NSA spying on Microsoft Windows crash error reports

If you've used Microsoft Windows for any length of time, then a dialog box like this will be no stranger to you:

You may think that it's harmless enough to click on the 'Send Error Report' button and send details of the crash to Microsoft, but recent revelations about NSA surveillance underline that there are risks.

For instance, did you realise that by default Windows crash reports are sent unencrypted, potentially exposing information about the setup of your computers?

Indeed, according to a leaked presentation seen by Der Spiegel, the NSA's TAO (Tailored Access Operations) division can be automatically notified whenever a targeted computer sends a crash report.

The automated crash reports are a 'neat way' to gain 'passive access' to a machine, the presentation continues. Passive access means that, initially, only data the computer sends out into the Internet is captured and saved, but the computer itself is not yet manipulated. Still, even this passive access to error messages provides valuable insights into problems with a targeted person's computer and, thus, information on security holes that might be exploitable for planting malware or spyware on the unwitting victim's computer.

To understand more about the threat, check out this investigation from the researchers at Websense.

Bizarrely, whoever created the NSA presentation found the interception of the Windows crash error reports so amusing that they mocked up a version of the familiar dialog with their own wording,

Truly bizarre.

If (unlike the NSA) you fail to see the funny side of this, and want to prevent computers in your organisation from sending Windows Error reports to Microsoft (and potential snoopers) you may wish to make a group policy setting change.

And maybe it would be good if Microsoft made some changes at its end too, ensuring that future crash reports are sent properly encrypted.

About the author, Graham Cluley

Graham Cluley is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives presentations on the topic of computer security and online privacy. Follow him on Twitter at@gcluley, Google Plus, App.net, or drop him an email.

Lokasi:

Share :