Posted on

Windows 10 can carry on slurping even when you’re sure you yelled STOP

All your activity are belong to us

Updated A feature introduced in the April 2018 Update of Windows 10 may have set off a privacy landmine within the bowels of Redmond as users have discovered that their data was still flowing into the intestines of the Windows giant, even with the thing apparently turned off.

In what is likely to be more cock-up than conspiracy, it appears that Microsoft is continuing to collect data on recent user activities even when the user has explicitly said NO, DAMMIT!

First noted in an increasingly shouty thread over on Reddit, the issue is related to Activity History, which is needed to make the much-vaunted and little-used Timeline feature work in Windows 10.

Introduced in what had previously been regarded as one of Microsoft’s flakiest updates – prior to the glory of the October 2018 Update, of course – Timeline allows users to go back through apps as well as websites to get back to what they were doing at a given point.

Use a Microsoft account, and a user can view this over multiple PCs and mobile devices (as long you are signed in with that same Microsoft account). The key setting is that “Send my activity history to Microsoft” check box. Uncheck it and you’d be forgiven for thinking your activity would not be sent Redmondwards. Right?

Activity History

Except, er, the slurping appears to be carrying on unabated.

The Redditors reported that if one takes a look at the Activity History in the Privacy Dashboard lurking within their account, apps and sites are still showing up.

The fellows over at How To Geek have speculated the issue may be something to do with Windows’ default diagnostic setting, which is set to Full and will send back app and history unless changed to Basic. Of course, Windows Insiders have no option but to accept Full, although a bit of slurping is likely to be the least of their problems.

A thread at TenForums has also provided a guide to turning the thing off, ranging from tinkering with Group Policies through to diving headlong into the Registry. Neither are options likely to appeal to users who would expect that clearing the “Send data” box would stop data being sent.

Deliberate slurpage, or a case of poor QAand one team not talking to the other aside, it isn’t a great look for Microsoft and users are muttering about potential legal action. Privacy lawyers will certainly be taking a close look – after all, the gang at Redmond are already under scrutiny for harvesting data and telemetry from lucky users of Windows 10.

Google has been on the receiving end of a sueball for slurping location data from user’s phones and providing an over-complicated way to turn off the “feature”.

It is all a bit of a mess and has left users unsure of what is being collected and when. We have contacted Microsoft to find out how it plans to deal with the situation (ideally before 2018’s privacy bogeyman, GDPR, makes an appearance) and will update if a response is forthcoming. ®

Update 13 December 16.45UTC

Microsoft got in touch to insist it is committed to privacy and transparency, but admitted there is indeed a bit of naming problem, with “Activity History” cropping up in both Windows 10 and the Microsoft Privacy dashboard.

Marisa Rogers, Privacy Officer at the software giant, told us: “We are working to address this naming issue in a future update.”

The slurpage collection is of course for your benefit and Rogers added that users have “controls to manage your data.”


Customers who viewed this item also viewed

Breaking down the Marriott data breach

Hackers Data Breach Equifax For 76 Days Before Being Discovered

The 21 biggest data breaches of 2018

Quora Website Data Breach Hits 100 Million Users

Facebook exposed up to 6.8 million users’ private photos to developers in latest data leak

Privacy Policy

Windows 10’s Built-in Antivirus Is Getting A Massive Upgrade

Goodbye to Edge: Microsoft is building a new, faster browser

Posted on

How British spies made a cyber immune system

Darktrace uses artificial intelligence to not just fix computer viruses, but to stop them before they start. It is the world’s leading machine learning company for cyber security. Created by mathematicians from the University of Cambridge, the Enterprise Immune System uses AI algorithms to automatically detect and take action against cyber-threats within all types of networks, including physical, cloud and virtualized networks, as well as IoT and industrial control systems. A self-configuring platform, Darktrace requires no prior set-up, identifying advanced threats in real time, including zero-days, insiders and stealthy, silent attackers. Headquartered in San Francisco and Cambridge, UK, Darktrace has 30 offices worldwide.


Customers who viewed this item also viewed

Nicole Eagan, Darktrace CEO, speaks at Hong Kong RISE: ‘When AI attacks’

5 Key Benefits of Computer-Integrated Manufacturing

FREE TRIALS

Executive Team

 

 

Posted on

Protect DNS traffic from malware and related malicious activity

5 Ways To Monitor and Protect DNS Traffic For Security Threats

Check out these examples of how to implement real-time or offline traffic monitoring using common commercial or open source security products. Says Dave Piscitello VP Security, ICANN

In Monitor DNS Traffic & You Just Might Catch A RAT, Dave Piscitello described how inspecting DNS traffic between client devices and your local recursive resolver could reveal the presence of botnets in your networks. Today, he will share how you can monitor traffic using security systems and name resolvers you may already have deployed.

https://support911.net/products/data-breach-prevention-and-protection/

Firewalls

Let’s begin at the most prevalent security system: your firewall. All firewalls should let you define rules to prevent IP spoofing. Include a rule to deny DNS queries from IP addresses outside your allocated numbers space to prevent your name resolver from being exploited as an open reflector in DDoS attacks.

Next, enable inspection of DNS traffic for suspicious byte patterns or anomalous DNS traffic to block name server software exploit attacks. Documentation describing how popular firewalls provide this feature is readily available (e.g., Palo Alto NetworksCisco SystemsWatchGuard). Sonicwall and Palo Alto can detect and block certain DNS tunneling traffic, as well.

Intrusion detection systems

Whether you use SnortSuricata, or OSSEC, you can compose rules to report DNS requests from unauthorized clients. You can also compose rules to count or report NXDOMAIN responses, responses containing resource records with short TTLs, DNS queries made using TCP, DNS queries to nonstandard ports, suspiciously large DNS responses, etc. Any value in any field of the DNS query or response message is basically “in play.” You’re essentially limited only by your imagination and mastery of DNS. Intrusion prevention services in firewalls provide permit/deny rules for many of the most common of these checks.

Marriott faces backlash over data breach impacting 500 million guests

Traffic analyzers

Use cases for both Wireshark and Bro show that passive traffic analysis can be useful in identifying malware traffic. Capture and filter DNS traffic between your clients and your resolver, and save to a PCAP file. Create scripts to search the PCAP for the specific suspicious activities you are investigating, or use PacketQ (originally DNS2DB) to SQL query the PCAP file directly.

(Remember to block your clients from using any resolver or nonstandard port other than your local resolvers).

Passive DNS replication

This involves using sensors at resolvers to create a database that contains every DNS transaction (query/response) through a given resolver or set of resolvers. Including passive DNS data in your analysis can be instrumental in identifying malware domains, especially in cases where the malware uses algorithmically generated domain names (DGAs). Palo Alto Networks firewalls and security management systems that use Suricata as an IDS engine (like AlienVault USM or OSSIM) are examples of security systems that pair passive DNS with IPS to block known malicious domains.

Logging at your resolver

The logs of your local resolvers are a last and perhaps most obvious data source for investigating DNS traffic. With logging enabled, you can use tools like Splunk plus getwatchlistor OSSEC to collect DNS server logs and explore for known malicious domains.

Despite peppering this column with links to documentation, case studies, and examples, I’ve barely scratched the surface of the many ways you can monitor DNS traffic. And bear in mind that you can use several of these methods in a complementary manner. I’ve no doubt overlooked other products, services, or methods, so comment to add to these resources for your colleagues (with technical relevance, please).

Nicole Eagan, Darktrace CEO, speaks at Hong Kong RISE: ‘When AI attacks’

How British spies made a cyber immune system