New Windows 7 'security-just' update installs telemetry/snooping, uh, feature

Three years agone, Microsoft promised to keep Win7 and 8.one updated with 2 tracks of patches - Monthly Rollups that include everything and "security-only" patches that are supposed to be limited to security fixes. Judge what but happened.

Windows security and protection [Windows logo/locks]
Thinkstock / Microsoft

Back in October 2016, Microsoft divided the Win7 and eight.1 patching worlds into 2 parts.

Those who got their patches through Windows Update received so-called Monthly Rollups, which included security patches, bug fixes – and nosotros frankly don't know what else – rolled out in a cumulative stream.

The folks who were willing to download and manually install patches were also given the choice of installing "security-only" patches, not cumulative; these were meant to address just the security holes.

...From October 2016 onwards, Windows will release a single Security-simply update. This update collects all of the security patches for that month into a unmarried update. Unlike the Monthly Rollup, the Security-but update will just include new security patches that are released for that month. Individual patches will no longer be available.... The security-but update will permit enterprises to download as small-scale of an update as possible while all the same maintaining more than secure devices.

Nosotros've had lots of problems with the security-only patches in the intervening three years, with well-nigh of the difficulties tied to bugs created by the security-only patches that are stock-still in Monthly Rollups.

Those who use Windows Update to get their Win7 patches have been treated to all sorts of extraneous stuff, including the infamous snooping (or should I be politically correct and call it "telemetry"?) patch KB 2952664 .

Now comes discussion that the July security-just patch, KB 4507456, includes an unexpected bonus. Snooping, er, telemetry.

According to an eagle-eyed anonymous tip on AskWoody :

The "July nine, 2019— KB4507456 (Security-simply update)" is Not "security-merely" update .

It replaces infamous KB2952664 and contains telemetry. Some details can be found in file data for update 4507456 (keywords: "telemetry", "diagtrack" and "appraiser") and under http://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=7cdee6a8-6f30-423e-b02c-3453e14e3a6e (in "Package details"->"This update replaces the following updates" and there is KB2952664 listed).

As @PKCano explains :

Microsoft included the KB2952664 functionality (known as the "Compatibility Appraiser") in the Security Quality Monthly Rollups for Windows 7 dorsum in September 2018. The move was announced past Microsoft ahead of time.

With the July 2019-07 Security Only Quality Update KB4507456 , Microsoft has slipped this functionality into a security-just patch without whatever warning, thus adding the "Compatibility Appraiser" and its scheduled tasks (telemetry) to the update. The package details for KB4507456 say information technology replaces KB2952664 (amid other updates).

Come on Microsoft. This is not a security-only update. How exercise you justify this sneaky behavior? Where is the transparency now.

Windows guru @abbodi86 has looked at the internals of the patch and concludes :

Disabling (or deleting) these schedule tasks after installation (before reboot) should be enough to turn off the appraiser

\Microsoft\Windows\Application Experience\ProgramDataUpdater
\Microsoft\Windows\Awarding Experience\Microsoft Compatibility Appraiser
\Microsoft\Windows\Application Feel\AitAgent

only it'south all-time to wait until next month to meet if the Security-but update comes clean

I've found no indication that the Windows 8.1 Security-only patch has been similarly subverted.

Argue amid patch cognoscenti rages . Some feel that Microsoft is justified in adding telemetry to the final vestiges of Win7 – due for the chip heap in January. Most come across a fundamental cant at play, with yet more Windows snooping software getting installed without forewarning or consent…, this time in a "Security-only" patch for heaven's sake.

Security veteran Dr. Vess Bontchev put it simply :

I accept officially stopped updating my Win7 car. I no longer trust Microsoft's updating process. I'll protect it from any existing and time to come vulnerabilities with my other defenses, as well every bit I can.

Even if Microsoft'southward motives are clean equally the driven snow, I find it difficult to justify this kind of contempt for Windows vii customers. Unfortunately, with just vi months of support left for the former OS, it seems unlikely that any regulatory torso will have MS to task.

Join the debate on AskWoody .

Copyright © 2019 IDG Communications, Inc.