Windows Update gathering info about you - Tilted Forum Project Discussion Community

RelaX · 10-17-2003, 05:01 AM

Mods please do your thing if this has been posted before (it's pretty old but I just ran across it).
Does anyone have anything more on this?

http://www.geek.com/news/geeknews/20...0226018826.htm

Quote:

Windows Update sending private data to MS
The heading on the page says it's not sending any data to Microsoft, but the researchers at tecChannel have found otherwise ... and are prepared to prove it.
--------------------------------------------------------------------------------
posted 9:43am EST Wed Feb 26 2003 - submitted by J. Eric Smith
NEWS
The difficulty of keeping up with the endless flow of patches and fixes coming from Microsoft has long been a reason for the poor security administration worldwide of its products. To address this concern, Microsoft rolled out its Windows Update service several years ago to much fanfare. Finally, ordinary users could go to a single Web page and it would download all the patches and install them automatically. What could be better?

Privacy advocates took issue, though, with the possibility for sensitive data to be passed to Microsoft during the update procedure. Microsoft's verbage on the update site indicates that no personal data is being sent to Microsoft, but German researchers at tecChannel were a bit perplexed at the amount of data flowing not into your computer from Microsoft, but out of it to Microsoft. So, they analyzed the packets to see what was going on.

As it turns out, packet analysis is useless, as the stream is encrypted via Secure Sockets Layer (SSL). However, using an undocumented Windows feature, tecChannel was able to get around this and view the raw data. The results were alarming. Embedded in the data stream were lists of what software you have installed on your PC--and not just Microsoft products. Apparently the folks in Redmond can find out just what you've got installed on your PC, all without you ever knowing about it or explicitly consenting to it.

You can head over to tecChanel.de for the full story (subscription required).

ERIC'S OPINION
You know, if Microsoft didn't have such a reputation as a ruthless, aggressive, domineering, exploitive company then perhaps such revelations as this wouldn't be so damning. But Microsoft is what it is, and its reputation is well deserved based on years of this type of conduct. While I'm sure Redmond will defend this type of behavior with some sort of legal wrangling buried deep in the EULA, the truth of the matter is it is once again treading quite heavily on the hallowed grounds of user privacy. Where I come from, we call this "stubborn arrogance." I'm not sure what they call it in Redmond.

There could be a very legitimate reason why WindowsUpdate is gathering this information. Application compatibility would be the first one I would suspect. After all, nobody wants to auto-install a patch that breaks an important piece of software. But if the reason is legitimate, why is Microsoft hiding behind the words on the WindowsUpdate home page, the ones that state no information is being sent to Microsoft? This is clearly not the case.

Conspiracy theorists among us might say that Redmond is amassing a database of who's using what, and could use that to target potential trends and competitors in the software industry. The potential for something like this is disturbing to say the least, so disturbing that I'm surprised Microsoft is being so brazen about this. Then again, this is Microsoft, and being brazen and arrogant is something it seems to have redefined for our time.

hrdwareguy · 10-17-2003, 09:25 AM

Just to play devil's advocate, this is what the Windows Update page says:

Quote:

Windows Update Privacy Statement (Last Updated 10/15/2002)
Windows Update is committed to protecting your privacy. To provide you with the appropriate list of updates, Windows Update must collect a certain amount of configuration information from your computer. None of this configuration information can be used to identify you. This information includes:

Operating-system version number
Internet Explorer version number
Version numbers of other software for which Windows Update provides updates
Plug and Play ID numbers of hardware devices
Region and Language setting
The configuration information collected is used only to determine the appropriate updates and to generate aggregate statistics. Windows Update does not collect your name, address, e-mail address, or any other form of personally identifiable information.

Windows Update also collects the Product ID and Product Key to confirm that you are running a validly licensed copy of Windows. A validly licensed copy of Windows ensures that you will receive on-going updates from Windows Update. The Product ID and Product Key are not retained beyond the end of the Windows Update session.

To provide you with the best possible service, Windows Update also tracks and records how many unique machines visit its site and whether the download and installation of specific updates succeeded or failed. In order to do this, the Windows operating system generates a Globally Unique Identifier (GUID) that is stored on your computer to uniquely identify it. The GUID does not contain any personally identifiable information and cannot be used to identify you. Windows Update records the GUID of the computer that attempted the download, the ID of the item that you attempted to download and install, and the configuration information listed above.

No personal information is gathered. Meaning your name, your company, credit card information, IP address. Getting software version information is no way personal information.

RelaX · 10-17-2003, 12:49 PM

Here is the conclusion from the original tecchannel article

Quote:

Conclusions

The details that we have documented in this article match the vague information provided by Microsoft. We believe that the biggest privacy issue with Windows Update is the list of hardware components that is transferred to the Microsoft server, which reveals the make and model of all installed PCI cards, mass storage devices, and other hardware components to Microsoft. The approach that older versions of Windows Update took was to download a complete list of updates and then filter out the relevant ones on the user's computer - without transferring any sensitive information to Microsoft. Why does the current version implement an approach that transfers the information required for the filtering from the user's computer to the Microsoft server, which then does the filtering and returns a list of updates that is tailored to the configuration of the user's computer? Bandwidth is hardly a limiting factor today and downloading a complete list of updates would probably take only a few seconds. This question therefore remains unanswered.

This does not only apply to driver updates. The server-side filtering could also be abused to determine which software is installed. Imagine that Microsoft would like to know whether you use Mozilla 1.0. It would then simply create a product category for Mozilla 1.0, e.g. mo10, add a rule for determining whether Mozilla 1.0 is installed, e.g. Mozilla 1.0 is installed if HKEY_LOCAL_MACHINESOFTWAREMozillaMozilla 1.0 exists, and return this product category when Windows Update sends a Provider-level request to the Microsoft server. If you were using Mozilla, Windows Update would then by evaluating this rule determine that the product category mo10 applies to your computer, ask the Microsoft server to list the products by sending a Product-level request for mo10, and reveal in this way that you use Mozilla 1.0.

New product categories could also be used for more benign reasons. They make it technically very easy to open Windows Update to other software vendors. As Microsoft is trying to shift to making money with services instead of software, it might try to use the fact that most people who have Windows also have Windows Update as a lever and become the world's premier update service.

The ability of the GetSystemSpec() function of the COM component to list the software vendors of all installed software packages (<regKeys /> tag) is currently unused by Windows Update, but it might become a privacy issue in the future. Microsoft might be planning to open the Windows Update service to other software vendors, which could be the moment in which Windows Update starts using this feature of GetSystemSpec(). (mha)

So maybe the geek.com article took it a bit too far saying that they already document what software you have on your pc.

charliex · 10-17-2003, 11:12 PM

yeah they ask for that info when you install hardware it doesn't recognise, they just use it for determining if theres hardware out there they need to look at including in the default build etc.

Looking at all your hardware and uploading it, well duh, its looking for device driver updates

as for determining which browser you are using and creating a special page for it, errr umm...

This is what MS said about it.

Quote:

The Facts: What Information Does Windows Update Really Collect?

REDMOND, Wash., March 24, 2003 --Researchers for the German-based Web site tecChannel claimed recently to have analyzed data collected by the Microsoft Windows Update Web site and found that it provided Microsoft with a list of all software on a user's computer. If that were true, it would be inconsistent with the Windows Update Privacy Statement, which is posted on the site and details all the information collected by Windows Update.

To find out what information Windows Update actually does collect, PressPass spoke with Microsoft's Nick Dallett, the Windows Update program manager for supportability and sustained engineering. Dallett is also responsible for privacy and security issues for the Windows Update Web site.

PressPass: What is Windows Update, exactly?

Dallett: Windows Update was launched to make it easier for people to keep their computers up-to-date by providing a single, easy-to-use Web site for automatically downloading the latest enhancements, patches, and security updates for the Windows operating system. Part of providing updates for Windows is to offer a catalog of the latest device drivers to ensure that hardware devices are compatible with Windows. Drivers are provided to Microsoft by third-party manufacturers, and we do collect information about the devices installed on your machine, and the versions of drivers installed for those devices in order to see whether Windows Update has newer drivers that would be appropriate for your computer. This information is used during the scanning process and is not stored by Microsoft.

When you visit Windows Update, the site scans your computer to see if there are any applicable updates that are not installed on your computer. It then provides you with a list of updates that are appropriate for your machine.

PressPass: What information does the Windows Update site collect?

Dallett: To provide that list of appropriate updates, the Windows Update site must collect a certain amount of configuration information about your computer. The information includes the version numbers for your operating system and for Microsoft Internet Explorer, the version numbers for other software that the site provides updates for, Plug and Play ID numbers for hardware devices, and your region and language settings. Windows Update also collects the Product ID and product key to make sure that you are using a valid, licensed copy of Windows, but we do not keep that information once your Windows Update session is over.

To provide the best service we can, Windows Update also records how many unique computers visit the site, and whether updates are downloaded and installed successfully. To determine unique-user counts, Windows Update stores a randomly generated unique identifier on your computer. That identifier does not contain any personal information and it cannot be traced back to you or your computer. This install-status information, including the unique ID and other non-personally-identifiable information, is the only information Windows Update stores, and it is used only to aggregate statistics and to troubleshoot install errors.

PressPass: Does Windows Update collect information about software other than Windows?

Dallett: As I mentioned before, the site does scan your computer to see what devices are installed, and the versions of the device drivers installed for those devices. Beyond that, Windows Update does not check your computer to see what other software you have.

PressPass: Can any of the information that Windows Update collects be used to identify individual computer users?

Dallett: Windows Update only collects the information that is required to determine what updates your computer can use, whether your version of Windows is legitimately licensed, and to track how many computers visit the site and whether downloads are successful.. Windows Update does not collect names, addresses, e-mail addresses, or any other personal information.

PressPass: According to recent reports, researchers at a German Web site called tecChannel analyzed the data sent to Windows Update when it scans a computer and found that it includes a list of all installed software.

Dallett: The article on the tecChannel site refers to the GetSystemSpec method on our ActiveX control. This method can be used to obtain several different types of information. When the method is called without any parameters, the default behavior is to return all available data, which includes a list of top-level keys in the Software hive of the system registry. However, when the Windows Update Web site or the Automatic Updates client calls this method, the call includes parameters that limit the data that is returned so that it only contains information about the system type, the Windows operating system version and locale, and devices installed on the system. This can be easily verified by checking our site files for instances of this method call. If the tecChannel people used the API without including the parameters that we always send, then they'd see classes of information, such as third-party software, that Windows Update never asks for, and they might assume we are asking for registry data that we never collect.

PressPass: Why does the Windows Update API include the capability to scan for data like third-party software if the Windows Update doesn't want to collect that information?

Dallett: One of the goals of Windows Update design was to provide a means of updating third party software such as device drivers, etc. To do that, we needed to be able to determine if any of the supported software was on the box before we downloaded files to the machine. The specific registry keys mentioned are the quickest and least intrusive way of determining if software for a particular third party was on the box or not.

This information is readily available through publicly documented APIs that are available to any Windows programmer (see http://msdn.microsoft.com/library/de.../registry.asp, for example). I'd also like to reiterate that Windows Update does not take any of this information off the client machine, as this data is specifically excluded from the information the site requests from the control.

PressPass: Not to belabor the point, but to be clear, does Windows Update collect the information that tecChannel claims it does?

Dallett: Absolutely not