Huge security flaw! Microsoft remembers me in new machines and offline account!

[jen2]

Huge security flaw! Microsoft remembers me in new machines and offline account!

When making new machine I install new windows from scratch on a new formatted hard!

Only when making machines with the same name and the same offline user name, Windows play store will show me downloaded apps from other machines and the date of installing these apps.

I always make machines for test purposes only, all have the name "Jen" with an offline account user name "Jen" with no password. when  deleting the machine and making a new machine with name "Jen" and offline user "Jen", Microsoft play store will show my the downloaded apps with downloaded dates from old deleted machine!! how? there must be some type of fingerprints?

Is it possible that VMWare associates the machine ID associated with the machine names?

When changing either the machine name or the offline username, Microsoft play store will not show any history of downloaded apps.

I tired to make a new machine named "J" with offline user "J", download apps, deleted the machine, make a new one named "J" with offline user name "J", and guess what, the apps I downloaded in the deleted machine are there"

[scott28tt]

Isn’t this just a Microsoft thing rather than having anything to do with Workstation Player?

In other words, would the same thing happen with Windows on a physical machine if you wiped the hard drive and did the same when you installed Windows?

[jen2]

Nope, it is a VMWare issue, and it means that there are fingerprints can be traced.

If Microsoft, a none hacking company that doesn't trace users, can trace and identify vmware machine, it is a sure thing that hackers and intelligence agencies can trace vmware machine.

Intel stopped serial numbers its CPUs cause it can be used to trace people. Vmware is doing something, not in purpose, that makes its machines be traced.

I am uninstalling VMware until this issue can be addressed, cause there are fingerprints allow me to be traced for sure

[scott28tt]

How do you know for certain that it’s a VMware-specific issue?

If you delete a VM, all the files associated with that VM are deleted.

Sounds like it is Windows reinstalling those apps, and that the same would happen on a physical system if you wiped it and installed Windows again.

[jen2]

Nope, the apps in the history are not Microsoft apps, they are apps I want to test. And they will be listed in the history with the exact date purchased from the deleted machines!

Exactly, when deleting a machine, all files are deleted, and when making a new machine new files created, So there is something in VMWare workstation, a flaw, that lets Microsoft recognize me. it is called fingerprints

Again, it is only when using the same name for both the machine and the offline user

[Technogeezer]

---

@jen2 wrote:

If Microsoft, a none hacking company that doesn't trace users

---

Microsoft is collecting information on you every time you install Windows and every time you use their app stores. Do you have a Microsoft account (you indicate you use the Windows Play store, so I assume you have a Microsoft account)? Go into your user account - they have your computer name as well as the applications you've downloaded against the user account. And if you have OneDrive, they're syncing information from your computer. 

As @scott28tt says, you might want to see what happens if you do the same thing with a physical machine and see if you get different results. My guess is, you won't. 

One question - could you be a bit more specific about what "history" are you talking about? If it's the Microsoft store - then yes, they have all the apps that you purchased under that Microsoft ID.

[jen2]

Microsoft collect data anonymously, and doesn't associate it with users, read its privacy policy.

And no, I don't use Microsoft account, I use offline account, and there is no way Microsoft will know me, other than fingerprints in VMWare machine.

I used the word purchased, cause Microsoft play uses it! No, I don't purchase apps, it is just the downloaded date.

Please read carefully before you reply, and you try to think that I am stupid, no, read my comments carefully please

And I can't try it on physical machine, cause I have one laptop, but you can try what I explained and confirm it yourself

[jen2]

I may try it on VirtualBox and return, but even if VirtualBox gives the same results that means both have a flaw of exposing fingerprints.

[jen2]

@Technogeezer  If I use another Machine name, with same user "Jen" Microsoft will not recognize me.

They are fingerprints associated with the machine name!

That means there are fingerprints are exposed!

[Technogeezer]

No, we don't think you're stupid - sometimes we have to ask questions that might seem basic to assess what's happening and help out. Most of us are users here just like you trying to help.

If you're going to try VirtualBox, see if the behavior happens on the very first installation of Windows on Virtual Box.

[Technogeezer]

I agree that something is keeping track of what you're doing. It's just that from our experience everything that VMware knows about your VM is encapsulated in the virtual machine configuration files, particularly the .vmx file. Deleting a virtual machine and its files should get rid of that. And VMware has no way of knowing what you installed from any Microsoft store - that's between you and Microsoft.

By "changing the machine name", do you mean the VM name as you see it in the Workstation GUI, or do you mean the VM's hostname that's configured within the Windows VM?

You still have not proven whether either VMware or Microsoft is the culprit by changing the machine name - which I am interpreting is the Windows system name/hostname . All you now know is that whatever was happening for a machine named "Jen" is not happening for the new machine name.  As a first step at things that *might* be construed as a "fingerprint", examine the .vmx file of each of your VMs and see if these settings are the same:

• uuid.bios
• uuid.location
• ethernet0.address (which is the VM NIC's MAC address). 

[jen2]

By changing the machine name, I don't mean changing the name of the existing machine, I mean when creating a new machine I will use another name. and it is the one you can see in the UI,

I checked, uuid.bios and uuid.location are the same when the you use the same VM name. They will be changed when changing the name of the VM upon creating new machine.

I will try this, changing uuid.bios and uuid.location values manually with the same VM and check, it could be MS using these values to recognize PCs.

[jen2]

@Technogeezer  BTW, I disable all MS telemetries, no way MS will collect any data of me, not even windows update can collect data about my PC, only windows apps store etl files are collected and that is why I use VM to test them!

[scott28tt]

I didn’t say anything about them being Microsoft apps.

I am inclined to believe that it is Microsoft recognising your Windows installation, whether you install in a VM over and over again or on a physical system over and over again.

[jen2]

@scott28tt  When using another VM name Microsoft will not recognize my PC.

It is something with VMware mchine names, as @Technogeezer  said it could be the UUID as I found they are associated with the VM name.

I will test now and return!

[scott28tt]

It’s still Microsoft doing the “recognising” though, which isn’t a VMware-related security flaw in my book, given that I expect the same would happen on a physical system…

[jen2]

@scott28tt  But it is VMware exposing fingerprints, I am not worried about Microsoft recognizing (identifying) my PC, I am using the same offline user name "Jen"

It is the idea that there are fingerprints that are exposed, and could be used to track users! And it is VMWare responsibility to close them!

As I said, Intel stopped serial number its CPUs since Pentium 3 (1999) as they can be used to trace users!

[scott28tt]

Perhaps if you were more specific by what you mean by “fingerprints” and what sort of “tracking” you mean and are worried about, that would help.

I remain intrigued as to what would happen with a physical system, only then can it be concluded where any issue lies…

[jen2]

@scott28tt  I can understand your bias, if I knew what the fingerprints were I would not have started a thread to ask, it would be more likely a feedback thread!

@Technogeezer  It is only the uuid.bios!

Apparently uuid.bios is just a hash of the machine name (and maybe other values), but it seems that you can change it later. So I made a new VM named "Jen" as usual, and I changed just the last number of both uuid.bios and uuid.location, upon start the VMI got this message if I moved or copied the machine, so the uuid.location is just a hash for the physical address on the host, I clicked on I moved it, and the uuid.location was restored as before modification. I installed Windows and made an offline user named "Jen" and the App store didn't show me the history of my downloaded Apps, so it is the uuid.bios.

I restored the uuid.bios to it is original hash associated with the VM name "Jen"  and Windows app store is still not showing me the history of downloaded apps. So Microsoft Identify a PC using uuid.bios only when installing Windows.

I tried to remove uuid.bios, but VMWare restored it automatically using the VM name to generate it.

So basically, Microsoft uses the uuid.bios to identify PCs, which I think it is not a good reputation for Microsoft. Microsoft should not collect any data associated with hardware!

VMWare generates uuid.bios using the VM name (and maybe the location or other values), which is a privacy risk, VMWare should generate uuid.bios randomly and VMWare should make an option to remove the uuid.bios for more privacy!

@scott28tt  My laptop doesn't have uuid.bios, others do have it, so it is not happening in every hardware, but even if it is the case, a VM should provide more privacy than the hardware, only in this case VMWare "virtual" machines has exposed me more than my physical hardware.

[bluefirestorm]

Every machine whether physical or virtual has a UUID (even Apple Macs have them!). I think you would really need to have a very, very old machine to not have a UUID.

In Windows (whether physical or virtual), you can see this using a tool such as HWInfo64 and you can see it under

Motherboard -> SMBIOS DMI -> System -> UUID

There is also the Product Serial Number,

The fact it appears under DMI, it is part of a hardware vendor standard https://www.dmtf.org/standards/smbios

I think the UUID mechanism is how Microsoft keeps track of whether Windows licence is activated against a particular hardware (or at least one of the factors).

If presented with Moved It or Copied It dialog, if you answered "I moved it", the default behaviour of VMware is to NOT generate a new UUID (that is why you don't have to reactivate a Windows 7/8/10/11 licence if you answered "I copied it"). Other software (not just Microsoft) that require per seat licensing may also make use of UUID so fiddling around UUID is generally not a recommended action.

As for Windows 10, starting with 21H1, with Home Edition you cannot avoid creating an online account (although I think you could turn it off after the setup but the online account is already associated with that hardware). I think with Professional Edition, you still can avoid online account sign in but you have to disable internet during setup. The last version that lets you choose "Limited Experience" and proceed with an offline account only is 20H2. I don't know about Windows N (I haven't tried), since N is primarily due to the EU settlement, it might let you avoid it on account of GDPR.

Microsoft generally associates a lot of online stuff now. Even with Office 365 subscription, you cannot choose "Sign out" after activating an installation.