-->

Thursday, July 11, 2019

author photo

Technology - Google News


Did Microsoft just drop the Telemetry bomb on Windows 7 users without telling anyone? - Ghacks Technology News

Posted: 11 Jul 2019 04:55 AM PDT

Microsoft released security updates for all supported operating systems on the July 2019 Patch Day. Windows 7 administrators get to choose between a security-only update or a monthly rollup update. The main difference between the two is that security-only supposedly only contains security related patches while the monthly rollup update may also include non-security changes.

KB4507456, which is this month's security-only update, seems to have included more than just security patches for the various components of the Windows 7 operating system. According to reports, installing the security-only update replaces the notorious KB2952664, the Compatibility update for keeping Windows up-to-date and also making sure that upgrades to Windows 10 work as expected.

With the July 2019-07 Security Only Quality Update KB4507456, Microsoft has slipped this functionality into a security-only patch without any warning, thus adding the "Compatibility Appraiser" and its scheduled tasks (telemetry) to the update. The package details for KB4507456 say it replaces KB2952664 (among other updates).

microsoft-windows 7 telemetry bomb

Tip: Guide on Blocking Telemetry in Windows 7 and 8.1

The release sparked fear among some admins that Microsoft might have dropped the update in preparation of Windows 7's support end and the expected push of Windows 10 on these systems.

This is not the first time that Microsoft slipped Compatibility Appraiser into a security-only update. The company did so in September 2018 for Windows 7 but informed users and administrators about it in advance.

The July 2019 seems like a repeat of that but without the warning. Once installed, a new scheduled task is added to the system under Microsoft > Windows > Application Experience.

Ed Bott picked up the story on ZDnet confirming that the security-only update did in fact include the Compatibility Appraiser tool. Bott suggests, however, that there might be another simpler explanation for the inclusion: that the tool itself had a security issue that Microsoft fixed with the release.

Bott presents no evidence on the other hand that the update fixed security issues in the Appraiser tool. Given the lack of data, I would not be too quick to dismiss the hypothesis. For now, all we know is that Microsoft did push the update to Windows 7 devices as part of the security-only update. It could be another case of Microsoft just being Microsoft.

Communication and openness has improved in recent years at Microsoft but as Bott points out, there are still issues "where the company's stubborn silence is baffling".

Support for Windows 7 ends in January 2020 and Microsoft started to show notifications about the upcoming end already. The company promised, however, that it would not run another Get Windows 10 campaign on user devices.

Enterprise customers may purchase up to three years of support extensions that costs them $50, $100, and $200 per user and year respectively.

Summary

Did Microsoft just drop the Telemetry bomb on Windows 7 users without telling anyone?

Article Name

Did Microsoft just drop the Telemetry bomb on Windows 7 users without telling anyone?

Description

KB4507456, which is this month's security-only update, seems to have included more than just security patches for the various components of the Windows 7 operating system.

Author

Martin Brinkmann

Publisher

Ghacks Technology News

Logo

Advertisement

Let's block ads! (Why?)

Google goes after whistleblower who revealed it sends voice recordings for transcription - The INQUIRER

Posted: 11 Jul 2019 02:43 AM PDT

Google goes after whistleblower who revealed it sends voice recordings for transcription

Well, you chose to put that thing in your house

GOOGLE ASSISTANT devices are recording users and sending the data for transcription, sometimes without a wake-word, according to a new report.

Virtual assistant devices are supposed to listen for the "OK Google" or "Hey Google" commands (or 'Alexa', 'Hey Siri', 'Hey Cortana' or 'You keep out of this, Bixby'), wiping every fraction of a second if they haven't heard it.

It was established recently that Amazon's Alexa recordings are sent for transcription, in order to improve the language skills of the AI that powers it.

Now it would seem that Google is doing exactly the same and sometimes it does so when it hasn't been asked.

A Belgian whistleblower told VRT News about the issue, and it was able to personally identify the address of two sets of recordings from the content, and neither set had an "OK Google" command at any point.

The whistleblower, who went to VRT after hearing the allegations surrounding Alexa, confirmed that he worked for a sub-contractor, paid by Google, to transcribe and annotate recordings, including presumptions of the speaker's age and other demographics.

The report suggests that the whistleblower works at what is likely to be hundreds of global locations, all doing the same work, eavesdropping on everything from our bank details to the noises we make in the bedroom. Just… yuck.

What's particularly notable about this is the fact that nowhere in Google's T&Cs does it mention anything about recordings being listened to by another human being. That's the sort of thing you'd think it'd want to make clear.

Google says it only transcribes about 0.2 per cent of the total number of recordings it receives (because that's alright then) and that it uses the data to improve voice recognition (as is Amazon's defence too). 

"We partner with language experts around the world to improve speech technology by transcribing a small set of queries - this work is critical to developing technology that powers products like the Google Assistant," it said in a statement given to INQ.

"Language experts only review around 0.2 per cent of all audio snippets, and these snippets are not associated with user accounts as part of the review process.

The whistleblower says that those doing the work were given no guidance as to what to do if they heard someone in danger or undertaking something illegal, adding that there were regular arguments between couples, make-up sex noises and, in some cases, concern over the welfare of the voice at the other end.

Rather than confront this, Google has suggested its more interested in finding the whistleblower for breaching its security policies than righting the wrong.

"We just learned that one of these reviewers has violated our data security policies by leaking confidential Dutch audio data," it said. "Our Security and Privacy Response teams have been activated on this issue, are investigating, and we will take action. We are conducting a full review of our safeguards in this space to prevent misconduct like this from happening again."

Although Google says that data is anonymised before it is sent, this first-hand account suggests that it's not hard, in some cases, to work out exactly who is talking and what they're up to.

We'd quite like an explanation of that too, please Google. μ 

Further reading

Let's block ads! (Why?)

This post have 0 komentar


EmoticonEmoticon

Next article Next Post
Previous article Previous Post