Windows file updates

I reported last week that the Windows Update routine was quietly changed a few months ago to upload to Microsoft your Product ID and a list of your hardware. Prior to the change, Microsoft merely downloaded a list of all available fixes. Your PC then figured out which ones you didn't have without sending any data back to the software giant.

Free IT resource Open Source Business Conference (OSBC) May 22-23, 2007 Sponsored by OSBC Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft

I quoted a Microsoft spokesman who said no one is forced to use Windows Update, and in any event, its new mode of operation is in compliance with the privacy statement posted at Microsoft's site. If you wish to see for yourself what data Windows Update is transmitting, you can get a technical paper and a set of small monitoring utilities from tecChannel, an IDG site in Germany . (The cost is a mere 1.99 euros, about $2.20. See http://www.tecchannel.de/betriebssysteme/1126.)

In this column, I delve deeper into how Windows Update's new "phone home" process works, based on tecChannel's analysis. Understanding this process is an important way for you to predict Microsoft's future plans in three areas: your Product ID, your hardware, and your software.

Product ID. Recent copies of the Windows CD bear a 25-character string called the Product Key. When a retail version of Windows is installed, you type in this string, and the operating system generates a 20-digit code called the Product ID. You can see your ID by right-clicking the desktop icon called My Computer and then clicking Properties.

The ID's middle 10 digits uniquely identify the Product Key that was used to install Windows. The additional digits comprise a digital signature. The middle 10 digits, plus the Product Key from which they were derived, are now being sent to Microsoft when Windows Update runs.

Hardware. The new Windows Update contains a function called GetSystemSpec. Among other things, this function transmits to Microsoft the make and model of all installed drives, PCI boards, and other hardware components. For plug-and-play devices, the vendor and device ID numbers are listed, identifying makes and models.

Software. Windows Update does not yet upload a list of installed software. But the routine already contains a section that can extract the Registry's software subkeys. If implemented, this would record your versions of Mozilla, QuickTime, or any other applications.

tecChannel writer Mike Hartmann speculates that Microsoft has prepared these capabilities to sell updates and deny them to those who don't pay. "Supplying certain updates only to users that have a support contract," he writes, "seems to have been a requirement during the design of Windows Update, although this feature is not currently used."

I once wrote about a plan to split Microsoft into two companies, one named Microsoft and a second called Patchsoft, which would sell fixes for Microsoft software. I guess I wasn't joking.