Search the Community

Introduction From Win 10's 'privacy' statement: ​ Three levels of surveillance are built in - get in your electronic pen sheeple: ​ "But wait... there's more!" The Problem with Recent Windoze 7/8/8.1 'Important/Optional' Backports/Updates It is overdue for Windoze junkies to disable as much spyware data leakage as possible that goes back to the mothership. Be aware that recent 'important' and 'optional' updates have been fraudulently backported through to Win 7 and 8/8.1 Windoze users (!) which gives your desktop the same data leakage as Windoze 10. In other words, you are an open book - like last year's Penthouse centerfold in her birthday suit... Apparently the NSA is not happy enough with being buried in Windows 10 shit; they want all data in accordance with their OCD hoarding complex and 'Own the Net' initiative (look it up). Never forget Spyware O/STM it is a hostile black box endorsed by authoritarian fuckwits. This should tell you everything you need to know. So if you won't wipe over it completely with a real operating system, then tie it down a little so it doesn't go completely rogue. Luckily our little friends in the Schneier cookie collective have identified ways to kill feedback to Microhack headquarters for known (obvious) data leaks. So, follow these instructions below if you insist on using Windoze 7, 8 or 8.1, or continue to be a corporate bitch on a hourly basis. Your choice. After all, logically there is no point running VPNs and Tor and other privacy enhancing software if your own base system betrays you. The quote starts below - italics etc are mine. Microhack Spyware Implants Microsoft likes the data they stream from windows 10 machines soo much that they decided to back port functionaly and carve out impants resulting in a of push 4 optional and 2 important windows updates They will appear in control panel installed updates as Optional "Update for Microsoft Windows (KB3068708)" "Update for Microsoft Windows (KB3075249)" "Update for Microsoft Windows (KB3080149)" "Update for Microsoft Windows (KB3022345)" Important "Update for Microsoft Windows (KB2952664)" "Update for Microsoft Windows (KB3021917)" If you have better things to do than hand eye troll through the list of installed updates then here are two approached to detect the SurveillanceWare Implants. The referenced KB's are specific to the surveillance implants which target Windows 7 only. If your running windows 8, 8.1 or 10 your more than likely fighting much more of a loosing battle. So this section is specific so where it may be temporarily possible to remove the Implants. ​ or alternatively detect with an update to the systeminfo command ​ To start removal after optionally taking an evidence image or a system backup ​ Then reboot seems required then continue ​ ---------- Windows 7, 8, 8.1 Script to Detect Implants------- Here is a list and updated DIY detection ready scripting for all 14 (currently known) Surveillance implants. Including Implants for windows 8 and later. I guess they thought they could catch more fish with 14 baited lines. Here are two batch files . run the larger script to see whats detected. Open an elevated command prompt ​ Add the batch script content ​ Create a batch file, purpose is to check for currently known Implants. Name: checkfor_NPI_patches.bat Add the batch script content ​ Whatever Surveillance implants revealed in your machine, it can be removed with a customization of the wusa command, just replace the ??????? with the kb numbers reported. ​ -------Housekeeping QA Housekeeping checks post removal additional steps. I can foresee someone will prophetically conclude a recommended step 5) Uninstall windows and install a secure *nix variant. Obligatorily mentioned in advance. Thanks. An eye on post removal Hinkyness had some hits after removals and reboots. 1) Only two of the four uninstalled KB's reappeared as available optional "Update for Windows 7 for x64 based Systems (KB3075249) and (KB3080149), another reappeared as Important "Update for Windows 7 for x64 based Systems (KB3068708)" The important one was the "Update for customer experience and diagnostic telemetry" Important to who, NSA? The "KB3068708" Update for customer experience and diagnostic telemetry" did not reappear as an available patch. It may be dependent on one of the other three removed bits 2) Before the uninstall, I had foresight to search the infected file system for .manifest with a common namespace string called assemblyIdentity which is set to a string value "Microsoft-Windows-Authentication-AuthUI.Resources" The before removal search listing files which matched the above search constraint yielded 62 matches in 52 manifest files. The after removal search listing of files which match the above search constraint yields 74 matches in 64 manifest files. Conclusion, the removal did not remove the manifest files pushed in the original infection. 3) In a read of KB 3080149, it indicated it installed and updates / requires maintenance of a file named utc.app.json Before removal, the file file was found in 6 places on the infected filesystem After "removal" the file exists in the same 6 locations, same filesize just waiting for re-use and reinfection. discovered and removed using the disribed method 22 additional implants Found all 6 utc.app.json were removed and it had left two backup copies under the name utc.app.json.bk in C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings in the same directory, found a backed up file telemetry.ASM-WindowsDefault.json.bk In order to see the hidden system directory, you must elevate to admin dir wont show the rest of the telemetry files unless you clear the files attributes An Elevated file explorer will show the files Files wont be readable until you change owner permissions or change your running user principal context to that which does allow access to the file. telemetry file content ​ content file of utc.app.json ​ To mitigate future infection, am considering removal alteration or perform a revocation of file permissions to utc.app.json and the hinky manifest files. 4)Re the connections the malware opened, which may or may not have Mitm certificate pinning mitigation. My personal opinion is to mitigate by locking access to the data ex filtration end points. ​ Chances are that anything outbound to ".data.microsoft" should likely be blackholed if you opt out of the "Idiots Do Opt Having Pervasive Surveillance Patches" IDOH-PSP program for short. Hope this helps to bring most of the malware workflow, as is early info on this new day of vendor sponsored in your face implants, info will likely be incomplete. Additional Steps to Block Windoze Malware https://github.com/WindowsLies/BlockWindows Stop Windows 7 through 10 Nagging and Spying updates, Tasks, IPs, and services. Works with Windows 7 through 10 ​