← Back to context

Comment by pogue

1 day ago

The article links to this page, which was shared on HN yesterday. [1]

I feel like using wireshark to look at what's being sent back and forth from Windows telemetry, when using Edge, Chrome & etc should reveal what's being sent and recieved. Using MITM SSL spoofing should be able to intercept the packets.

[1] https://github.com/SmtimesIWndr/gdid-reversal

5 comments

pogue

Reply
Terr_  1 day ago

I would be shocked if Microsoft was not using their own layer of certificate-pinning to stop people from doing that, and/or using another layer of encryption separate from the networking layer.

  • pogue  1 day ago

    Only way to see what's going on is testing to see what's going on. Hopefully, someone who knows more about it than me can take a look at the packets and see what they contain.

    • Terr_  1 day ago

      I found this talk [0] and some of the slides suggest that Windows is, at least in some circumstances, packaging web-browsing data into telemetry.

      To lift examples from the slides, that includes page titles:

          "CorrelationGuid": "7da62b73-082f-4eb2-a370-135d0113e1dd",
    "EventInfo.Level": 2,
    "PageTitle": "SiSyPHuS AFUNKT - Search",
    "TabId": 830425073,
    "client_id": -7497793556371901000,
    "pop_sample": 100,
    "utc_flags": 140737488355328

      The transitions between pages:

          "IsSameDocumentNavigation": 0,
    "client_id": -7497793556371901000,
    "navigationUrl": "https://www.bsi.bund.de/DE/Service-
    Navi/Publikationen/Studien/SiSyPHuS_Win10/AFUNKT/SiSyPHuS_AFUNKT_node.html",
    "referUrl": "https://www.bing.com/",
    "HttpStatusCode": 200,

      And even which link you clicked in the page:

          "DOMElementPath": "A|1||c-link%20c-link--download%20FTpdf;P|5[…]gsb%20lang-de%20fixed%20js-on;HTML|1||",
    "DOMAnchorHrefUrl": "https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/SiSyPHus/AFUNKT.pdf?__blob=publicationFile&v=6",

      [0] https://troopers.de/troopers23/talks/bsabut/

      1 reply →

  • cromka  1 day ago

    But you'd still see some encrypted traffic and it wouldn't fly under a radar