Windows 10 telemetry network traffic analysis, part 1

VOAT ^ | 2/3/2016 | "CheesusCrust"

[Dalberg-Acton]

"Like many of you, I am concerned about the telemetry, spying and other surveillance features, known or unknown, of Windows 10. It has concerned me enough to push me to Linux Mint as my main operating system. Even so, I wanted to better understand Windows 10, but internet search results for a decent windows 10 traffic analysis leave a lot to be desired. As such, I decided to do my own investigating on what, exactly, Windows 10 is doing traffic-wise, and post the results. For this analysis, I wanted to simply analyse the network traffic of Windows 10 on a clean install, and just let it sit and run without using it."

[Dalberg-Acton]

With all Windows 10 Enterprise telemetry turned off on a clean install, it still communicates constantly with the Microsoft mother ship.

See his 30-hour update.

[Dalberg-Acton]

For your pinglist.

[spel_grammer_an_punct_polise]

Interesting. That is why I still run Win 7 and will not upgrade to Win 10. I usually wait a year or so before installing a new OS. A year gives MS time to fix bugs AND for other users to evaluate and fix spyware within the new OS.

[B212]

and so.....this explains MS’s lust to give away W10

[Skywise]

I’d be curious to see a similar study on Windows 7/8 - I use Windows 7 myself but I’ve heard Microsoft has backported the telemetry to Win 7 too (through various updates).

[tacticalogic]

All of the commenters seem to have accepted the premise that any connection attempt is for the purpose of sending user data to MS.

[r_barton]

Windows 7 upgrades in the past few months have been reported to have added telemetry to it, also.

I think Microsoft is pushing and giving away Windows 10 because of the up-sell ability of the Microsoft Store embedded in Windows 10.

The Apple store and Google store make a lot of money on mp3’s, videos, games, etc for those companies and Microsoft wants in on that action.

[upchuck]

Article best summed up by this comment:

Setting all the Windows 10 privacy option so you are most secure doesn't work. They're getting lots of data from you and you can't stop it if you use Windows.

[PAR35]

I *think* it will cut down on the volume of traffic, (but probably not actual data mined) if you set it up like you have a metered connection.

[PAR35]

The apps aren’t the product to be sold. The users are the product to be sold.

[r_barton]

One complaint is that you can no longer block unwanted contacts from requesting you join them on Skype.

Someone suggested that Microsoft protects minors from contact. So setting your Skype profile to say you are 14 years old does work to block unwanted contacts. Tried it and this does seem to work.

I wonder if there is some setting in Windows 10 to say you are 14 years old. Maybe Microsoft would then back off with the telemetry.

[The Antiyuppie]

Microsoft is definitely working on giving themselves a black eye. This type of behavior will simply push more people to OSX or Linux. As it is, some European governments have gone all open-source because of well-founded suspicions. Now, I don’t for a second believe that Linux is inherently more secure, but with lots of eyeballs on the source code, the chances of sneaking something in undetected is small. Windows (any version) is a black box that you just have to “trust”.

[msgt]

Found on /.:

I read TFA, the guy is an idiot and screwed up the test.

He configured the router to drop all connections. So Windows tries to access Windows Update, and it fails. So it tries the next server on the list, which fails. Strange, the interface has an IP address, try the next one...

Windows also has this thing called the Out Of Box Experience. It’s been there since at least 98, probably before. The first time you log in, it runs a few things so you can choose your preferences and set important stuff up. If you ignore it, it will carry on looking for updates from the Windows Store, updates for live tiles in the start menu etc.

Every OS enables a load of crap by default. This is not surprising at all.

Unlike the guy in TFA, I bothered to do this properly. If you disable everything and don’t use Windows Store apps then the only traffic is to Windows Update.

[Dalberg-Acton]

I disabled the upgrade, so it’s probably not an issue.

[MV=PY]

“I think Microsoft is pushing and giving away Windows 10 because of the up-sell ability of the Microsoft Store embedded in Windows 10.”

+1

[kiryandil]

Unlike the guy in TFA, I bothered to do this properly. If you disable everything and don't use Windows Store apps then the only traffic is to Windows Update.

Is it true you can't opt out of Windows Update in 10?

[KarlInOhio]

I just bought a Windows 10 computer a few days ago. Just about every privacy option defaulted the “wrong” way. “Can I send usage information to Microsoft?”, “Can I get web page recommendations from Microsoft?”, “Can I turn on my camera and watch you while you sleep?”. Please, just give me a big “Don’t spy on me” button.

[Bob434]

[[This type of behavior will simply push more people to OSX or Linux.]]

Yeah but not enough to where they actually give a crap- adobe did the same dang thing- forcing users who wanted to upgrade into a monthly payment- there was loud protests t first, but they simply waited it out, and ignored it- because they don’t give a crap- monthly payments is a huge golden goose for them- I predict MS will move to this platform as well

[Gideon7]

I recently upgraded to the latest edition of Visual Studio, Visual Studio 2015. It requires that all of your apps link with two big new libraries called ucrtbase.dll and vcruntime140.dll. You must ship it as part of your app’s setup procedure for your app to run on pre-Windows 10 systems. The DLLs are carefully designed to be compatible with all versions of Windows back to Windows XP, which is rather unusual for Microsoft to do in 2016. (BTW I’m talking about classic desktop apps here, not the new jailed WinRT apps).

The source code for ucrtbase.dll and vcruntime140.dll is shipped, which is standard for Visual Studio for single-stepping source code for debugging purposes. However, one module called telemetry.obj has its source code conspicuously missing. Visual Studio 2015 links the following code into your app (see the file VC\crt\src\vcruntime\exe_common.inl):

__telemetry_main_invoke_trigger(nullptr);

//
// Initialization is complete; invoke main...
//

int const main_result = invoke_main();

//
// main has returned; exit somehow...
//
__telemetry_main_return_trigger(nullptr)l

See what it is doing? Before your program even begins (main), the function __telemetry_main_invoke_trigger is called. After your program exits, the function __telemetry_main_return_trigger is called.

As far as I know there is no way to avoid linking these calls into every C/C++ desktop app that is built with Visual Studio 2015. They get called regardless of which edition of Windows you are running. And without source code there is no way know what they might or might not do when invoked on earlier versions of Windows.

[Dalberg-Acton]

I have been using Visual Studio 2010, but I tried the free Community Edition of Visual Studio 2015. It seems you have to use the MSDN online help libraries and you don’t get the local help libraries. I’m on satellite internet with a metered connection, so that was a deal breaker for me.
I don’t see why you would need telemetry for a “Hello World” application.