago
Proton is incredibly impressive nowadays, even when dealing with highly invasive anticheat services. I think there are only a small handful of games in my steam library where it doesn't work well. Within 5 years I think most of the remaining friction to gaming on linux will be gone.
- heyoni 5y ago
  It's what I'll probably end up doing when I have the energy but my wife is a bit techphobic and enjoys playing some games since setting up the PC on the TV but will abandon everything if linux starts getting in the way :D
  - yjftsjthsd-h 5y ago
    Will she abandon everything if Windows starts getting in the way?
- alpaca128 5y ago
  Yes, but like always this is dependent on hardware and drivers. Which is a reason I'm excited about the Steam Deck and potential future devices. Hardware built by Valve has most likely the best compatibility.
mdoms 5y ago
It's "impossible" to play games on Windows because "you have garbage popping up constantly"? Sorry what are you talking about? I, like millions of people, play games all the time on my Windows PC and don't encounter this problem. It's most certainly not "impossible". > There’s definitely a demand for windows that can play games and do nothing else. It's called a "games console". Microsoft makes one called XBox.

getcrunk 5y ago

Can you give some more examples of the file browsing tracking ? I have timeline off

_8j50 5y ago
Checkout amcache and shimcache, recent files, bam/dam. https://andreafortuna.org/2017/10/16/amcache-and-shimcache-in-forensic-analysis/ https://andreafortuna.org/2017/10/16/amcache-and-shimcache-i...
assttoasstmgr 5y ago
Object access auditing has been around in NT since the mid-1990s, if not from the beginning. It's not some secret spyware, it is literally a feature that is widely used and is a requirement for high-security environments (e.g. government systems) when you need to be able to log or prove if someone did or did not access some sensitive information. E.g. insider threat scenario. https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-object-access https://docs.microsoft.com/en-us/windows/security/threat-pro...
- _8j50 5y ago
  Others also seem to think I am pointing out some secret feature. None of this is a secret, just not obvious to people who didn't think to look for it. Defaults matter.
- jiggawatts 5y ago
  It’s off by default! (Only the domain controllers enable a subset of it.) You can make it log everything, but the performance hit is noticeable. Next thing you’re going to start complaining about dtrace spying on you.
deleted 5y ago
[deleted]
OminousWeapons 5y ago
You have to register to see it, but this is a SANS poster which summarizes common Windows forensic artifacts and what data can be obtained from them: https://www.sans.org/posters/windows-forensic-analysis/ https://www.sans.org/posters/windows-forensic-analysis/

xcmac 5y ago

Your comment is Interesting to me Im a Dev. But outside of reversing games for hacks and cheats I havent done anything with Windows specifically. Any links, books, articles, etc.. you can provide to learn more about this?

IYasha 5y ago

History clearly shows us about tenth of all updates from Microsoft are bogus, if not malicious. I only install those I downloaded and checked manually.

_8j50 5y ago
Maybe automatic update, but entirely?

MrStonedOne 5y ago

forgotmypw17 5y ago

I don't agree that not keeping up with Windows Update is always a security risk, if one is behind NAT and only browses trusted websites (which rules out webmail, BTW.) I do agree that trying to make a consensual OS out of Windows is an uphill battle. If you're stuck using it, however, for whatever reason, a patchkit like this is better than nothing.

jve 5y ago
Good luck if there is any single malicious device on your network. Good luck if explorer previewed wrong file. Good luck if trusted website has been hacked and serves malicious content. Good luck if you do npm install.
- forgotmypw17 5y ago
  I would not do any of those things.
_8j50 5y ago
You can disable auto update and manually check/approve. Standard enterprise practice too.

Bancakes 5y ago

"Just don't use windows" is not a solution. Ameliorated works, whether you believe in security whataboutism or not.

_8j50 5y ago
It's not whataboutism. Windows has a ton features spanning decades and privacy was never a priority given their paying customers' priority. Linux on the other hand was made by individuals and allows a lot more control and input from users. If privacy is your priority then Linux wind the race. If managable corporate workstation is your priority then windows wins the race.
- Bancakes 5y ago
  And these scripts allow me to mold Windows into something more usable, no need to jump ship.

myk9001 5y ago

>> If you looked at a specific folder in explorer, that can be proven in court, executed a specific program?... You'll find most if not all of these in `.bash_history`, wouldn't you? Probably, it's possible to setup an install of Linux in such a way, that the user won't leave any traces in the system, but this is definitely not the default behavior. And the system setup in this way is likely a pain to use. But if you have a specific need, by all means, go for it. After all, with Linux you're in control. But saying Windows is spyware because it logs your activity locally is stretching it.

_8j50 5y ago
The OP called it spyware, not I. I pointed those out as examples of what artifacts windows logs. Bash_history much like your browing history you can clear it and be done with it. But due to the seemingly endless subsystems (new ones get discovered all the time, see my other replies) if you clear security.evtx and your browsing history there are still many reliable (as in court tested) artifacts that can prove you browsed specific sites and ran specific programs. I don't know how much of this MS collects and anyone who says they do, I would challenge them for evidence because there are many plausibly deniable and benign reasons to extract this information from the host. I would say at best windows is spyware-friendly. If I workes for the CCP and was instructed to get a list of people that used Signal so they can be sent for re-education, I would not even look to see if Signal.exe is installed in windows, I would just check prefetch and srum.

JoeMamaAME 5y ago

I do agree removing Windows Update does pose some security risk, however I don't think said risk is nearly as bad as some make it out to be, and I personally think the benefits of Windows Ameliorated greatly outweigh any security downsides. Spyware is not the same as local system logs. Spyware in this case is software that sends unnecessary or intrusive information to Microsoft. The goal of Windows Ameliorated is to remove spyware, not prove your innocence in court. You used Windows Defender as an example of a security benefit. There are alternatives to Windows Defender, and IMO If you're a tech literate power user, an AV isn't useful in most cases. If you have the time, consider reading this: https://wiki.ameliorated.info/doku.php?id=antivirus https://wiki.ameliorated.info/doku.php?id=antivirus Personally I believe antivirus software in general does more harm than good, as they are generally quite resource hungry and privacy intrusive. Also, AME does greatly help to mitigate the attack surface of Windows: Windows Ameliorated ships with a non-administrator user account by default, which mitigates ~70% of Windows vulnerabilities. (Source: https://web.archive.org/web/20210618023509/https://www.beyon https://web.archive.org/web/20210618023509/https://www.beyon...). Of course you can still do admin actions, it just requires the admin password.

crtasm 5y ago
Your source link has been truncated.
- JoeMamaAME 5y ago
  Thanks for letting me know. Here's a shorter link that hopefully works: https://www.beyondtrust.com/assets/documents/BeyondTrust-Microsoft-Vulnerabilities-Report-2021.pdf https://www.beyondtrust.com/assets/documents/BeyondTrust-Mic...

logifail 5y ago

> Are they providing their own filtered update channel?? You can even update Windows offline if you want to.[0] It's quite refreshing to be able to prep a USB stick containing all the updates for a clean install of a certain build of Windows and be able to deploy them without needing to connect to the internet. [0] https://download.wsusoffline.net/ https://download.wsusoffline.net/