WindowsSpyBlocker 🛡️ is an application written in Go and delivered as a single executable to block spying and tracking on Windows systems ⛔.

The approach of this project is to capture and interpret network traffic 🚦 based on a set of tools. Depending on the interactions ⛓️ between services and source or destination of traffic, rules are created and sorted by assignment.

Main window of WindowsSpyBlocker

Configuration file app.conf is generated at first launch :

For more info, take a look at Wiki.

To capture and interpret network traffic for the telemetry option, QEMU virtual machines are used on the server virtualization management platform Proxmox VE based on :

• Windows 10 Pro 64bits with automatic updates enabled.
• Windows 8.1 Pro 64bits with automatic updates enabled.
• Windows 7 SP1 Pro 64bits with automatic updates enabled.

Traffic dumps are clean every day and compared with the current rules to add / remove some hosts or firewall rules.

Tools used to capture traffic :

• qemu -net dump : capture
• Wireshark : capture + logs
• Sysmon : capture + logs
• Proxifier : logs

The data folder contains the blocking rules based on domains or IPs detected during the capture process :

• data/<type>/extra.txt : Block third party applications
• data/<type>/spy.txt : Block Windows Spy / Telemetry
• data/<type>/update.txt : Block Windows Update

Firewall and Hosts data are the main types. The others are generated from these as :

• DNSCrypt : a protocol for securing communications between a client and a DNS resolver.
• OpenWrt : an open source project used on embedded devices to route network traffic.
• P2P : a plaintext IP data format from PeerGuardian.
• Proxifier : an advanced proxy client on Windows with a flexible rule system.
• simplewall : a simple tool to configure Windows Filtering Platform (WFP).

And about data collection, you can read the Telemetry collection page for more info.

• pi-hole : A black hole for Internet advertisements (designed for Raspberry Pi).
• OpenWrt adblock package : DNS based ad/abuse domain blocking
• WPD : Customize Group Policy, Services and Tasks, responsible for data collection and sending, as you like.
• simplewall : Simple tool to configure Windows Filtering Platform (WFP).
• LEDE Project : A Linux operating system based on OpenWrt.
• Mikrotik hosts parser : An application that blocks "advertising" for routers based on RouterOS.
• void-zones-tools : A list of void zones that can be readily feed into Unbound on FreeBSD.
• DNSCrypt Proxy : A flexible DNS proxy, with support for encrypted DNS protocols.
• FilterLists : An independent, comprehensive directory of filter and host lists for advertisements, trackers, malware, and annoyances.

All kinds of contributions are welcome 🙌!
The most basic way to show your support is to star 🌟 the project, or to raise issues 💬
But we're not gonna lie to each other, I'd rather you buy me a beer or two 🍻!

MIT. See LICENSE for more details.
Icon credit to Icons8.