this post was submitted on 28 Jun 2024

85 points (94.7% liked)

Privacy

29764 readers

998 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

Chat rooms

[Matrix/Element]Dead
Discord

much thanks to @gary_host_laptop for the logo design :)

founded 4 years ago

MODERATORS

[email protected]

Windows 10 shows Linkedin Learning Ads on Login Screen (infosec.pub)

submitted 3 days ago* (last edited 3 days ago) by [email protected] to c/[email protected]

18 comments fedilink hide all child comments

Hi all,

First off: Can't switch to Linux, Windows is a work requirement. Please spare me.

With that out of the way, here's my problem:

Since 2-3 days I've been seeing ads disguised as a minimized video player popup on my Windows 10 Login Screen .

Initially I thought I might have been watching something on youtube and forgot to close the tab and it autoplayed in the background until reaching this stuff by chance; but that turned out not to be the case (I'm also using Firefox exclusively, which I thought wouldn't integrate with Windows, but I wasn't 100% sure on that end).

I tried to research this a bit, but the only similar case I found was in an old reddit thread saying that some Windows update installed the LinkedIn App for them, which is not the case here.

Antivirus (Bit Defender) and Malwarebytes both give me a clean report.

So I did some more digging and right click that thing with my firewall set to deny all to figure out where this is taking me, and surprise...

There's a total of 100 connection attempts from Windows Search to around 10 different IP addresses, all of which belong to Microsoft.

I have not installed any updates in the last 14 days, no new software, and have not changed any system settings.

What did change is that I am currently not in China, where I normally live, but am on a business trip to Malaysia, where a bunch of services that are blocked in China might be accessible, and are now splicing in those (somewhat disguised) ads.

Does this happen to anyone else, and if so, do you have an idea how to get rid of it?

Thanks a lot in advance!

all 19 comments

sorted by: hot top controversial new old

[–] [email protected] 24 points 3 days ago (1 children)

Windows detects media being played and shows you that inlay with controls. It must be detecting that stream somewhere being played, even if it isn't obviously playing in a browser tab. You should be able to control whether it shows media controls on the lock screen.

[–] [email protected] 10 points 2 days ago (1 children)

Been poking around a bit more, and found another entry in the Firewall that comes up right on boot, which is a service called MS.Edge.Webview2, which seems to be triggered through the Teams App (that I did have on autostart). I've now completely uninstalled Teams, and after a fresh boot the ad (or "media control") seems to be gone now. Guess I'll be using Teams from my phone or via browser in the future. No idea how that happened though, I never played any video through Teams.

[–] [email protected] 3 points 2 days ago (1 children)

Glad you got it sorted. Weird about teams though. Have a good one!

[–] [email protected] 1 points 2 days ago

Yeah it's very weird, no idea what happened there. Maybe someone had somehow sent me a link and it was looping in the background? No clue. I gave up trying how teams and teams groups work a long time ago, the implementation is a major shitshow.

[–] nickhammes 6 points 3 days ago (1 children)

I haven't had this happen personally, but are you allowed to edit your hosts file? I'm assuming those IP addresses are coming from DNS resolution, and if you hardcode those DNS entries to resolve to 127.0.0.1, it'll stop the ads.

nslookup <ip address> should give you the domain names, if not there's DNS logs in Event Viewer that should tell you.

[–] [email protected] 6 points 3 days ago (1 children)

Yep I can access the hosts file, that's a great idea. Will give it a shot. I just hope those aren't IPs that MS is using for genuine requests of applications I have to use such as Teams or Outlook... But will give it a try, at least if anything else breaks, I know what to do to resolve that. Thanks for the tip!

[–] [email protected] 1 points 1 hour ago

I use the whole 365 suite, including cloud pc, provided by my work, on Fedora. I block a whole lot of stuff, and everything works, minus the annoying ads and pushy up sales.

YMMV, but I strongly suggest you start blocking crap at the hosts level, if something breaks, start unblocking.

[–] [email protected] 0 points 3 days ago

Ads on a login screen? That's disturbing.

For people automatically saying to switch to Linux, it's because they have never had a job in tech to know it doesn't work that way, and have never worked in production. There are several industries where if you don't run Windows you can't have a job because all of the software is only designed to run on Windows in their industry.

[+] [email protected] -29 points 3 days ago (2 children)

First off: Can’t switch to Linux, Windows is a work requirement. Please spare me.

Did they give you a very funny reason for this requirement, or is it just some windows exclusive garbage that doesn't work in wine?

[–] [email protected] 35 points 3 days ago* (last edited 2 days ago) (2 children)

Did they give you a very funny reason for this requirement, or is it just some windows exclusive garbage that doesn't work in wine?

Why do people always ask this kind of crap?

If you have a corporate laptop, it will likely have a suite of software centrally managed by your company's IT department.

It will contain software that is also centrally licenced so that your boss doesn't have to figure out how to pay for thousands of dollars of software, they can just tell IT to bill a licence for software X to your cost centre at $13.75 a month.

It will have a domain login that is your corporate identity which will usually require multi factor authentication.

It will have some corporate VPN solution which operates mostly transparently and requires zero setup on your part.

It will contain company sensitive data which will usually be encrypted by bitlocker, whose keys are stored with your domain account.

It will have the usual Teams/Outlook/SharePoint stuff with a centralised calendar and contacts for your company, and likely security classifications for all the communications you do through it, allowing you to join groups, accept invites to restricted groups, and limit access, all linked to your domain account.

It will have mapped drives to your corporate file storage , again, all linked to your domain account.

It will probably have OneDrive, synced to a corporate server, again, linked to your domain account.

It will have a printing solution that is linked to your domain account so that your printers follow you wherever you go and you can easily find and print to the secure print queue on some random printer you happen to walk past in one of your offices, so you can enter your PIN or swipe your access card and have that IMPORTANT_SECRET_RESEARCH.DOC file print while you're standing in front of the printer.

And finally, your work laptop does not belong to you. Wiping it and installing Linux plus Wine and keeping company sensitive data on an unmanaged device will attract the ire of HR.

Your IT department won't give a crap. But they also won't help if anything doesn't work, such as trying to join a domain to access allllll those domain-linked features with an unauthorised device.

They will simply re-image your laptop to bring it back to a known state that they can deal with, because they are dealing with thousands of devices. They need everything to be homogeneous simply because they don't have the manpower to manage anything else or to audit a million different configurations for security issues or data leaks.

So no, suggesting Linux + Wine to run some "windows exclusive garbage" isn't an answer here.

[–] autonomoususer -1 points 2 days ago* (last edited 1 day ago) (1 children)

This kind of reply is never convincing so, rather than promote proprietary software, here's the real answer:

You are likely not hired to remove Windows, so why give them extra work for free?

[–] [email protected] 1 points 2 days ago

Despite being the centrally managed solution most companies chose, it also is, let’s face it, a completely capable OS that’ll happily run most software without recompiling your kernel twice a day. (My Linux days are long gone, I know things are supposedly easier today.)

Sure, it’s sometimes annoying to use and I might take longer to do my job on it. It also might spy on you. But then, I’m being paid by the hour and I don’t do private shit on my work computer, so yeah, what gives.

[–] [email protected] 16 points 3 days ago (1 children)

I live in China, policies are to be followed. There is no "but", and I rather pick a nicer hill to die on, when it comes to that.