sneaky spyware hidden in Windows Update - GoFuckYourself.com

nata25 · 03-07-2003, 06:22 AM

Windows Update spies on your XP box and sends information about your installed software back to the MSFT Death Star. Best of all, this was discovered by sniffing the "secure" SSL protocol that MSFT uses to communicate. How? By exploiting an undocumented API in MSFT's own system.

Evidence obtained by German hardware site tecChannel suggests a list of software installed on an XP machine is sent to Microsoft when users run Windows Update. When patches are downloaded, a few kilobytes of data are sent in the opposite direction over a secure SSL channel. Because the data is encrypted a simple packet sniffer can't be used to see what this data contains. However tecChannel's tecDUMP utility takes advantage of an undocumented WinInet API, enabling an examination of the data before it becomes encrypted. According to tecChannel, the information sent to Microsoft includes details of all the software installed in a machine, not only Microsoft applications.
http://www.securityfocus.com/news/2746

funkmaster · 03-07-2003, 06:33 AM

thanks for the info, I downgraded to win3.1

dchottie · 03-07-2003, 10:22 AM

I wondered why I was getting all the fucking popups but yet was unable to detect any spyware or trojans or such with my software. So has anyone heard how to get rid of it? Now I kow why I hate XP! ! !

Jizzman · 03-07-2003, 10:24 AM

Quote:

Originally posted by funkmaster
thanks for the info, I downgraded to win3.1

don't you mean upgrading

blazi · 03-07-2003, 10:29 AM

I knew about this before it even hit the media...

little do most people even know, the Internet has been around since 1969... started with 4 networks called the Arpanet, used only for military purposes... if you only knew the half of what Microsoft was up to!!

Spunky · 03-07-2003, 10:34 AM

I tried to get rid of them fucking things and more and more pop ups come to each site I surf.I tried that adaware and it finds 100 of the bastards and removes them only to have them come back....arrrgghh. I also have pop up stopper which helps alot.
I use win xp pro also

blazi · 03-07-2003, 10:35 AM

good thing is, even though Microsoft gets a lot of critisizm, what they're up to is not really bad at all... a very smart company!

plexer · 03-07-2003, 10:37 AM

I always thought that to be true!

amber438 · 03-07-2003, 10:45 AM

Interesting stuff, aint it..
I was a network engineer for the army from 1997 - 2000..we had some stuff then..
anyway, I have zone alarm and trojan, pest and spyware remover programs I use daily..not to mention windows washer..
interesting that windows explorer and generic host processes for win 32 both need internet access..wonder why..??

try to block them with a firewall..

iroc409 · 03-07-2003, 10:47 AM

i should finish up the unix box, and then put all the windows machines behind a hardware firewall and block ssl

then i can just ssl anywhere i need to from the *nix box

Damian_Maxcash · 03-07-2003, 10:57 AM

ok, so u make the most popular porn site of its kind.

This site is so popular that when u post a new pic, everyone pays extra to get it.....

What do you do?

iroc409 · 03-07-2003, 11:01 AM

03/07/2003 11:40:18 Allowed UDP Outgoing xxx.xxx.xxx.xxx 137 xxx.xxx.xxx.xxx 137 C:\WINDOWS\System32\ntoskrnl.exe 3 03/07/2003 11:39:13 03/07/2003 11:39:15 GUI%GUICONFIG#SRULE@NBENABLEYOU#ALLOW-UDP
this part of what you're talking about?

03-07-2003, 06:22 AM	#1
nata25 Confirmed User Join Date: Feb 2002 Posts: 240	sneaky spyware hidden in Windows Update Windows Update spies on your XP box and sends information about your installed software back to the MSFT Death Star. Best of all, this was discovered by sniffing the "secure" SSL protocol that MSFT uses to communicate. How? By exploiting an undocumented API in MSFT's own system. Evidence obtained by German hardware site tecChannel suggests a list of software installed on an XP machine is sent to Microsoft when users run Windows Update. When patches are downloaded, a few kilobytes of data are sent in the opposite direction over a secure SSL channel. Because the data is encrypted a simple packet sniffer can't be used to see what this data contains. However tecChannel's tecDUMP utility takes advantage of an undocumented WinInet API, enabling an examination of the data before it becomes encrypted. According to tecChannel, the information sent to Microsoft includes details of all the software installed in a machine, not only Microsoft applications. http://www.securityfocus.com/news/2746 __________________ Web Design ~ Paysite Software ~ Cash STABILITY & RESPONSIBILITY: OVER 15 YEARS IN THE INDUSTRY

03-07-2003, 10:22 AM	#3
dchottie Confirmed User Join Date: Feb 2003 Posts: 894	I wondered why I was getting all the fucking popups but yet was unable to detect any spyware or trojans or such with my software. So has anyone heard how to get rid of it? Now I kow why I hate XP! ! ! __________________

03-07-2003, 10:29 AM	#5
blazi Confirmed User Join Date: Feb 2003 Location: Closer now Posts: 4,321	I knew about this before it even hit the media... little do most people even know, the Internet has been around since 1969... started with 4 networks called the Arpanet, used only for military purposes... if you only knew the half of what Microsoft was up to!! __________________ makingcoin.com - 100% payouts coinscuties.com

03-07-2003, 10:34 AM	#6
Spunky I need a beer Industry Role: Join Date: Jun 2002 Location: ♠ Toiletville ♠ Posts: 133,944	I tried to get rid of them fucking things and more and more pop ups come to each site I surf.I tried that adaware and it finds 100 of the bastards and removes them only to have them come back....arrrgghh. I also have pop up stopper which helps alot. I use win xp pro also __________________ *YOUR INFORMATION HERE*

03-07-2003, 10:35 AM	#7
blazi Confirmed User Join Date: Feb 2003 Location: Closer now Posts: 4,321	good thing is, even though Microsoft gets a lot of critisizm, what they're up to is not really bad at all... a very smart company! __________________ makingcoin.com - 100% payouts coinscuties.com

03-07-2003, 06:33 AM	#2
funkmaster So Fucking Banned Join Date: Sep 2001 Location: shell beach Posts: 7,938	thanks for the info, I downgraded to win3.1

03-07-2003, 10:37 AM	#8
plexer Confirmed User Join Date: Oct 2002 Location: NJ/AZ Posts: 1,339	I always thought that to be true! __________________ I'M FREEEEE!!!!

03-07-2003, 10:45 AM	#9
amber438 Confirmed User Join Date: Sep 2002 Location: NY Posts: 230	Interesting stuff, aint it.. I was a network engineer for the army from 1997 - 2000..we had some stuff then.. anyway, I have zone alarm and trojan, pest and spyware remover programs I use daily..not to mention windows washer.. interesting that windows explorer and generic host processes for win 32 both need internet access..wonder why..?? try to block them with a firewall.. __________________ Red Hot Galleries Red Hot Links

03-07-2003, 10:47 AM	#10
iroc409 Confirmed User Join Date: Jan 2003 Location: midwest side, yo Posts: 4,728	i should finish up the unix box, and then put all the windows machines behind a hardware firewall and block ssl then i can just ssl anywhere i need to from the *nix box __________________ <a href="http://www.iroc409.com/"><img src="http://www.iroc409.com/adv/120x60.gif" border=0></a> icq: 1 7 6 4 2 0 9 6 0 Gallery templates for ONLY $25! w00t!

03-07-2003, 10:57 AM	#11
Damian_Maxcash So Fucking Banned Join Date: Oct 2002 Location: MaxCash.com Posts: 12,745	ok, so u make the most popular porn site of its kind. This site is so popular that when u post a new pic, everyone pays extra to get it..... What do you do?

03-07-2003, 11:01 AM	#12
iroc409 Confirmed User Join Date: Jan 2003 Location: midwest side, yo Posts: 4,728	03/07/2003 11:40:18 Allowed UDP Outgoing xxx.xxx.xxx.xxx 137 xxx.xxx.xxx.xxx 137 C:\WINDOWS\System32\ntoskrnl.exe 3 03/07/2003 11:39:13 03/07/2003 11:39:15 GUI%GUICONFIG#SRULE@NBENABLEYOU#ALLOW-UDP this part of what you're talking about? __________________ <a href="http://www.iroc409.com/"><img src="http://www.iroc409.com/adv/120x60.gif" border=0></a> icq: 1 7 6 4 2 0 9 6 0 Gallery templates for ONLY $25! w00t!