The Windows Phone 7 "phantom" data has been something of a mystery, but with Microsoft giving their diagnoses that it appears to be third-party software as being the source of the problem, Rafael Rivera took a closer look into the matter.
Rafael took a look into the feedback tool built within Windows Phone 7 and uncovered some very interesting clues as to who the culprit behind the phantom data might be. According to Rafael, the feedback toggle (fund under Settings > System > Feedback) transmits Software Quality Management (SQM) back to Microsoft"s centralized server (sqm.microsoft.com) for data analysis.
As Rafael dug a little deeper to see exactly what was being sent, he gathered some of the SQM communication data and discovered chunks of the data was uncompressed textual data. Digging through the data, you can see that the device sends information such as your email domain, phone make and model, operating system and build number, carrier, processes and more:
Some classes of data transmitted (obtained from packets one and two):
- Phone make, model (e.g. Samsung SGH-i917)
- Operating system build string (e.g. 7004.WM7_7.0_Ship(mojobld).20100916-1429)
- Carrier (e.g. AT&T US)
- Carrier support information (e.g. https://www.att.com/devicesupport, 1-800-331-0500)
- Email domain names (not entire addresses) configured (e.g. withinwindows.com, contoso.com)
- Entire contents of the equivalent services file on Windows Phone (e.g. \etc\services)
- Name of enabled email services (e.g. Windows Live, Google)
- Processes and configured SIDs running on the device (e.g. servicesd.exe, clocknot.exe, …)
Although the data is being sent when connected to the PC via USB, it sends this data every time, even outside of the email account setup process. The packets of data range anywhere between 1kb and 6kb, but have an irregular transmission schedule.