Wait, what. Windows 10 sends info on USB devices plugged in directly to Microsoft?
And it does that using pure HTTP?
https://pastebin.com/ttYp5rLg
You gotta be kidding me.
@rysiek
As early as Windows 7, when you opened up the Devices and Printers control panel, there was an option to "Obtain device information from the internet" (or some wording to that effect) which would retrieve graphics for printers and such, so they wouldn't show up with generic icons. I wonder if this is *that*, but perhaps without asking for permission, and of course being done insecurely as it may have been all along.
Windows 7+: Device Metadata Packages Show more
Windows 7+: Device Metadata Packages / Security Show more
Windows 7+: Device Metadata Packages / Security Show more
Windows 7+: Device Metadata Packages Show more
@tw ugh. But why does it do this via HTTP?..
I wonder if there's a vulnerability there somewhere. Anybody up for some fuzzing? What happens when somebody MITMs the HTTP connection and sends back some random data?..