{"id":10421,"date":"2019-07-11T11:11:55","date_gmt":"2019-07-11T09:11:55","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=10421"},"modified":"2019-07-11T11:12:49","modified_gmt":"2019-07-11T09:12:49","slug":"windows-7-update-kb4507456-security-only-with-telemetry","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2019\/07\/11\/windows-7-update-kb4507456-security-only-with-telemetry\/","title":{"rendered":"Windows 7 Update KB4507456 (security only) with Telemetry"},"content":{"rendered":"

\"win7\"[German<\/a>]It's an unpleasant surprise administrators of Windows 7 systems. July 9, 2019 patchday from Microsoft comes also with security-only Update KB4507456, but this package has telemetry on board.  <\/p>\n

<\/p>\n

Rollup and security-only updates <\/h2>\n

\"\"A brief review of the nomenclature. For Windows 7 SP1 and Windows Server 2008\/R2 there was a monthly rollup update as well as a security-only update. The monthly rollup update contained all security fixes, but also bug fixes. And this rollup update included telemetry features. <\/p>\n

Exactly these telemetry functions were missing in the security-only updates that Microsoft offers in the Microsoft Update Catalog and via WSUS. Many administrators have therefore installed the security-only updates.<\/p>\n

Security-only update with Telemetry<\/h2>\n

German blog reader Bolko had already posted this comment<\/a> on the blog a few hours ago (thanks for that). <\/p>\n

\n

The security-only KB4507456 contains telemetry (KB2952664, diagtrack, appraiser). Telemetry was previously only included in the rollups, but not in security-only. Secretly quiet and quietly Microsoft wants to extend the monitoring.<\/p>\n<\/blockquote>\n

I only noticed that, but haven't time to dig in. Later, while visiting askwoody.com<\/em> I came across the article Microsoft surreptitiously adds telemetry functionality to July 2019 Win7 Security-only patch<\/a> linked by Bolko. Microsoft has added silently telemetry functionality to the July 2019 Security-only update for Windows 7 KB4507456. An anonymous poster had contacted askwoody.com<\/em> with the following hint: <\/p>\n

\n

Warning for group B Windows 7 users! <\/p>\n

The \"July 9, 2019\u2014KB4507456 (Security-only update)\" is NOT \"security-only\" update. <\/p>\n

It replaces infamous KB2952664 and contains telemetry. Some details can be found in  file information for update 4507456<\/a> (keywords: \"telemetry\", \"diagtrack\" and \"appraiser\") and under http:\/\/www.catalog.update.microsoft.com\/ScopedViewInline.aspx?updateid=7cdee6a8-6f30-423e-b02c-3453e14e3a6e<\/a> (in \"Package details\"->\"This update replaces the following updates\" and there is KB2952664 listed). <\/p>\n

It doesn't apply for IA-64-based systems, but applies both x64 and x86-based systems.<\/p>\n<\/blockquote>\n

The poster had inspected the file list (link<\/a> is available the KB article). There are entries for files with names like \"telemetry\", \"diagtrack\" and \"appraiser\". In 2016, I had already written something about the Diagnostics Tracking service (DiagTrack) in the article Plant Microsoft die Ausweitung der Telemetriedatenerfassung in Windows 7\/8.1?<\/a> At askwoody.com abbodi86 writes<\/a> that DiagTrack is part of the Compatel Runner. And about appraiser I had written something documented in the article Windows 10 V1607: Update KB4033637 finally documented<\/a>.  <\/p>\n

<\/p>\n

The anonymous poster at askwoody.com<\/em> made another interesting statement. In the Microsoft Update Catalog for update KB4507456<\/a> you will find on the tab Package Details<\/em> the information that the update KB4507456 replaces three other updates. Among others the update KB2952664<\/a> will be replaced, a compatibility update to keep Windows 7 up to date. The KB article says: <\/p>\n

\n

This update performs diagnostics on the Windows systems that participate in the Windows Customer Experience Improvement Program. The diagnostics evaluate the compatibility status of the Windows ecosystem, and help Microsoft to ensure application and device compatibility for all updates to Windows. There is no GWX or upgrade functionality contained in this update.<\/p>\n<\/blockquote>\n

This is interpreted on askwoody.com in such a way that telemetry functions now find their way into security-only updates. It is still unclear whether the telemetry is now included in every security-only update or whether it is a one-time thing. At askwoody.com there is this thread<\/a> which describes how to disable the telemetry. <\/p>\n

\n

I have officially stopped updating my Win7 machine. I no longer trust Microsoft's updating process. I'll protect it from any existing and future vulnerabilities with my other defenses, as well as I can. Fuck you, @microsoft<\/a>.https:\/\/t.co\/x3CYassKMO<\/a><\/p>\n

\u2014 Vess (@VessOnSecurity) 10. Juli 2019<\/a><\/p><\/blockquote>\n