Since the Anniversary Update of Windows 10, the personal assistant Cortana comes built-in. We identified the cookie Cortana AppUID in every query the Windows 10 client sends to. An overview is given in the following table: Server Furthermore, the Windows 10 client repeatedly sends extensive telemetry data to Microsoft server. At this point, any connection to would not be necessary. The complete search string as well as multiple prefixes of it are sent while you are typing. In general, there are two types of connections: Bing queries and telemetry data.Ī local search in the Windows start menu leads to multiple queries to. In an analysis of the recorded network packet traces we identified several connections to Microsoft servers.

We benefit from Microsoft not using Certificate Pinning in this case, which means the client accepts any certificate in its certificate store. Our final Setup is shown in the following figure: The privacy settings are set to the most restrictive values according to the TechNet article Manage connections from Windows operating system components to Microsoft service.

In our setup, we use a newly installed Windows 10 Enterprise client without any additional software. We use a Windows 10 Enterprise client (Version 1607 – Build 14393.447) and activate this level. Some Windows 10 versions (Enterprise, Education, and IoT Core editions) support an additional telemetry level, telemetry level 0: security.

Our focus is to identify and analyze the traffic of a Windows 10 client with the most restrictive privacy settings activated. To do this we use a Raspberry Pi 3, which is a single-board computer the size of a credit card. Since all telemetry communication is encrypted, we need to perform a man-in-the-middle attack. Now our goal is to analyze the communication by monitoring the data being sent. soft ScheckĪlready identified this traffic in an earlier analysis. Windows 10 has been observed to establish encrypted connections to Microsoft servers without a direct related user interaction. The focus of this research is to analyze the amount of privacy provided in Windows 10 when using the most restrictive privacy settings available.

Windows 10 business edition