telemetry. malwarebytes.com

[BillHalberstadt]

I am using the free version (4.16.7) on a MacBook Pro (16" 2019), MacOS 12.15.1. PiHole reports blocking traffic to telemetry.malwarebytes.com every 5 minutes. In Malwarebytes preferences, the item "Usage and Threat Statistics" is unchecked. I do not have Malwarebytes installed on any other devices, and I have verified that the IP address reported by PiHole is my laptop.

Why is Malwarebytes trying to make connections to telemetry.malwarebytes.com?

Bill Halberstadt

 

[Porthos]

8 minutes ago, BillHalberstadt said:

I do not have Malwarebytes installed on any other devices

Do you have browser guard for any of your browsers installed?

[BillHalberstadt]

No. I had to Google it to see what it was, and I have never installed it.

[Porthos]

Just now, BillHalberstadt said:

No. I had to Google it to see what it was, and I have never installed it.

I asked to move your post to the correct section. You posted in the Windows section.

[BillHalberstadt]

Thanks. I was just about to repost in the Mac section, but will wait for it to be moved.

[alvarnell]

I have observed same and suppose I should have challenged it here long ago. I'm not sure what pi-hole blacklist it's included in, but obviously somebody believes the connection to include tracking or other types of data that needs to be blocked. I would gratefully whitelist it if I learn that providing this connection would be mutually beneficial to Malwarebytes and I.

[BillHalberstadt]

Can anyone from Malwarebytes comment on why Malwarebytes free is "phoning home" even with its "Usage and Threat Statistics" option unchecked?

[Porthos]

@treed

[treed]

1 hour ago, BillHalberstadt said:

Can anyone from Malwarebytes comment on why Malwarebytes free is "phoning home" even with its "Usage and Threat Statistics" option unchecked?

There is one daily check-in sent to telemetry.malwarebytes.com, regardless of the status of that setting. (This is the "client data.") This just sends some basic info, like Malwarebytes version, macOS version, hardware architecture, license state, etc - nothing that is sensitive. It will normally be sent only once per day... but if the connection fails, it will retry periodically. I suspect that, because there is a network connection, but the connection to that server is being blocked, the software is probably seeing this as a temporary issue and the retries are more frequent.

Just FYI, the data that is not sent when you turn off that option is:

• Data on protection-related activity (scans, RTP events) and any detections
  • This data does not include copies of files that were detected
• Data on how you interact with the app... ie, buttons you click, etc
  • This helps us understand how people interact with the app

None of this data is shared with any other parties, it's solely for our own use to better understand what kinds of threats our customers are seeing and what parts of the app people aren't interacting with (which may indicate unclear user interface or a feature that people don't find useful), so that we can ensure we're protecting folks as well as we can. We are absolutely not in the business of monetizing data about our users.

I personally work a lot with the detection data. It helps me better understand the threats that are out there in the wild. For example, I can see that certain threats that may get a lot of news coverage aren't found on any of our customers' machines, or threats that aren't getting any attention are very widely-distributed. This helps me understand the threat landscape and know how to communicate with customers. It also helps me spot any potential for ways we could improve our detections.

Anyway, long story short, if you unblock telemetry.malwarebytes.com, the client data is pretty insignificant, and nothing else will get sent to the telemetry server with the Usage and Threat Statistics option turned off. You can also opt to continue blocking it, but you'll continue to see those entries in the logs.

[BillHalberstadt]

Thanks for the definitive answer.