Windows Error Reporting: Difference between revisions

Revision as of 11:36, 28 August 2017

Revision as of 16:29, 28 January 2018

Line 50:

Older versions of WER send data without encryption; only WER from [[Windows 8]] uses TLS encryption.<ref name="wsense2013-12"/> In March 2014, Microsoft released an update (KB2929733) for Windows Vista, 7 and Server 2008 that encrypts the first stage of WER.<ref>{{cite web|title=The first stage of the WER protocol is not SSL encrypted in Windows|url=http://support.microsoft.com/kb/2929733|publisher=Microsoft|accessdate=10 January 2015|date=11 March 2014}}</ref>

In December 2013, an independent lab found that WER automatically sends information to Microsoft when a new USB device is plugged to the PC.<ref name="wsense2013-12">{{cite web|url=httphttps://communityblogs.websenseforcepoint.com/blogs/securitylabssecurity-labs/archive/2013/12/29/drare-watson.aspxyour-windows-error-reports-leaking-data|title=Are Your Windows Error Reports Leaking Data? |date=29 Dec 2013 |publisher=Websense Security Labs|accessdate=4 January 2014}}</ref>

According to ''[[Der Spiegel]]'', the Microsoft crash reporter has been exploited by NSA's [[Tailored Access Operations|TAO]] unit to hack into the computers of [[Secretariat of Public Security (Mexico)|Mexico's Secretariat of Public Security]]. According to the same source, Microsoft crash reports are automatically harvested in NSA's [[XKeyscore]] database, in order to facilitate such operations.<ref>[http://www.spiegel.de/international/world/the-nsa-uses-powerful-toolbox-in-effort-to-spy-on-global-networks-a-940969-2.html Inside TAO: Documents Reveal Top NSA Hacking Unit]</ref>