News for hackers. Stuff that matters.

A comment on Reviewing Microsoft's Automatic Insertion of Telemetry into C++ Binaries. Parent comment

Re:Reviewing Microsoft's Automatic Insertion of Telemetry in... by acqq on Thursday June 09, 2016 @05:49PM (#11872645)
Typical Microsoft. They were (or maybe are still) in the telemetry-all-the-things craze so what can be more logical than adding an event called "telemetry" to every binary produced with their compiler. In the words of Raymond Chen, "I bet somebody got a bonus for that feature." But as MS's Carrol is quoted in the the fine article:

"We haven’t actually gone through this full exercise with any customers to date though, and we are so far relying on our established approaches to investigate and address potential problems instead."

Even if that ETW event isn't "telemetry" itself, it could be, of course, used in the some hypothetical telemetry code that that would use ETW infrastructure. Which is not bad as is. It's just an event, independent of who uses it.

The main question is, of course, is there such code ("real" telemetry using ETW) in Windows, or is ETW used only for debugging, that is, only by developers.

https://msdn.microsoft.com/en-us/library/windows/desktop/aa3...

My guess is: ETW is already used for some real telemetry: its model seems to allow this.

Technical details of what the functions do:

https://www.reddit.com/r/cpp/comments/4hoyzr/msvc_mutex_is_s...

And the explanation of the ETW by xon_xoff:

https://www.reddit.com/r/cpp/comments/4hoyzr/msvc_mutex_is_s...

"ETW is a general mechanism to log any kind of event, not just performance events, and is used throughout Windows for more than just profiling. Furthermore, it supports both multiple simultaneous consumers and storage in .etl files for later processing. Any program with sufficient privilege can enable tracing of specific event types throughout the system, and user intervention is not required to do so. An example is an automatically generated file called ExplorerStartupLog.etl in the AppData\Local\Microsoft\Windows\Explorer folder. These files being generated locally doesn't mean they can't be transmitted later, and some problem reporting tools use ETW+ETL files to efficiently capture telemetry for upload."

[ Parent | on HN ]
Re:Reviewing Microsoft's Automatic Insertion of Telemetry in... by yuhong on Thursday June 09, 2016 @10:10PM (#11873836)
I think it is not true in this case. The thing that does telemetry in Windows is called SQM AFAIK. I think it might use ETW sometimes, but this is only one thing ETW can be used for.
[ Parent | on HN ]
Re:Reviewing Microsoft's Automatic Insertion of Telemetry in... by acqq on Friday June 10, 2016 @03:04AM (#11874726)
I'm quite sure Windows uses ETW on various places: searching for etl files, I find 136 on my C: disk, and all are generated by the system, and not due to my debugging actions. E.g.

    C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl
    C:\Users\myname\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl
    C:\Users\myname\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl
    C:\Users\myname\AppData\Local\Microsoft\Windows\SkyDrive\logs\app\SkyDriveApp-2015-08-30.2157.4952-1.etl
    C:\Users\myname\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\LiveComm.etl
    C:\Users\myname\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\LiveCommLast.etl
    C:\Users\myname\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\Microsoft.WindowsLive.Mail.etl
    C:\Users\myname\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\Microsoft.WindowsLive.People.etl
    C:\Users\myname\AppData\Local\Packages\Microsoft.WindowsReadingList_8wekyb3d8bbwe\LocalState\StashApp.etl
    C:\Users\myname\AppData\Local\Packages\Microsoft.WindowsReadingList_8wekyb3d8bbwe\LocalState\StashShare.etl
    C:\Windows\Inf\netcfgx.4.etl
    C:\Windows\Logs\PBR\RjvTrace_Configure.etl
    C:\Windows\Logs\SystemRestore\restore.0.etl
    C:\Windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{fef283f0-94cd-4a98-a8e7-4fd5e3eca941}\snapshot.etl
    C:\Windows\System32\wdi\LogFiles\BootCKCL.etl
    C:\Windows\System32\wdi\LogFiles\SecondaryLogonCKCL.etl
    C:\Windows\System32\wdi\LogFiles\ShutdownCKCL.etl
    C:\Windows\System32\wfp\wfpdiag.etl
If we would track everything that their different telemetries uploads, I'm quite sure .etl files would be somewhere inside. Or that their number rises with the installation of the KB updates that mention telemetry (e.g. everything related to "prepare your system for Windows 10," for example). Or that they really planned to use .etl files too fro these purposes but just haven't yet. But the .etl are widely used, they are simply system-level provided effective logs.

Everybody can check for himself too.

[ Parent | on HN ]
Re:Reviewing Microsoft's Automatic Insertion of Telemetry in... by yuhong on Friday June 10, 2016 @09:28AM (#11876182)
The point is that the particular ETW logs in question in this case are unlikely to be in the list.
[ Parent | on HN ]
Re:Reviewing Microsoft's Automatic Insertion of Telemetry in... by acqq on Friday June 10, 2016 @10:32AM (#11876605)
Personally I don't see that they invade privacy more than they can with other their information gathering methods, I however do belive that the names weren't given randomly but really related to some telemetry they planned, even when unfinished.
[ Parent | on HN ]