About

WindowsSpyBlocker 🛡️ is an application written in Go and delivered as a single executable to block spying and tracking on Windows systems ⛔.

The approach of this project is to capture and interpret network traffic 🚦 based on a set of tools. Depending on the interactions ⛓️ between services and source or destination of traffic, rules are created and sorted by assignment.

Main window of WindowsSpyBlocker

Configuration file app.conf is generated at first launch :

For more info, take a look at Wiki.

Telemetry and data collection

To capture and interpret network traffic, QEMU virtual machines are used on the server virtualization management platform Proxmox VE based on :

• Windows 10 Pro 64bits with automatic updates enabled.
• Windows 8.1 Pro 64bits with automatic updates enabled.
• Windows 7 SP1 Pro 64bits with automatic updates enabled.

Traffic dumps are cleaned monthly and compared with the current rules to add or remove some hosts or firewall rules.

Tools used to capture traffic :

• qemu -net dump : capture
• Wireshark : capture + logs
• Sysmon : capture + logs
• Proxifier : logs

The data folder contains the blocking rules based on domains or IPs detected during the capture process :

• data/<type>/extra.txt : Block third party applications (Skype, Bing, Live, Outlook, NCSI, etc.)
• data/<type>/spy.txt : Block Windows Spy / Telemetry recommended
• data/<type>/update.txt : Block Windows Update
• data/hosts/[extra|spy|update]_v6.txt : Handle IPv6 blocking for hosts

Firewall and Hosts data are the main types. The others are generated from these as :

• DNSCrypt : a protocol for securing communications between a client and a DNS resolver.
• OpenWrt : an open source project used on embedded devices to route network traffic.
• P2P : a plaintext IP data format from PeerGuardian.
• Proxifier : an advanced proxy client on Windows with a flexible rule system.
• simplewall : a simple tool to configure Windows Filtering Platform (WFP).

And about data collection, you can read the Telemetry collection page for more info.

Projects using WindowsSpyBlocker

• BlackArch Linux : an Arch Linux-based penetration testing distribution for penetration testers and security researchers.
• Blackweb : URLs Blacklist for Squid
• BlahDNS : A small hobby ads block dns project with doh, dot, dnscrypt support.
• DNSCrypt Proxy : A flexible DNS proxy, with support for encrypted DNS protocols.
• Energized Protection : Let's make an annoyance free, better open internet, altogether!
• FilterLists : An independent, comprehensive directory of filter and host lists for advertisements, trackers, malware, and annoyances.
• LEDE Project : A Linux operating system based on OpenWrt.
• Mikrotik hosts parser : An application that blocks "advertising" for routers based on RouterOS.
• OpenWrt adblock package : DNS based ad/abuse domain blocking
• OPNsense : An open source, easy-to-use and easy-to-build HardenedBSD based firewall and routing platform.
• pi-hole : A black hole for Internet advertisements (designed for Raspberry Pi).
• simplewall : Simple tool to configure Windows Filtering Platform (WFP).
• void-zones-tools : A list of void zones that can be readily feed into Unbound on FreeBSD.
• WPD : Customize Group Policy, Services and Tasks, responsible for data collection and sending, as you like.

How can I help ?

All kinds of contributions are welcome 🙌!
The most basic way to show your support is to star 🌟 the project, or to raise issues 💬
But we're not gonna lie to each other, I'd rather you buy me a beer or two 🍻!

License

MIT. See LICENSE for more details.
Icon credit to Icons8.