crazy-max / WindowsSpyBlocker

Block spying and tracking on Windows

Home Page:https://crazymax.dev/WindowsSpyBlocker/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

WSL

realizelol opened this issue · comments

Behaviour

Start-BitsTransfer should download Ubuntu 20.04 (WSL) but transfer is blocked when blocking a.ads2.msads.net + b.ads2.msads.net + ec.atdmt.com.

Steps to reproduce this issue

  1. Start-BitsTransfer -source https://aka.ms/wslubuntu2004 -destination 'Ubuntu.zip'
  2. Add IP to outgoing firewall rule and block it.
    (a.ads2.msads.net -> cs9.wpc.v0cdn.net)
    (b.ads2.msads.net -> cs9.wpc.v0cdn.net)
    (ec.atdmt.com -> cs9.wpc.v0cdn.net)
    (aka.ms/wslubuntu2004 -> wsldownload.azureedge.net-> cs9.wpc.v0cdn.net)

Expected behaviour

Start-BitsTransfer should download Ubuntu 20.04 (WSL) file.

Actual behaviour

Transfer is blocked.
IP 152.199.19.161 is NOT blocked in firewall/spy.txt which is fine!

Rules used

  1. data/firewall/spy.txt
  2. data/hosts/spy.txt

Configuration

Country (ex. United-States) : DE / Germany

Operating system (ex. Windows 10 Pro 64 bits) : Windows 10 Pro 64bit

Winver screenshot : Microsoft Windows [Version 10.0.19042.630]

@realizelol Cannot reproduce your issue:

PS C:\tmp> Start-BitsTransfer -source https://aka.ms/wslubuntu2004 -destination 'Ubuntu.zip'
PS C:\tmp> dir


    Répertoire : C:\tmp


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----        04/06/2020     00:43      452997756 Ubuntu.zip

Also https://aka.ms/wslubuntu2004 redirects to https://wsldownload.azureedge.net/Ubuntu_2004.2020.424.0_x64.appx which is not blocked by spy rules.

Thanks for your reproduction!

Seems to be related to resolving all domains to ip and then block it in windows firewall:

foreach ($domain in $domains) {
  foreach ($ip in (Resolve-DnsName $domain -ea SilentlyContinue).IP4Address) {
    $ips += $ip
  }
}

I've tested this with (...)\etc\hosts so I have to do something else to bypass the Win Defender FalsePositive..

best regards
realizelol