Windows 8 Tells Microsoft About Everything You Install, Not Very Securely

[GreyGeek]

http://log.nadim.cc/?p=78

Windows 8 has a new featured called Windows SmartScreen, which is turned on by default. Windows SmartScreen’s purpose is to “screen” every single application you try to install from the Internet in order to inform you whether it’s safe to proceed with installing it or not. Here’s how SmartScreen works:

1. You download any application from the Internet. Say, the Tor Browser Bundle.
2. You open the installer. Windows SmartScreen gathers some identifying information about your application, and sends the data to Microsoft.
3. If Microsoft replies saying that the application is not signed with a proper certificate, the user gets an error that looks something like this.

[ATTACH=CONFIG]3608[/ATTACH]
There are a few serious problems here. The big problem is that Windows 8 is configured to immediately tell Microsoft about every app you download and install. This is a very serious privacy problem, specifically because Microsoft is the central point of authority and data collection/retention here and therefore becomes vulnerable to being served judicial subpoenas or National Security Letters intended to monitor targeted users. This situation is exacerbated when Windows 8 is deployed in countries experiencing political turmoil or repressive political situations.This problem can however get even more serious: It may be possible to intercept SmartScreen’s communications to Microsoft and thus learn about every single application downloaded and installed by a target. Here is my analysis:

[NickStone]

I've read the full article and I can understand about the privacy issue that was brought up, why should it be Microsoft's concern what software you choose to install and run?

On the other hand though I think the whole idea of "Smartscreen" is a good idea in that it should (in theory) reduce the number of malicious software from being installed on a Windows 8 computer and thereby reducing the threat of viruses from transferring from one computer to another.

But then again if it doesn't stop someone from installing software with no digital signature from Microsoft then it won't prevent that user's computer from getting infected. Now if only Microsoft could create "Smartuser" instead of "Smartscreen" it would be more effective at reducing the spread of malicious software.

[whatthefunk]

Wouldnt it be easier to maintain a local list of known malicious software that is updated when the system is updated?

[bsniadajewski]

Well, MS does have the Malicious Software Removal Tool that is updated every so often, done via Windows Update.

[woodsmoke]

Personally, IMHO, this is something that Homeland Security wanted them to do, and of course they were glad to do it so that they could see what people were using so they could just purchase it like most of the other stuff that they deliver.

woodsmoke

[Batty]

now if only microsoft could create "smartuser"

[oshunluvr]

I'm pretty sure MS has a "Smart-User Removal Tool" that runs all the time - of course. If you find it and click on it, it takes you to Distro Watch...

[erigais]

oshunluvr, i literally laughed out loud at your comment.

i give it about a month before 2 things happen.

1. Windows 8 is pirated and can easily be downloaded from a torrent site with smart screen disabled(as well as a convient backdoor for joschmo cracker)

2. Malicous programmers figure out a way to forge the smart screen certificate to allow its program to pass through and set itself and all its friends up to seem legitimate.

oh and im writing this on a vista machine at my friends house. its running slower than the last time i used it so i should probably change my password when i get home.

This is not me bashing windows(i do use it for photoshop), its just the truth.

[SteveRiley]

"Wolf, wolf!"

This feature is not new. It's a further extension of SmartScreen, a reputation service. SmartScreen first checked for known fishing attacks, then included URL checks, and then included checks for downloaded files. BTW, this last bit -- the one that's got Kobeissi's panties in a bunch -- has been around since IE9, so it isn't exactly new. Furthermore, the data is anonymized and not shared. Believe me, the Trustworthy Computing Group, to which I belonged during most of my time at Microsoft, would be all over the IE team if they had not incorporated privacy elements.

Various aspects about the article should give a reader pause. First, he mis-reports how SSL is handled, claiming that SSLv2 will be used. Although the SmartScreen server was mistakenly configured to allow SSLv2 connections, in practice this would never happen. (In fairness, he updated his article after Microsoft fixed the server.) He omits an analysis of the information that's actually collected; once again, he did publish an update. But, and most infuriating, he has to sew just a bit more doubt by raising the quesion about certificate chains. This is a systemic problem with the way heirarchy of trust works, and not at all specific to SmartScreen. This bit, alone, makes me question Kobeissi's motives.

SmartScreen covers only URLs and downloaded programs. Programs installed via other means aren't included in the reputation check. Google and Firefox also perform reputation checking, using an offline database. The tradeoff here is that the database must continually be updated.

Also, Microsoft is now responding to questions regarding the original article. Example at Softpedia.

[GreyGeek]

....
BTW, this last bit -- the one that's got Kobeissi's panties in a bunch -- has been around since IE9, so it isn't exactly new.

I knew you would respond and I am glad you did. I'm four years removed from using Windows in any significant way, and since I did not even install VB on this new Acer I, for the first time in 10 years, do not have a copy of Windows handy to check. I figured I'd post the OP to let people know what Kobeissi claims, but I am not aware of his credentials. As I've said before, my grip is with Microsoft's ethics and business practices.

Furthermore, the data is anonymized and not shared. Believe me, the Trustworthy Computing Group, to which I belonged during most of my time at Microsoft, would be all over the IE team if they had not incorporated privacy elements
.......
Also, Microsoft is now responding to questions regarding the original article. Example at Softpedia.

Thanks, Steve, that info is good to know. You're THE voice with Windows experience that I trust.

[GreyGeek]

I was curious about Kobeissi and looked him up: http://en.wikipedia.org/wiki/Nadim_Kobeissi

Activism

Kobeissi is also known for speaking publicly against Internet censorship and Internet surveillance. He was one of the earliest supporters, in 2010, of the Bradley Manning Support Network.^[5] He organized a march through Montreal in December that year in support ofWikiLeaks, ran a WikiLeaks mirror site, and hosted CHOMP.FM, a radio program on Internet activism that ran weekly on Montreal's CKUT-FM during 2011.^[6]
Controversies

Kobeissi was detained and questioned at the U.S. border by the DHS in June 2012 about Cryptocat's censorship resistance. He tweeted about the incident afterwards, resulting in media coverage and a spike in the popularity of Cryptocat.^[7][8] Kobeissi is regularly searched and questioned whenever he flies in the U.S.
In 2012, the FBI attempted to entrap Kobeissi using Sabu – an American hacker involved withLulzsec, an offshoot of Anonymous – as an undercover informant.^[10] Kobeissi responded on his blog: "To all young hackers out there – use your talents for research. Never acquiesce to anything illegal with anyone, even if they do it with you."

[SteveRiley]

I knew you would respond and I am glad you did.

When I read your original post and the article you referenced, I figured it would be wise to wait a bit for additional material to come to light, as well as find time to do my own research (alas, I've been distracted by a new Roland Fantom G8 I found for, er, a song at Best Buy, haha).

I've said before, my grip is with Microsoft's ethics and business practices.

As is mine.

You're THE voice with Windows experience that I trust.

I'm honored.

[oshunluvr]

Welcome back Steve, your absence was noted!

[SteveRiley]

Welcome back Steve, your absence was noted!

Thanks!

You know, when I'm at home, I'm often on KFN, which has come to feel like another home. But when I'm away -- as I was this week, in SF for a few days -- I feel like I miss both homes: Seattle/family and KFN. I try to keep abreast of goings on here via Tapatalk on my phone, but it isn't the same.

That said, I'm off again tomorrow, back once more to SF, this time for VMworld. Looks like it'll be very interesting. I'm planning to attend as many of the sessions on network virtualization as I can. SDN, FTW!

[SteveRiley]

Now if only Microsoft could create "Smartuser"

There is no patch for stupidity.