Microsoft backports data slurp to Windows 7 and 8 via patches (Win 10 spyware comes to 7, 8.1)

The Register ^ | Sep 1, 2015 | Andrew Orlowski

[dayglored]

We recently mused, half seriously, whether the entire point of the Windows 10 upgrade was to harvest your personal information. With Microsoft suffering from a serious case of Google envy, perhaps it felt it had some catching up to do.

Now Microsoft is revamping the user-tracking tools in Windows 7 and 8 to harvest more data, via some new patches.

All the updates can be removed post-installation – but all ensure the OS reports data to Microsoft even when asked not to, bypassing the hosts file and (hence) third-party privacy tools. This data can include how long you use apps, and which features you use the most, snapshots of memory to investigate crashes, and so on.

The updates are KB3068708 ("Update for customer experience and diagnostic telemetry" and mandatory) KB3075249 ("Update that adds telemetry points to consent.exe in Windows 8.1 and Windows 7") and KB3080149 (also an "Update for customer experience and diagnostic telemetry", both optional).

The notes explain that diagnostic telemetry data is sent to settings-win.data.microsoft.com (64.4.54.253) over SSL. Privacy advocates note that the OS is hardwired to use that hostname, so trying to override the IP address it resolves to using your PC's hosts file won't work.

The tools relate to Microsoft's CEIP ('customer experience improvement program')...

[zeugma]

You’ll have to do that from your router; multiple reports say these telemetry programs have hard-coded IPs AND they bypass both the OS firewall and the hosts file.

actually, that's what I meant. Though in my case, i can blacklist it from the host that is running the windows VM as well with iptables.

[zeugma]

Thinking about blocking outgoing/incoming for 64.4.0.0/18 at the router as well. That would work pretty well.

[catnipman]

“Thinking about blocking outgoing/incoming for 64.4.0.0/18 at the router as well. That would work pretty well.”

btw, ghacks has changed their mind about the effectiveness of using the OS firewall for blocking these addresses:

http://www.ghacks.net/2015/08/28/microsoft-intensifies-data-collection-on-windows-7-and-8-systems/

[Cicero]

Thanks for that information.

[timestax]

ping

[Moltke]

bmfl