2

Even with all the privacy, sync, and p2p settings off, using an offline account, I don't feel safe using Windows 10 for a business. I would like to restrict its ability to communicate to Microsoft (or vice versa) as much as I can.

Is there a list, or any way info out there, about what IP's Windows 10 is using to, for lack of better words, "phone home"? Or is there some way I can find/initiate the push listeners and see incoming? It seems mysteriously sparse in the resource monitor considering the amount of junk that's internet facing. I would like to block all possibilities of push/pull besides updates. However I don't know the plethora of "connected" services available in Win 10 yet and I feel that they would use massive ranges of IP's [v6] or proxies, which would be hard to capture fully. Or perhaps they may even mask com in some abstract layer, underneath the reach of monitors such as netstat or Fiddler.

So far I see some, svchost (netsvcs) perma connected occasionally calling system using the classic 157.56.106.189 range and some new IPv6, then there is system using MS limited in europe at 94.245.121.253 (I'm in USA), followed by system hitting MS denver 64.4.54.254. Im sure there are plenty more of these too that pop up. Also there are mysterious system connection bogons that are way out of our network range such as 169.254.255.255, and some other IP's I've seen checking in for just a second.

Do you know any more IP's like these? Any insights on how to force stop the non-essential communications or what to hardware firewall would be very much appreciated.

  • 1
    Fundamentally if you don't trust Microsoft to some degree here, you'd be better off not using Windows 10 or otherwise, as realistically specific IP address ranges could be changed at any time. – Rоry McCune Aug 18 '15 at 15:42
  • 1
    @Roy McCune Yeah thats what I'm thinking too -- a futile battle, especially considering the gigantic range of ipv6 or proxies available. Figured it wouldn't hurt to ask regardless. A few people at work clicked yes to install the Win10 update...rollback to Win7 could be the best solution for this. – dhaupin Aug 18 '15 at 15:49
  • Why would you roll back - Microsoft has long had the ability to do this. Win10 just has the defaults set a little oddly. – Rory Alsop Aug 18 '15 at 15:50
  • @RoryAlsop Yeah noticed some of the same sockets open in Win7, although I only slightly disagree due to a lack of perma rooted Onedrive, no Bing search/indexing integration, and no "predictive" abilities such as Cortana, it seems less liable on the surface, albeit a farce too. They don't wanna go the *nix route here since they still are software based accounting and things, so Win is what we gotta live with I suppose. – dhaupin Aug 18 '15 at 15:54
  • 1
    I do not think rolling back to Win7 would solve your worries: how could you even trust an operating system of which you have no idea how it is coded? – user45139 Aug 18 '15 at 16:16
2

As mentioned in comments, I think that ultimately you can't block all avenues an OS vendor may use to gather information from a machine, ultimately if you don't trust them the only avenue is to user a different OS.

With that said there are some things you can do to try and reduce exposures for Windows 10 specifically.

This script contains a good list of changes including a list of hosts to block which you could use to reduce potential information leaks. Obviously you should read/understand all the changes before using it, as it may affect the operation of the OS.

  • Totally agree on switching OS. That script is much needed for Onedrive removal alone (instead of using linux to do it), and the hosts seem very encompassing. Thanks man. – dhaupin Aug 19 '15 at 15:48
5

Since I think this is a battle you can't win, I've resorted to simply not having Internet available by default for my Windows 10 box. Instead, to get access to the internet, you have to go through a firewall with a proxy setup.

If an Application needs internet access, I configure its proxy server settings (but NOT the native Windows proxy). This covers 99% of my needs, as Firefox, Chrome (with plugin) and Thunderbird all have these settings available.

For the other 1% of my Internet needs, I configure the firewall to allow certain IP ranges only (for a few games I play).

This also convienently blocks almost anything that normally annoys me (applications that are not supposed to use the Internet, incessant checking for updates, giving me news, etc..)

Sure, the Tiles etc won't work -- I don't care.

Runs like this for 3 months now, I'm happy.

  • Update on this: for other use cases I now use Proxifier to allow certain applications to go through a Socks5 proxy. You can configure this on a per executable basis. Windows itself still has no internet access. – john16384 Aug 30 '17 at 21:09
1

The literal answer to your question is yes. It is possible to block the type of connections you mentioned.

But in practice there is no foolproof way to prevent your networked windows machines from phoning home or taking remote instructions from Microsoft because, fundamentally, Microsoft - not you -owns your machines. Microsoft's abilities to see your data and change your system are baked into the OS at a basic level and cannot be meaningfully circumvented while retaining normal functionality. In particular, the features of Windows 10 that allow for remote access to and potential manipulation of your files and information have been widely documented and discussed on both stack exchange and the wider Internet.

If you are truly concerned about your privacy and are willing to invest some time and effort I highly recommend investigating the possibility of switching to Debian for a (somewhat) safer, but still user-friendly, environment. But a switch to linux might not be possible for you and if that is the case then you must assume that your data is just as much Microsoft's as it is yours.

  • Agree with the Debian switch. For others reading this, the most vetted Debian distros include Debian itself, Ubuntu, Mint, and ElemantaryOS. Also, in a business environment, you should use the "Long Term Support" (LTS) release(s) for more stable scripts and extended updatability. – dhaupin Aug 19 '15 at 15:52
1

While, I am pretty agree with the previous experts that it's the race you can't win, I am also pretty sure you can try :)
There are lists of such IPs and I am proud to present these lists to you:

All lists are updated frequently by these kind Japan guys.

  • Thanks you + kind Japan guys. That ambiguous subdomain range is helpful to understand, esp at the edge. – dhaupin Feb 14 '17 at 3:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.