My application ran away and called home from Redmond
I think the key quote here is"This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel."As a user, you can just disable automatic sample submission. In fact I'm pretty sure you can set it during installation, as I've never had to go through the settings to disable it, but it's still disabled on all my installations.But the question is, from an adversary perspective, does your victim have it disabled?Most likely they won't, so you can use Microsoft as a mule to exfiltrate data from otherwise firewalled victims.