Security researcher accuses Microsoft of 'sneaky data mining' in Windows 10

[Batu69]

Ah, you can never get enough paranoia nowadays, can you? Security researcher Mike Patterson -- founder and CEO of security analytics organization Plixer -- says Microsoft's Windows 10 sends encrypted data from your machine every five minutes, and there’s basically very little you can do to stop it.

 

Even when he opted out of everything he could find, regarding data transfer, the OS still continued to do it. The weirdest part about it is that you can’t really determine what is being sent. The content was encrypted so that it is impossible to know what’s going out, essentially hiding this information from the end-user.

 

Patterson also said he discovered a group policy feature called Allow Telemetry, which determines how many telemetry details are being sent back to the company. The only way to eliminate this, according to Patterson, is to get Windows 10 Enterprise. Or, you can switch to another OS, I guess.

 

But Microsoft is not the only company doing this. McAffee is sending back data, and so is Plantronics, the researcher claims. "It’s unfortunate that many reputable brands are knowingly engaging in 'sneaky data mining' without providing upfront details to consumers", comments Rahul Kashyap, EVP and chief security architect at Bromium. "Moreover, it is important that users should absolutely be told -- how long this data will be stored, the security of the data and what will it be used for. Failing to comply is a breach of consumer trust. The impact of mining such user behavior can lead to users getting targeted by ads, mails, phone calls etc. and if it goes in the wrong hands -- it could lead to targeted attacks. The current trend is disturbing and cyber laws need to be enforced to protect unsuspecting consumers".

 

"This is actually a widespread problem; not only with software we install, but with many free web application as well", adds Andy Green, senior technical specialist at Varonis. "Far too many treat your data in the same way as Plantronics and McAfee. The core issue is the Terms of Service that we robotically click on. Since few of us read the Terms of Service, we as consumers are essentially signing a contract that allows the company to access behavioral and personal data. Typically, these ToS agreements say the company will not sell or share this data with third parties. That’s good. But it still means they are collecting it and there’s enough weasel language for them to get out of their claims that they restrict access. Of if you sign a ToS that allows ads, you’re now in dark area legally -- you’ve essentially given up an expectation of privacy. Consumers have some legal protections here (in the US) but often the ToS is written to get around the few relevant laws".

 

Article source

[steven36]

this is not new  here is a post about  it from 2015

http://winaero.com/blog/how-to-disable-telemetry-and-data-collection-in-windows-10/

 

Quote

 

The usage data monitoring setting can be set to Full out of the box, which is not acceptable for many users. Those users might want to turn off the data collection in Windows 10. This can be done with a Registry tweak. To disable Telemetry and Data Collection in Windows 10 Home and Windows 10 Pro, you need to do the following:

1. Open Registry Editor.
2. Go to the following Registry key:

   
   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection

3. There you need to create a new a 32-bit DWORD value named AllowTelemetry and set it to 0.

 

1. Windows privacy tweaker and there's many more that disable this on all additions of windows 10.

2.Don't seem like he done any research on the subject he researched. so hes not much of a researcher .

3. Every site i go to i read were these  haters who are misinformed spread these lies to scare people who dont know any better. they think you must have group policy for everything when you dont  all group policy does is change stuff in the registry and someone can take a snap shot of the registry  and know what too edit on all versions.  

4. if they didn't encrypt  the data they collected people who dont know how to block it like this researcher  would get hacked .

 

[SnakeMasteR]

People use 5 different tools to disable data collection and telemetry settings, yet M$ gets anyway the data they wanted in the first place. The only thing that would make it definitely stop is disconnecting from the internet. ?

[steven36]

1 hour ago, n0_risk! said:

People use 5 different tools to disable data collection and telemetry settings, yet M$ gets anyway the data they wanted in the first place. The only thing that would make it definitely stop is disconnecting from the internet. ?

Every thing collects data even when you made this post this site did so whats you're point?  Only time My pc calls home and gets by is when I reboot it calls Windows updates if i blocked  updates in my FW it wouldn't do this the rest of the time its up it dont call home at all . It would be different if it was something new but Google , Twitter  and Facebook  has been selling everyone's data to Hollywood and to0 companies  for years and people work hard too give it away for a like .

[SnakeMasteR]

The point is that blocking anything doesn't make any difference so what's your point in blocking it? That's the point of the point.

[steven36]

8 minutes ago, n0_risk! said:

The point is that blocking anything doesn't make any difference so what's your point in blocking it? That's the point of the point.

It makes a big difference if you dont block nothing its always using you're internet up I can see what my IP sniffer says and I can see when my modem is  using internet when it should not be. You got any proof  it dont make any difference ? i can show you proof it does .

[SnakeMasteR]

Your point 1. is weird, how can you state that you can disable Telemetry and Data Collection if the data submitted to M$ is encrypted anyway? Have you decrypted the data that's been sent to verify that or is it more that M$ made it in a way so that the data they want will be sent regardless, encrypted but in different scenarios than the mentioned?

[steven36]

4 minutes ago, n0_risk! said:

Your point 1. is weird, how can you state that you can disable Telemetry and Data Collection if the data submitted to M$ is encrypted anyway? Have you decrypted the data that's been sent to verify that or is it more that M$ made it in a way so that the data they want will be sent regardless, encrypted but in different scenarios than the mentioned?

Were is you're proof Mr. tinfoil hat ? of what you say. Like i said. i told you when it calls home it calls trough windows updates when i 1st boot up .

[SnakeMasteR]

There are hundreds of other possible scenarios where data can be submitted, encrypted and you would know sh1t what it is, just because you know how to use Wireshark doesn't make you any better than Mr. Patterson. No proof needed.

[steven36]

7 minutes ago, n0_risk! said:

There are hundreds of other possible scenarios where data can be submitted, encrypted and you would know sh1t what it is, just because you know how to use Wireshark doesn't make you any better than Mr. Patterson. No proof needed.

That what i figured you have no proof . I dont use Wireshark  i  dont need it my Firewall has that built  in why install stuff i don't need ? It tells my every thing that is allowed and every thing that is blocked i  can make logs and prove it .

[SnakeMasteR]

The only thing you can prove is that data is sent or not but not WHAT. That's what the topic is about, meh. What do you need proof for, OP posted it already.

[steven36]

29 minutes ago, n0_risk! said:

The only thing you can prove is that data is sent or not but not WHAT. That's what the topic is about, meh. What do you need proof for, OP posted it already.

Whats the alternative?   use Linux  they dont have no really good firewalls like Windows even  . I use both so I know . Come October  in order to get updates on older Windows you will have to take telemetry updates as well  The OP didn't prove nothing really that any Amateur has  not posted on before.  Too bad there's no researchers that really can prove anything in this filed then someone would have a real case against them.  Last person who made like they knew something about telemetry got laughed at  that posted this hype and it made the news and got called a Amateur 

 

PS: You may be safe for a year or 2 of not doing updates  but after so many unpatched vulnerabilities older windows will become Swiss cheeses  like XP is with holes all in it.

[Holmes]

No risk has a point with the encryption the researcher said in the post lots of encrypted data is going to microsoft he never mentioned if it was personal data he made the assumption it was personal data.  With that said if its not personal microsoft is using your internet bandwidth alot and giving you not much choice in dealing with the problem thats the big issue.  Im disappointed the security researcher did this and didnt think about trying to decrypt the data to see what was in it no one has yet and its disappointing.  Dont get me wrong I dont want microsoft sending data from my computer as much as they want when they want and they have attempted to give users control you can setup a metered connection in windows eight am I right or is that in windows ten.  They need to give users control over what data is sent and better control of how much data is sent period end of story.

[SnakeMasteR]

Yes he could only guess. Everyone only can guess as long as the data remains encrypted. But that doesn't mean that the researcher was bad in researching, it was just limited, the limit. It needs decryption of the data like you said to make proper claims but the researcher hasn't even made any claims, he simply demanded more data control. The possibility of personal data being sent every 5 minutes in encrypted form along other crap, at least that is what i've understood, is a own assumption. Depending on what is being sent, encryption does make sense but nobody can or should deny the possibility of personal data being part of it or claiming to be able to block with the firewall. Even if M$ decides to give more control, it still wouldn't mean anything. Only M$ will know afterall and no opt-in or out would change that.

[steven36]

8 hours ago, Holmes said:

They need to give users control over what data is sent and better control of how much data is sent period end of story.

Even windows 7 and windows 8 calls home sends data back even XP did  And Windows 10  enterprise  has the same kind opt out that is in Windows 7 and 8  and its available via the registry on all versions of windows like i showed in post #2

 

 

3 hours ago, n0_risk! said:

Depending on what is being sent, encryption does make sense but nobody can or should deny the possibility of personal data being part of it or claiming to be able to block with the firewall. Even if M$ decides to give more control, it still wouldn't mean anything. Only M$ will know afterall and no opt-in or out would change that.

 I dont even think you know much about Firewalls and the way blocking works even if the the data is encrypted my Firewall can block it and you can still see encrypted data even though you cant read what it says . Even if i let it get past my Firewall I can still see it  If you couldn't see it the researcher who seen it never would  have seen it .i been watching encrypted data from Microsoft for along time now  .And somebody  who gets paid to too do it make a statement who didn't see it tell a year latter you make a big deal of it ?

 

Everything is blocked gives a red arrow like this 

 

Everything that gets trough  gives a green arrow

 

These programs like O&O , Windows Privacy Tweaker do help  Do you think they would waste there time making them  for free if they didn't ? It cost them money to make software . They stop my Firewall from having  to block most stuff witch it can do on iit's own  .. The only way to block Microsoft 100%  would be to block windows updates too witch  Im not going too do before i sit around on system without updates i would switch to Linux all the time

 

You have no proof  a firewall cant block Microsoft  but I have proof it can . Without proof  you're  point is pointless.  Microsoft Data Collecting  is done trough exe all trough the software and if you know what you're doing its not hard to block.. If you use a shitty Firewall it wont work though. Microsoft hates the Firewall  I use they done said they did at there site they hate anything that can block them  . I deal in logic and not in contempt  prior to investigation. You point is based on he said ,she said  its not even you're  point. it belongs to someone else.  My point is from my own research and I been researching this longer than the guy they spoke about it in the OP .

[pc71520]

16 hours ago, n0_risk! said:

People use 5 different tools to disable data collection and telemetry settings,

yet M$ gets anyway the data they wanted in the first place.

It's a vicious cycle...

[steven36]

I agree to what he said too a point most people use 5 different programs and never bother to use a ip sniffer to see what gets by and what dont . That's because there lack of knowledge or they have too much trust in software at face value . After all Google, Twitter and Facebook has been selling you're  data for years . Kids use these services to try to be famous and liked by people they dont even know and they work there butt off for free to get there data harvested and these companies  get rich off them.from selling there data

 

Microsoft has became the same way they use insiders and normal users as lab rats for free and they are collecting  all kinds of money from there data its like Gold  . But some of us are not so gullible we do research and we know what gets by and what dont because we monitor it in real time. They bought Skype and LinkedIn there going around buying things to make them rich off data for years now.

 

The 1st thing people need to understand is what data harvesting is used for . It can be used by law enforcement , but really law enforcement already knows were you live unless you're in hiding ,and if you have a  history  of being in the Courts they have record of what you done and didn't do. So unless you go around committing crimes is the lest of you're worries.

 

Most of you're Data is being sold to make ads and stuff for big companies  even Movie Stars and Musicians buy data  to see how the can use it too make them more money .  I doubt very little of what Microsoft collects is being  used to make windows better but some of it is ,Most of it is sold or is used to help them figure out new ways to make more money off you're data.

 

Most of the world  dont care. they love giving there data away  , Its Hip and the In thing now days  So anyone who speaks against it are a minority and will be looked down upon by most teens and young adults now days . But old people that do this needs to go back to there roots and grow up.

 

Many people I seen on different blogs and stuff use Anonymous names and stuff when they speak out against Windows 10 i guess so the masses wont know who they are or if they decide to use it for themselves .

 

I play devil's advocate and i dont take sides . 

 

[Holmes]

You cant stop the data collection completely with allowtelemetry zero some is sent anyway like when I disabled ceip (Customer Experience Improvement Program) that didnt stop them now using my firewall could stop that (it may have stopped it I havent checked again).  I personally wouldnt mind if they removed that shit anyway.  Like I said I dont think you can stop all of it and thats what I was talking about.

[steven36]

2 hours ago, Holmes said:

You cant stop the data collection completely with allowtelemetry zero some is sent anyway like when I disabled ceip (Customer Experience Improvement Program) that didnt stop them now using my firewall could stop that (it may have stopped it I havent checked again).  I personally wouldnt mind if they removed that shit anyway.  Like I said I dont think you can stop all of it and thats what I was talking about.

Why would Microsoft remove there biggest source of Income from Windows 10?  that's not logical  they have not made any money off selling keys or PCs since 2013? No one had too buy Windows 10 but enterprise users  . Most Windows 10 users upgraded for free. .If i owned a business and i couldn't earn a profit on part of it id shut that part down ..

 

There not a bunch of open source hobbyist doing it for free that's Linux  Microsoft  stock is some the most valuable stock there is and Satya Nadella made that happen , you dont earn a profit from being liked and like him or not he earns great profits for them overall Microsoft is not just Windows they even make software for Apple phones now days.

 

But most of you guys post  is nuts you sound like a bunch of paranoid people  that think Microsoft is out too get you , they only care about getting you're money and nothing else, And you're data is money ..If you think different you're sadly mistaken  .and I thought I was a paranoid nut but now im not so sure .  this how they make most of there money.

 

1. Windows 10 is a massive ad for Windows Store-I dont have Windows store on Windows 10 or any store apps

 

2. Cortana funnels users to Bing- I have this disabled trough the registry and search blocked with a firewall.

 

3.  OneDrive is free until you use up your space - I have this disabled and it want even launch .

 

4. Office might be include- but it’s not free . The only PC i have Office on is Windows 7 and i paid for it 

 

5. I have windows tweaked and blocked down like Fort Knox  Any data they may get off Windows updates would not really be of any real value to them but maybe to make windows better.

 

6. If they cant make Money off of it useless to them . Everyone thinks Microsoft cares they dont , They let people get away with Pirating there own software and other companies software  out of fear people would switch to a Non M$ OS . Now they deiced too play Google and make a profit off all these people who never paid . Piracy is so bad in China they have factories that make bootleg copies of windows . And they have the most internet users there is.  

 

7. The reason they made it look like Steve Ballmer stepped down  is because people would not buy Windows 8 ..He was more or less forced out the door , He would of never allowed the OS  too become full of ads.  they most likely would of been Windows 10 but it would of been much different . So the way I see it was the users fault for not buying Windows 8 that they hired a snake in the grass like  Satya Nadella  and Windows 10 turned out the way it is.  He was brought to Microsoft to layoff  most  of its workers  and to downsize  and be able to churn more profit  than ever with less than half of the overhead. On the internet you are what you like and most people hated Windows 8  .. Microsoft blamed it on you in the end.

[Holmes]

I know and I dont think they fired steve I think he quit your getting into conspiracy theories now.  I remember turning off CEIP and when I looked in the logs one time it mentioned it with it turned off thats what I I was talking about.  Like I said before Im very disappointed that the encrypted data hasnt been decrypted yet that pisses me off.

[steven36]

17 minutes ago, Holmes said:

I know and I dont think they fired steve I think he quit your getting into conspiracy theories now.  I remember turning off CEIP and when I looked in the logs one time it mentioned it with it turned off thats what I I was talking about.  Like I said before Im very disappointed that the encrypted data hasnt been decrypted yet that pisses me off.

.Have you ever heard of being handed  a ultimotive ? Same thing happen to Nixon to keep him from being impeached .  It does no good too be pissed off  if my data was going trough there not encrypted for hackers to see I would be more worried .  Only thing you can do is if they do something you dont like is use something else. No one twist you're arm and made you come online. My data is always encrypted   im behind a VPN most of the time unless im doing something  that i need to be off it.

[Holmes]

Are you trying to say Ultimatum and yes I have heard of it (by saying that Im not attacking you i wanted to verify thats what you said).  I want my data encrypted I wish someone would decrypt the data microsoft is sending to see if it contains personal information thats all.  I have a vpn to and use it when I want my information encrypted to.

[steven36]

27 minutes ago, Holmes said:

Are you trying to say Ultimatum and yes I have heard of it (by saying that Im not attacking you i wanted to verify thats what you said).  I want my data encrypted I wish someone would decrypt the data microsoft is sending to see if it contains personal information thats all.  I have a vpn to and use it when I want my information encrypted to.

Steve Ballmer was actually fired, sources say. So what now?

http://www.computerworld.com/article/2474644/microsoft-windows/steve-ballmer-was-actually-fired--sources-say--so-what-now-.html

if you say what i say is a conspiracy theory .  Then this topic must surely be one about this researcher in the OP   is because   computerworld is much better site than betanews  .. Betanews mostly do short news post  without posting the whole story .too get readers to fight in the comments for hits they wrote so much bad stuff about Windows 10 that  its coming out of  there ears.  Only 2 sites I know of even touched this about Mike Patterson . Most stuff posted about windows 10 is posted everywhere .Most didn't think the Mike Patterson stroy to be even news . If i would of not been on Nsane  and seen it I would of never seen it.  I go to ZDNet  and Computerworld  and there sister sites to read the PC news mostly . I dont like reading news that was wrote to be negative just to start a fight to  get a lot of views and comments to me that's not real journalism.   

[straycat19]

21 hours ago, steven36 said:

You may be safe for a year or 2 of not doing updates  but after so many unpatched vulnerabilities older windows will become Swiss cheeses  like XP is with holes all in it.

 

That is an outright falsehood.  I have systems that haven't had an update since SP1 was installed.  They are more secure than any standard updated system on the internet.  As far as firewalls go, you start by blocking everything and then little by little configure what you want to get thru.  If you can't read it or identify it then it doesn't get thru.  I would never trust a system that someone else setup or provided 'expert advice' on securing it.  Instead I trust my 49 years experience in computers.

[Holmes]

Where is these sources at post a link?  What now?  Why did you make that comment are you feeling five years old I dont care about what now if you provide me proof that steve ballmer was fired then Ill be like ok he was fired so what this isnt a im right your wrong conversation lawls.  I asked about if he was fired or not i dont think he was if he was i want the proof.