Hide and Seek with Windows 10. Testing programs to turn off surveillance and increase privacy

[Демитрий]

Hide and Seek with Windows 10. Testing programs to turn off surveillance and increase privacy

More than three years have passed since the release of Windows 10, and the problem of discharging user data to Microsoft servers has not been resolved. Moreover, it was compounded by the forced reset of privacy settings and the restart of a disabled update service. In this article, we compare several utilities for managing “spyware” components of the OS and see how effective they are on modern builds of Windows 10.

The content of the article

• Testing methodology
• Check privacy settings
• Program Comparison
• Blackbird 1.0.28
• Destroy Windows 10 Spying 1.0.1.0
• DoNotSpy10 4.0
• O&O ShutUp10 1.6.1399
• Disable Win Tracking
• Windows Privacy Dashboard
• Disable manual tracking
• Disable user activity recording
• Disable the "keylogger"
• Disable telemetry
• Turn off location data collection
• Turn off Cortana
• Disable OneDrive
• Turn off telemetry sending in the task scheduler
• We block sending data to Microsoft servers
• Block updates
• conclusions

Microsoft never hid the fact that they collect information about users, it used to be limited to ornate phrases about sending "some information in order to improve the user experience." After entry into force European Data Protection Regulation and a number of other laws, company lawyers had to disclose details. Here You can read about what data is collected, where it is transferred, how it is processed, and in what cases it is disclosed.

In front of consumers at Microsoft, they unscrewed the fact that they supposedly give the opportunity to independently configure the type and amount of data transferred. To do this, you must install service pack (for those with builds below 15063.0) and use the privacy screen. It is advisable to do this at the installation stage.

Privacy screen when installing Windows 10
As planned, the user has the feeling that if everything is turned off, then the data will not leak. However, this is an intentionally created illusion. Let's run the sniffer and see how things are in reality.

Testing methodology
All tests were conducted in parallel on two test builds of Windows 10 Pro - 1709 and 1803. In order for the test conditions to be identical, each anti-spyware program was deployed in virtual machine clones. The screenshots in the article first provide a snapshot of the work in 1709, and then in 1803, unless otherwise indicated. As auxiliary utilities, Wireshark 2.6.3 64 bit, TCPView v. 3.05 and Regshot v. 2.1.0.17.

In all tested programs, the maximum blocking settings were selected. If a function or application is not blocked, an undefined error will occur. It will not be clear: whether this unblocked item causes data to be drained, or the program failed to disable some function. The ideal result is a dump of network traffic without Microsoft IP addresses. Let's see who will cope with this task, but first we’ll check the standard privacy management features in Windows.

Check privacy settings
If you leave the default settings, then after loading the OS, a large stream of outgoing traffic to Microsoft addresses is immediately visible.

Network traffic monitoring with default privacy settings
Now turn off everything that is disabled on the privacy screen. The result is obvious.

Network traffic monitoring with cut telemetry transmission
However, even after switching all the checkboxes to the prohibition position, some data is immediately sent to the Microsoft Azure cloud platform, and in Singapore. In the Wireshark logs, I noticed the IP addresses of Microsoft network nodes from around the world. Apparently, this is how load balancing works. The connection with them is not constant (I got in touch, relayed what I needed and cut the connection). The address pool is very large. I double-checked them and made sure that almost all of them belong to Microsoft or its affiliate networks.

Program Comparison
For comparison, we selected the following anti-spyware programs: Blackbird 1.0.28, Destroy Windows 10 Spying 1.0.1.0, DoNotSpy10 4.0, O&O ShutUp10 1.6.1399 and Disable Win Tracking 3.2.1. All of these applications have one goal - to prevent Microsoft from getting any data in a known way. They are not without various goodies such as blocking updates. Here is a sample list of what to expect from such utilities:

• disable user activity recording;
• disable sending keyboard input data;
• Disable handwriting submission
• disable the collection of diagnostic data (telemetry);
• disabling location data collection;
• Disabling and resetting Cortana personal settings;
• Disabling Internet access for Windows Media DRM;
• Disabling application access to account information, calendar, messages, camera, microphone and location;
• (optional) disabling the Windows Update service for other products.

Of course, this is not a complete list, but that is a reasonable minimum that you should focus on. All these changes can be done manually. Such "anti-spyware" utilities bribe only by using a hundred tweaks in a couple of clicks.

How do these utilities work at all?

1. Modify registry keys responsible for privacy settings.
2. Add URLs of network nodes known to the program authors to the% WINDIR% \ System32 \ drivers \ etc \ hosts file to the program’s program to which Microsoft merges data.
3. Add prohibitive rule sets to the Windows Firewall that block connections to known Microsoft IP addresses.
4. Stop the "tracking" services.
5. Delete the “spyware” tasks of the scheduler.
6. In the hardcore version, system files and directories responsible for spyware functions are deleted.

WARNING
An attempt to achieve maximum privacy with the help of such programs can lead to the fact that the necessary components will stop working, Windows activation will fly off, the OS will behave unstably or not boot at all. We strongly recommend not limited to backup tools built into them, but use third-party programs to create a complete disk image. With it, it will be guaranteed that it will be possible to return the system to its original state, no matter what happens to it during the experiments.

Blackbird 1.0.28
https://www.getblackbird.net

The program runs in console mode. It initially has only three functions:

• scan the system and display all (according to the developer) detected problems;
• start the lock manager;
• backup settings. I want to especially note this feature. Not every program allows you to do this, so if something went wrong, just restore the settings to lock and work on. The backup is placed in the program folder, and when it is done, the program changes one of its functions from “Backup” to “Restore from backup”.

Blackbird Interface
After scanning, a very large list of “shortcomings” is issued that needs to be fixed.

Scan to Blackbird
There really are many points in it, but there are very controversial points. For example, the first thing I did was cut the W32Time service blocking point. If the computer is in the domain, then how to synchronize time with the server?

Let's move on to the block list. Press A on the main screen of the program and see such a picture.

List of applications and services for blocking Blackbird
Please note that several new features have been added to build 1803, so 78 points should be blocked, not 70, as in 1709. Here's a good example of why I chose two Windows 10 releases for the test.

The difference in the builds of Windows 10 in Blackbird
There is no Windows Update service in the list of components that Blackbird can disable. The shutdown itself was made inconvenient: there are no ready-made settings profiles, each item has to be selected separately.

After the actions performed in assembly 1709, it was possible to disable all the "tracking" functions, the program coped with a bang. In assembly 1803, one function was never disabled, and for some reason their total number was 79.

Blackbird did not fully cope with assembly 1803
Two days of observing the behavior of operating systems showed that after Blackbird’s work, outgoing traffic became much smaller. However, a test computer with assembly 1803 constantly transmitted data to IP 104.25.219.21. Shodan says it belongs to Cloudflare, a well-known cloud provider. As far as I know, Microsoft has long been leasing hosting for virtual statistics collection servers from it. More such network activity was not noted, except for downloading updates.

Blackbird generally managed to block the tracking functions, but both test builds became inoperative because of it. Start menu does not open. Edge and IE do not start. The application store and mail try to start, but immediately close. In the notification panel hang messages that cannot be opened. In general, it is impossible to live with such a disfigured OS. Although the updates were installed without problems!

When recovering from a created Blackbird backup, it didn’t get better. In assembly 1703, Windows activation has flown and two registry errors have appeared. After the reboot, no problem was fixed. Build 1803 was not able to start Blackbird for recovery from backup at all, starting to swear at a file system error (although everything was fine with the FS).

The conclusion is obvious. Blackbird place in our former heading "West-building".

Errors when restoring a backup
Destroy Windows 10 Spying 1.0.1.0
Destroy-Windows-10-Spying

Destroy Windows 10 Spying - a program that, most likely, is already at the hearing of everyone who wondered how to turn off the transfer of their data to Microsoft. They talk that after version 1.0.1.0 the developer changed and the Trojan began to be sewn into new releases. Therefore, we will use the latest official version that Nummer has released.

Version 1.0.1.0 was written in April 2018. On my assemblies, it started and identified them correctly. Among other things, the program has a feature for disabling Windows updates, which I also took advantage of.

Destroy Windows 10 Spying 1.0.1.0
All changes are made by pressing the large button "Destroy Windows Spying NOW!". The program runs in three stages: disabling “spyware” services, adding known IP addresses to the firewall rules, and writing the URLs of Microsoft statistics collection servers to the host file. Then a reboot follows, applying all the changes.

DWS results upset me.

Dump Wireshark after DWS
Outgoing traffic to the “left” addresses has become less, but active communication with unnecessary IP addresses was still observed. The version of the program is outdated, and in new builds of Windows it really does not perform its function. However, the utility does not cripple the OS, as Blackbird does. My virtual computers survived after DWS. Within three days, no software problems were detected. Immediately after the reboot, assembly 1709 hung a couple of times, but it cost little blood and everything was restored.

With Windows Update locking, DWS also worked crookedly. After four or five restarts of Windows, svhost again appeared in TCPView logs, which continued to deliver updates as if nothing had happened. I also noticed a very close dialogue between build 1709 and the IP address of the server on the Akamai Technologies network, which cooperates with Microsoft, and a strong increase in SSDP packets. Perhaps Windows itself was sorting out spare ways to send data when its own servers were partially unavailable.

DoNotSpy10 4.0
DoNotSpy10 »pXc-coding

Another popular program with a user-friendly interface. For each item, the developer made a short description, so it’s easy to figure it out - check the boxes and go!

DoNotSpy10 Interface
This program provides the ability to make a system rollback point before applying the changes (not a backup of the settings, namely the system rollback point). In my opinion, with the number of functions in it, they overdid it a bit - there are a lot of all sorts of features. I applied everything to the maximum, and the result of the work surprised me. After four hours of system downtime, they began to reboot themselves. It turned out that during this time “blocked” updates rolled quietly. Wireshark collected almost 400 thousand packets per hour, which was not observed with other programs. Most packages were addressed exactly where DoNotSpy10 should have forbidden to send them. On top of that, licenses from both OSs have flown.

DoNotSpy10 will surely appeal to masochists and will disappoint everyone else.

O&O ShutUp10 1.6.1399
O&O ShutUp10

This program of German developers O&O Software has a user-friendly interface and several settings profiles. You can apply only the recommended ones or all at once with one click. Also among the advantages I note the import and export of registry settings. As practice has shown, this is a very important point. Machine translation into Russian hurts the eye, but it is enough to understand the prompts that pop up when you click on the line to disable the function.

In the program window, a column with the name "Recommended?" Is made, and in it there are items marked "NO." At first it seems that these are some particularly dangerous tweaks, but among them are auto-updates.

I want to note one important detail right away: in assembly 1709, the program suggests changing 97 points, and in 1803 - already 100. The three added points are located in the "Application Confidentiality" section and prohibit access to documents, images and videos.

Difference O&O ShutUp10 on different builds of Windows 10
When you select the first "tracking" function, the program issued a warning that the recovery point creation function was disabled in the system. Another plus in karma!

As in all previous tests, I chose the "ultra" settings to make the most of the program. Immediately before closing, O&O ShutUp10 warned that if updates were rolled onto the computer (and according to the developers, they would still roll), then you would have to start the program again and return the settings. Why then not completely block their installation?

Second German Warning
Another small observation (it's nit-picking, but the perfectionist inside me is indignant): after a warning, the program offers to reboot, but cannot reboot in either assembly 1709 or assembly 1803. Both had to be rebuilt manually.

Immediately after the next boot of the OS and before starting Wireshark, TCPView showed an unpleasant picture. Again, processes communicate with MS addresses!

The ban only partially worked
Dump Wireshark is also not pleased. The session setup and data transfer are clearly visible, although not many packets are sent.

Windows 10 1803 traffic dump
As expected, svhost swaps updates, although I turned them off in O&O ShutUp10, indicating two points related to Windows Update.

After five to eight hours, Internet access was lost. It was possible to return it by rebooting the network adapter, but the next check for updates on Windows failed.

Update error
After a day, two parameters changed: “Deny running applications in the background” and “Disabling telemetry (3 of 3)” were disabled. In 1709, this was not observed.

O&O ShutUp10
Two days after using the O&O ShutUp10, the flight is normal and the overall picture is good. Occasionally, Microsoft server addresses from different countries slip through network traffic. In assembly 1803, they mostly communicate with backgroundTaskHost, dasHost.exe and svhost (the latter keeps a stable connection throughout the work), and in 1709 only svhost. In addition, in assembly 1803, after each restart of the program, the option “Block applications from running in the background" is disabled (no such behavior has been noticed for 1709) and individual parameters are automatically restored that O&O ShutUp10 previously turned off or blocked. It turns out that she conquered Windows 10 1709, but 1803 is too tough for her yet.

The return of settings was painless. There is nothing much to talk about.

After using O&O ShutUp10, there are no complaints about the operation of the OS itself. I was surprised several times by faster work (with beggarly resources allocated to one main and two guest OSs, this is very noticeable to me).

Disable Win Tracking
10se1ucgo / DisableWinTracking

Disable Win Tracking 3.2.1 is another small and simple utility with a Spartan interface. It was updated at the beginning of the year, but nothing was said about the support for various Windows builds.

Disable Win Tracking
The Services item has two modes to choose from: delete services and disable them (I chose to delete). Actions are performed with two services: DiagTrack (service for monitoring the collection of diagnostic data) and dmwappushsvc (routing service WAP Push Message). Everything else is pretty simple and straightforward. When highlighting some of the items, the utility will carefully warn that if you turn off some functions, there will be consequences and some applications may stop working.

INFO
DiagTrack was initially distributed as an optional update to KB3022345. This "spyware" service could not be installed or removed at all by regular means, but at the end of 2015, tricks from Microsoft renamed it Connected User Experiences and Telemetry and sewn it into the system as a required component.

Press GO, and after completion we are given a detailed report on the work done. It is interesting to look through and see what the program does.

After three days of the test, regular updates were installed. The dmwappushsvc service reappeared in the list, but was in a disconnected state. According to the results of network monitoring: Microsoft and Akamai addresses in the logs did not go anywhere. My OSes regularly contacted them, but there was less traffic. Disable Win Tracking did not affect the stability of the OS, but Skype stopped working. Interventions in the system were minimal: adding rules for the built-in firewall and several registry changes.

Windows Privacy Dashboard
WPD

The last utility that I would like to parse is WPD 1.2.940. At the time of writing, the current release was from October 11, 2018, but the rules for blocking tracking components in it were used from September 16. Declared support for Windows 10 up to 1809. The program’s functions are divided into three sections: managing privacy, creating firewall rules and removing installed programs (“garbage”, as the developers called them).

Confidentiality management disables the rules in the scheduler, some services and makes changes to the registry. Firewall rules are created based on the selected privacy mode: Spy and Extra. When you select the latter, OneDrive, Skype, Live and the like are blocked (the program warns about this). As in all cases, I tried to squeeze out everything from this utility, except for uninstalling applications.

For four days of testing, I did not reveal any complaints about the OS - both test OSes worked stably. I am not less pleased with the program than O&O ShutUp10. After working with WPD, the logs left a minimal number of connections to the servers of Microsoft and its partners, and the packages themselves were very small.

WPD makes most of the changes to the registry. Here's what the result of her work in Windows 1803 looks like.

I compared the registry snapshots with Regshot. Listing all changed keys would be too tedious. I think that the number in the line “Deleted / New Settings” speaks for itself.

New registry keys
The program created one firewall rule by writing a bunch of IP addresses into it.

Firewall rule
In general, WPD worked pretty well.

Disable manual tracking
Let's try to manually do part of the actions of the programs described. Let's do the basic locks that I mentioned above. All actions are at your own peril and risk! Before editing the registry, I recommend that you create a backup copy.

Disable user activity recording
The Timeline function is responsible for this. We go into the registry editor (regedit), go along the path HKEY_LOCAL_MACHINE \ SOFTWARE \ Policies \ Microsoft \ Windows \ System. Create a 32-bit DWORD with a value of 0 and the name EnableActivityFeed.

Disable the "keylogger"
It's about the same dmwappushsvc service. We go along the branch HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ dmwappushsvc and set dmwappushsvc to 4 (here you can also turn off DiagTrack right away).

Disable telemetry
Here it must be clarified that modern Windows builds do not allow completely disabling telemetry without losing essential system functions. There are three options for configuring the transmission of collected data: “Basic setup”, “Advanced” and “Full data”. There is also a “Security” section, but it is only present in Enterprise. Through the registry, we can set the minimum telemetry collection level: HKEY_LOCAL_MACHINE \ SOFTWARE \ Policies \ Microsoft \ Windows \ DataCollection (if there is no DataCollection parameter, you need to create it). Create a 32-bit DWORD named AllowTelemetry and set it to 1.

Turn off location data collection
We go along the branch HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ DeviceAccess \ Global \ {BFA794E4-F964-4FDB-90F6-51056BFE4B44} and assign the parameter Allow.

Turn off Cortana
In the key HKEY_LOCAL_MACHINE \ SOFTWARE \ Policies \ Microsoft \ Windows \ Windows Search, set the Allow Cortana parameter to 0.

Disable OneDrive
At HKEY_LOCAL_MACHINE \ SOFTWARE \ Policies \ Microsoft \ Windows \ Skydrive, we find or create a DisableFileSync parameter of type DWORD 32 bits and set it to 1.

Turn off telemetry sending in the task scheduler
In addition to telemetry, the scheduler has a bunch of initially created tasks that take resources and work without the knowledge of the user. They mainly collect telemetry data for the “user experience improvement program” and the SmartScreen cloud protection service.

You can disable this entire almshouse with the following commands:

schtasks / Change / TN "Microsoft \ Windows \ AppID \ SmartScreenSpecific" / Disable
schtasks / Change / TN "Microsoft \ Windows \ Application Experience \ ProgramDataUpdater" / Disable schtasks / Change / TN "Microsoft \ Windows \ Application Experience \ Microsoft Compatibility Appraiser" / Disable
schtasks / Change / TN "Microsoft \ Windows \ Autochk \ Proxy" / Disable
schtasks / Change / TN "Microsoft \ Windows \ Customer Experience Improvement Program \ Consolidator" / Disable
schtasks / Change / TN "Microsoft \ Windows \ Customer Experience Improvement Program \ KernelCeipTask" / Disable
schtasks / Change / TN "Microsoft \ Windows \ CloudExperienceHost \ CreateObjectTask" / Disable
schtasks / Change / TN "Microsoft \ Windows \ DiskDiagnostic \ Microsoft-Windows-DiskDiagnosticDataCollector" / Disable
schtasks / Change / TN "Microsoft \ Windows \ Maintenance \ WinSAT" / Disable
schtasks / Change / TN "Microsoft \ Windows \ NetTrace \ GatherNetworkInfo" / Disable
schtasks / Change / TN "Microsoft \ Windows \ Shell \ FamilySafetyMonitor" / Disable
schtasks / Change / TN "Microsoft \ Office \ OfficeTelemetryAgentFallBack" / Disable
schtasks / Change / TN "Microsoft \ Office \ OfficeTelemetryAgentLogOn" / Disable

We block sending data to Microsoft servers
There are many resources on the Internet that regularly update the address lists of Microsoft spy servers. For example, on aeronet.cz You can find the main list. The easiest way is to add them to hosts and create prohibitive rules in the firewall.

Windows Firewall Rules
I used both methods. Windows reached one of the blocked addresses after an hour of operation, but the network packet size turned out to be zero.

Attempted connection with a blocked address
Some security experts believe that Windows system processes (including spyware) can bypass the prohibitions in hosts and in the built-in firewall. Theoretically, URL blocking in hosts can be circumvented by direct IP access, and IP blocking in the software firewall through dnsapi.dll and interception of the protocol creation functions at the NDIS level by other components of the Windows kernel. However, during my mini-experiment, I did not notice spurious traffic. After blocking in hosts and firewall rules, attempts to establish a connection with “spyware” servers continued, but outgoing packets were zero, and there were no incoming ones at all.

Block updates
For dessert, I decided to show another small program, all of whose functions only block updates (which most programs could not do, although the function was announced). it StopUpdates10 2.0.32 .

StopUpdates10
The program interface is limited to one button. Push, reboot, test.

For two days of testing, the program did not allow the download of updates, although Windows was diligently (and unsuccessfully) trying to find them. A bit annoying was the Windows message about the component installation error.

Error message
After two days of inactivity and a dozen reboots, I tried to check for updates manually, which also ended in failure. In the list of installed were only those updates that managed to download before the program started.

conclusions
We examined six programs to disable tracking and privacy settings in the current builds of Windows 10. There are a lot of similar utilities. Their authors copy the best practices from each other (Fork me on GitHub!), Trying to make lists of mutable parameters and blocked addresses as much as possible. They rarely bother to check them (especially long), and problems with the OS usually do not appear immediately after applying tweaks. This is a time bomb.

The development of most “anti-spyware” utilities for Windows 10 stopped in 2016-2017 due to the constant arms race. Microsoft often changes the IP addresses of its servers, leases cloud services at Cloudflare and redirects some of the traffic to the Akamai Technologies affiliate network. In fact, she owns a very dynamic pool of IPs and several large networks. You don’t have time to track and block everything. In addition, one URL is often used to connect to different IP addresses or a multifunctional server, which is necessary for the normal operation of other (non-spyware) Windows components.

You can add the network addresses of Microsoft data collectors manually, simply by finding such lists on GitHub and specialized forums. You need to download them, combine, edit, check (the most difficult part) and only then apply the “dry residue”. You will have to do a lot of routine work so that at least for some time the result is stable. Then Windows updates will be released, new network addresses will be added, your painstakingly created list will become obsolete, and you will have to start all over again.

Of the tested programs, only O&O ShutUp10 and WPD more or less coped with their task, although their work can hardly be called ideal. Some privacy settings are changed using the standard tools of Windows 10 itself, but not all settings are displayed in the interface. If the utility can change some additional and “deep” ones, it makes sense. You just need to work very carefully with it, carefully select the locked parameters and make backups before using them.

Source: hacker.ru

 

[Матушкин Андрей Николаевич]