Nov

4

Windows Media Player phones home

Filed Under Security, Software 

Windows Media Player 10 and 11 both have developed a nasty tendency to behave like spyware: they report back to their master and do so to a multitude of sites. They automatically retrieve content even if you don't explicitly click Online Stores and/or Guide, simply launching WMP will result into WMP retrieving content.

What is this spyware-like activity?
The spyware-like activity is the automatic downloading of content when you launch Windows Media Player (aka WMP) with an active Internet connection. The content (images, cookies, javascript, etc.) will end up in Internet Explorer's Temporary Internet Files.

This can easily be confirmed by first emptying Internet Explorer's Temporary Internet Files and Cookies, and then launching WMP.

To counter these problems you could simply try to block the offending sites by putting them in your Windows HOST file, and into Internet Explorer's Security-> Restricted Sites, and Privacy areas. But alas, the HOSTS-file method won't necessarily work because Microsoft has decided to implement a strategy to bypass the HOSTS file in certain instances for some microsoft.com URL's.

And you can't simply turn the update function in Windows Media Player (aka WMP) off because you only have the choice between updating every day or week or month.

The result is that you cannot prevent your WMP from contacting Microsoft's sites.

How to prevent WMP from phoning home
To prevent WMP from automatically contacting sites which WMP automatically retrieves content from you'll only have a few options:

1. The best choice is to install a third-party two-way personal firewall such as Comodo, Kerio, ZoneAlarm, etc. In your personal firewall set it to Block/Disallow WMP access to your Internet connection by creating a permanent rule. Or at the very least and perhaps a better recommendation is to set your personal firewall to Ask every time WMP is launched so that permission must be first granted by you rather WMP is allowed to automatically retrieve online content or not.
2. Compile a list of the sites which are loaded by looking into Internet Explorer's Temporary Internet Files and Cookies.
3. Using the list you compiled in #2 block the cookies, scripts, etc., from offending sites in Internet Explorer.

Note: Don't block go.microsoft.com as doing so will break many links that Microsoft utilizes when visiting microsoft.com.

On the other hand: do you really care? It only checks for updates and bypassing the HOST-file is done for security reasons in order to prevent malware from wrecking Windows Update.

In the end it depends on your mindset: do you think that Microsoft spies on you or do you think Microsoft helps you to keep your system safe.

(post witten in cooperation with Andavari)



Comments

2 Responses to “Windows Media Player phones home”

  1. # john sheppard capurro on February 11th, 2007 12:45 PM

    "bypassing the HOST-file is done for security reasons"
    Windows Media Player version 11 (unlike version 9) bypasses our hosts file LAN IP override needed for testing our original music intranet through a router — if this behaviour cannot be amended we will choose alternative media players that do check the hosts file.
    thanks for your comment
    j

  2. # DjLizard on February 12th, 2007 5:19 PM

    Use VLC.

    http://videolan.org

Leave a Reply

Comments are moderated.

If you use the same email address you used in a previous comment that was approved then your comment will bypass moderation.





Comments will be sent to the moderation queue.

Tag motherfucking cloud
Copyright © 2007 DjLizard.net • Powered by WordPress • Using Blue Zinfandel theme by Brian Gardner