MS Windows Defender and DeCSS(arch13.com)
arch13.com
MS Windows Defender and DeCSS
https://www.arch13.com/ms-windows-defender-decss/
207 comments
We are using Defender at work, too. There is a group policy that lets Defender do a full system scan once a week.
To not interfere with the user there allegedly is a group policy setting to limit the CPU usage and it is set to 15%. The thing is, it simply does not work. Every week my fans spin up to max, Defender hogs all my CPU cores, 25% of my GPU according to the Task Manager. Even typing becomes laggy.
The only way to stop it is to open Task Scheduler and end the scheduled task from there.
To not interfere with the user there allegedly is a group policy setting to limit the CPU usage and it is set to 15%. The thing is, it simply does not work. Every week my fans spin up to max, Defender hogs all my CPU cores, 25% of my GPU according to the Task Manager. Even typing becomes laggy.
The only way to stop it is to open Task Scheduler and end the scheduled task from there.
Wait...your are local Admin on your machine?
Outside of highly regulated environments, technical staff usually have local admin rights. Is it a risk? Yes, although one that can be minimized. Letting people do what they need to do with minimal interference is an important part of keeping employees happy.
Even if they're not supposed to, most people do, or at least they know an admin login. All it takes is one frustrated person who knows someone higher up and the login is on a sticky note in a drawer. Technical security measures are not and will never be a substitute for proper training.
> Technical security measures are not and will never be a substitute for proper training.
What would proper training achieve to solve GGP's problem of his machine becoming unusable every week?
What would proper training achieve to solve GGP's problem of his machine becoming unusable every week?
And proper training is never achievable in non IT Enterprise...because no one cares, whats left are technical restrictions.
Everyone at the company I work for has local admin on their machines. It is not the big deal people make it out to be.
1) Malware doesn't care. It is happy to eat the user's personal data or anything they have access to on the network.
2) The OS is easily replicable if it gets damaged or destroyed thanks to imaging.
3) Whitelisting applications is a bitch to implement properly and causes a lot of friction for users.
4) There is one PC per user, so there's absolutely no reason to protect the PC from it's user.
1) Malware doesn't care. It is happy to eat the user's personal data or anything they have access to on the network.
2) The OS is easily replicable if it gets damaged or destroyed thanks to imaging.
3) Whitelisting applications is a bitch to implement properly and causes a lot of friction for users.
4) There is one PC per user, so there's absolutely no reason to protect the PC from it's user.
I'd quit my job if work didn't let me be root on my work machine.
That's exactly the one single reason why no one should give a developer a Windows machine in a enterprise environment ;)
Well that and the shitty dev tools on Windows in general ;)
Care to elaborate? I'm using Windows as a primary dev machine for years and I've encountered no problems aside from the infuriating update-related restarts.
What am I missing? This is an actual, emotionless, genuine question? Always looking to find new ways to procrastinate by trying out new tools ;)
What am I missing? This is an actual, emotionless, genuine question? Always looking to find new ways to procrastinate by trying out new tools ;)
Ultimately it depends on what you need and what you develop for.
If you’re developing for the Linux kernel, I bet you’re missing out on some stuff.
If you’re building web, it doesn’t matter. If you’re building docker images, you can do it on Windows/Mac, but there’s just better performance on Linux if you’re ever debugging speed.
Java? Doesn’t matter either.
If you’re developing for the Linux kernel, I bet you’re missing out on some stuff.
If you’re building web, it doesn’t matter. If you’re building docker images, you can do it on Windows/Mac, but there’s just better performance on Linux if you’re ever debugging speed.
Java? Doesn’t matter either.
More specifically, Windows is an horrible environment for C, C++, or Rust, Haskell, or any kind of language where most developers do not like IDEs. Bad for Python, Ruby, PHP, Perl where IDEs do exist, but it's not a given that they are better than simple editors. Not really good for Javascript or any language with extensive use of dependencies and configuration.
It's not better than Linux for any language, but it comes really close for the IDE oriented ones.
It's not better than Linux for any language, but it comes really close for the IDE oriented ones.
Years ago I did some C++ development using Borland C++ Builder on Windows and couldn't find any problems or annoyances. I've been doing web dev (both front and backend) for a decade or so and can't really complain about anything really.
Developing in JavaScript and dealing with node_modules/node_modules/node_... is platform agnostic problem I think ;)
EDIT: What I like about developing on Windows is it's stability (update restarts notwithstanding). I've had Linux desktops fuck themselves up on more than one occasion. Not that I don't like Linux but...
Developing in JavaScript and dealing with node_modules/node_modules/node_... is platform agnostic problem I think ;)
EDIT: What I like about developing on Windows is it's stability (update restarts notwithstanding). I've had Linux desktops fuck themselves up on more than one occasion. Not that I don't like Linux but...
Yes, once there was a time when C++ was an IDE-oriented language.
I don't know if it was because the good IDE sellers went bankrupt or if it's the change that caused their failure, but it isn't anymore.
About the dependency tracking, Windows isn't good for dealing with lots of files. It's performance isn't great (but improved a lot recently), it has locking and time based inconsistencies, and it brings a load of helper tools (like anti-virus) that will assist you in destroying your file hierarchy. The same applies for holding a VCS repository.
About stability, you are the first person ever that I see claiming to prefer Windows instead of Linux for it. It's such an alien idea that I wonder what non-usual stuff you do with your computers.
I don't know if it was because the good IDE sellers went bankrupt or if it's the change that caused their failure, but it isn't anymore.
About the dependency tracking, Windows isn't good for dealing with lots of files. It's performance isn't great (but improved a lot recently), it has locking and time based inconsistencies, and it brings a load of helper tools (like anti-virus) that will assist you in destroying your file hierarchy. The same applies for holding a VCS repository.
About stability, you are the first person ever that I see claiming to prefer Windows instead of Linux for it. It's such an alien idea that I wonder what non-usual stuff you do with your computers.
I actually do pretty mundane, boring stuff with computers - web dev, some finance & trading, lots of backend. It isn't all that exciting to an average person but I'm fine with it, it gives me pleasure to do it and I don't care what anybody says about it ;)
Again, genuine question, what instability do you imply there is in the Windows environment? Since Win 10 I don't recall ever being fucked by updates (again, not including mandatory restarts).
What I don't like about Windows is the configuration. On Linux I can just copy over the configs and scripts from another system and that's usually that. On Windows, out of necessity, I've made a lengthy checklist of things I need to do on a new Windows machine in order to set it up to my needs. It's a pain, but once that's done I rarely have to fidget with it.
I think that my preferences have to do with getting older. When I started I happily spent days configuring Linux Desktop, compiling Gentoo with just the right flags and didn't get so upset when apt-get dist-upgrade fucked up my system. Now, I just don't care that much. I just want things to work so I can do work I want.
Just one thing to be extra clear about - I use Windows as a daily driver desktop. I'd never ever use Windows as a server, ever. I've had that experience once, in college, and I'll never ever make that mistake again ;)
Again, genuine question, what instability do you imply there is in the Windows environment? Since Win 10 I don't recall ever being fucked by updates (again, not including mandatory restarts).
What I don't like about Windows is the configuration. On Linux I can just copy over the configs and scripts from another system and that's usually that. On Windows, out of necessity, I've made a lengthy checklist of things I need to do on a new Windows machine in order to set it up to my needs. It's a pain, but once that's done I rarely have to fidget with it.
I think that my preferences have to do with getting older. When I started I happily spent days configuring Linux Desktop, compiling Gentoo with just the right flags and didn't get so upset when apt-get dist-upgrade fucked up my system. Now, I just don't care that much. I just want things to work so I can do work I want.
Just one thing to be extra clear about - I use Windows as a daily driver desktop. I'd never ever use Windows as a server, ever. I've had that experience once, in college, and I'll never ever make that mistake again ;)
For C/C++, in my limited experience, I'd say that Visual studio is fine. Though we're targeting Windows, so it's not as if we have a choice of OS there
Most of Windows itself is written in C/C++...
Yet Microsoft's tools for C/C++ don't hold up. Visual Studio is stuck in the early 2000s (and frankly the UX is horrendous), everything is packaged in weird GUI tools, the entire environment is practically hostile to automation. The VS debugger is probably one of the best pieces, everything else is simply outclassed. Debuggers have also been supplanted for many uses by other tools, of which Microsoft has few and all of them are annoying to use at best. I really wouldn't want to be a developer for Windows that has to cope with debugging e.g. memory issues (on Linux, you put "valgrind" in front of your command, and it tells you the exact line number containing the error 98.4 % of the time -- yes MS has a number, that is, too many, tools to debug various issues, most of which are arkane at best, like gflags). The default for scripting on Windows is still batch, which is simply insane (since batch was designed within the confines of a single user single "process" environment with no memory).
And this is just lacking in the basics department. We're not even talking about Windows coping very badly with development workloads like reading/writing many small files (which is a design flaw in the NT kernel and will not be fixed, ever).
Of course, if you don't use any of Microsoft's stuff, there really isn't anything wrong per se, just annoyances (slowness, spying and other user-hostile behavior from the OS); IntelliJ is IntelliJ, Linux or Windows matters very little if you live inside it.
Edit: It shouldn't be a surprise that Visual Studio is essentially abandoned by Microsoft. Do you abandon good things? You don't.
And this is just lacking in the basics department. We're not even talking about Windows coping very badly with development workloads like reading/writing many small files (which is a design flaw in the NT kernel and will not be fixed, ever).
Of course, if you don't use any of Microsoft's stuff, there really isn't anything wrong per se, just annoyances (slowness, spying and other user-hostile behavior from the OS); IntelliJ is IntelliJ, Linux or Windows matters very little if you live inside it.
Edit: It shouldn't be a surprise that Visual Studio is essentially abandoned by Microsoft. Do you abandon good things? You don't.
> Windows coping very badly with development workloads like reading/writing many small files (which is a design flaw in the NT kernel and will not be fixed, ever).
Not the kernel, but ntfs.sys. It is a design limitation of NTFS and was a tradeoff for something else. At the time NTFS was designed, high frequency reading and writing to small files was not at all common.
This does not exist on FAT/32/64 partitions, though there is always a per-file overhead on any filesystem, and FAT filesystems have their own problems.
IO performance tools don't seem to test reading and writing to a large number of small files; they tend to want a single large file and they test performance to and from that file. That's by design, and that means those tools don't find filesystem design limitations, or allow you to measure certain types of performance on a per-filesystem basis.
> Edit: It shouldn't be a surprise that Visual Studio is essentially abandoned by Microsoft.
Again, not true.
No one can know everything that MS is doing, of course, but the number of people who think they do is quite high. I am not referring to the person who made the comment I am replying to, by the way. Generally I just see a lot of things about MS or MS tools that are stated as fact and are entirely incorrect.
Not the kernel, but ntfs.sys. It is a design limitation of NTFS and was a tradeoff for something else. At the time NTFS was designed, high frequency reading and writing to small files was not at all common.
This does not exist on FAT/32/64 partitions, though there is always a per-file overhead on any filesystem, and FAT filesystems have their own problems.
IO performance tools don't seem to test reading and writing to a large number of small files; they tend to want a single large file and they test performance to and from that file. That's by design, and that means those tools don't find filesystem design limitations, or allow you to measure certain types of performance on a per-filesystem basis.
> Edit: It shouldn't be a surprise that Visual Studio is essentially abandoned by Microsoft.
Again, not true.
No one can know everything that MS is doing, of course, but the number of people who think they do is quite high. I am not referring to the person who made the comment I am replying to, by the way. Generally I just see a lot of things about MS or MS tools that are stated as fact and are entirely incorrect.
Abandoned? Are you kidding? They're previewing the 2022 release.
And frankly VS Studio UX is not horrendous. Modern UX is horrendous, give me deep menus and toolbars any day of the week.
As for I/O, I've worked on large git repositories (aka tons of small files) on Windows with no issue. In a Dropbox-synced folder no less.
And frankly VS Studio UX is not horrendous. Modern UX is horrendous, give me deep menus and toolbars any day of the week.
As for I/O, I've worked on large git repositories (aka tons of small files) on Windows with no issue. In a Dropbox-synced folder no less.
I have no idea what you’re talking about.
You don't use Windows Update Manager or timed firewall rules to make sure Update doesn't ever interfere with your work?
If your OS defaults to interrupting your work with its update policies, it's doing it wrong. Just because you can delay it doesn't make it acceptable.
Agreed. The fuck-your-work-restart behavior is infuriating.
This is one of the biggest reasons I no longer boot Windows at all, combined with the rather good support for gaming on Linux nowadays.
When I boot up my Windows install for the first time in months and it wants to waste ten, twenty minutes of my time installing updates and not letting me use my computer, I just don't bother next time. When I play a game, and Windows wants to pester me in the background to reboot for updates, it makes me wish I hadn't bothered. If a game or application doesn't work on Linux, I just don't use it. It's not worth the time.
When I boot up my Windows install for the first time in months and it wants to waste ten, twenty minutes of my time installing updates and not letting me use my computer, I just don't bother next time. When I play a game, and Windows wants to pester me in the background to reboot for updates, it makes me wish I hadn't bothered. If a game or application doesn't work on Linux, I just don't use it. It's not worth the time.
No I don't. The restarts are fucking infuriating but, at least in my case, they've never been catastrophic. My computer is usually running all the time but when I finish working on some thing I always ^S everything and usually `git push --all; git push --tags`.
I'm a relative beginner to development and have found no issues with WSL2 so far. Any pitfalls to be aware of?
When I was using wsl1 I ran into ocassional nuisances: needing to specify a windows mount point and having a problem with phpstorm connecting to it (iirc I had to use a docker for windows setting which was referred to as legacy or insecure maybe).
It wasn't too bad though honestly.
I ended up swapping to debian after my workplace rolled out some insane MDM policies / forced application installs. It is much nicer to dev in *nix
It wasn't too bad though honestly.
I ended up swapping to debian after my workplace rolled out some insane MDM policies / forced application installs. It is much nicer to dev in *nix
WSL2 is so much better than WSL1
I find that still slow compared to full blown dual install of Linux.
And anywhere with a good IT department would say "bye". From my experience, people with reasonable technical skills are the most likely people to defy IT policies, even without admin rights.
Then hold me responsible if I do.
Often by the time the violation is noticed, the damage is done. And when you're cleaning up a million dollars worth of ransomware damage, you rethink whoever thought anyone should ever be operating with admin rights to their machine.
>people with reasonable technical skills are the most likely people to defy IT policies
Absolutely true...aka "i know computers since the C64 nothing bad will ever come from my machine...bumm ransomware...but my Antivirus never said anything"
Absolutely true...aka "i know computers since the C64 nothing bad will ever come from my machine...bumm ransomware...but my Antivirus never said anything"
Less to do with that and more to do with it being infuriating that you can't install or do tiny things you need. It can be less frustrating to hop jobs.
Our company just switched from Symantec to Windows Defender and so far I'm very pleased. On my Windows laptop the fans were running more or less all the time when we had Symantec. With Defender the computer is nearly dead silent.
When looking in Task Manager before, it seemed that Symantec used more CPU than even Visual Studio and related processes.
When looking in Task Manager before, it seemed that Symantec used more CPU than even Visual Studio and related processes.
We had Symantec too, also switched to Windows Defender. Symantec was an awful piece of software for something that should be invisible until needed.
My very good solution on dealing with corporate antivirus: noise cancelling headphones.
I remember a few students using windows that took a very very long time to compile anything; even smallish single-file examples. Is is possible that this slowness is caused by windows checking the binaries that were just compiled?
Not just the binaries. The source code too.
A common practice is to exclude both the whole repo and the compiler from Defender.
A common practice is to exclude both the whole repo and the compiler from Defender.
Oh man....a mac with antivirus software...is your IT's mindset from the 90s?
People apparently disagree, but I'm with you. The idea that antivirus software is actually a worthwhile mitigation tool is a relic from the 90s. Malware defeats antivirus all the time, and sometimes even exploits it directly. Meanwhile, aggressive antivirus software is eating a percentage of every single task you do on your computer, actively impeding your work every second of your day.
The tradeoff is not worth it, in my professional opinion.
The tradeoff is not worth it, in my professional opinion.
While I wholeheartedly agree with you, I think that putting the horrible piece of shit antivirus software on enterprise boxes is a cover-your-ass tactic. It's required from IT depts to be able to say they followed industry standard practices and did their due diligence to prevent threats, regardless of whether those have any useful, practical effects at all.
My wife has a brand new corp issued Carbon X1 and I can hear it routinely spin fans 100% because of Norton FuckYourCPUandIO (tm) software doing nothing of use besides inducing anger.
My wife has a brand new corp issued Carbon X1 and I can hear it routinely spin fans 100% because of Norton FuckYourCPUandIO (tm) software doing nothing of use besides inducing anger.
Of course it's not worth it, but in many orgs it's required for compliance. It may change in the future as most people realize it's not that useful, just like NIST changed the rule about password updates.
On the other hand, it might seem useless because malware creators know it's there. Basically all functional pieces of malware have to go through VirusTotal otherwise they won't be effective. But if all orgs dump antivirus software it would be a bit like giving up MMR vaccination in children.
On the other hand, it might seem useless because malware creators know it's there. Basically all functional pieces of malware have to go through VirusTotal otherwise they won't be effective. But if all orgs dump antivirus software it would be a bit like giving up MMR vaccination in children.
Compliance for the sake of Compliance is just to protect ones ass and has nothing todo with security (aka no one gets fired for buying IBM)
Most companies have to have Antivirus anyway, for compliance reasons.
Depends on what the "anti-virus' does isnt it?
My company recently signed a deal with a healthcare company to do some work on their systems. I got a laptop from this company, MBP 16" so not bad. But lord oh lord are there so many things on this laptop.
Two worst offenders are:
- Antivirus: Just hogs memory, the scan runs "throughout the day" and I've had to resort to using scripts to shut the thing down just so my code will compile.
- Other annoying features: Lets make you stare at a dayglow green wallpaper and give you no way to change it to something that doesn't offend your eyes, lets place a bunch of icons on your dock and desktop that you can't get rid of, just bookmarks to common apps. Lets also make a popup show up on your laptop every day to remind you that you need to upgrade to OneDrive but forget to give me the permission to actually upgrade so this message repeats itself and fails every time..
endrant.
Two worst offenders are:
- Antivirus: Just hogs memory, the scan runs "throughout the day" and I've had to resort to using scripts to shut the thing down just so my code will compile.
- Other annoying features: Lets make you stare at a dayglow green wallpaper and give you no way to change it to something that doesn't offend your eyes, lets place a bunch of icons on your dock and desktop that you can't get rid of, just bookmarks to common apps. Lets also make a popup show up on your laptop every day to remind you that you need to upgrade to OneDrive but forget to give me the permission to actually upgrade so this message repeats itself and fails every time..
endrant.
"There's something wrong with your iCloud ID, please log in to fix it" popup. But hey we disabled iCloud integration so they'll never be able to actually login! (cue evil laughter)
My work-issued iPhone wants me to verify me Apple ID password for whatever reason.
By device management policy I am locked out from entering my Apple ID information again. Great success.
By device management policy I am locked out from entering my Apple ID information again. Great success.
You'd be surprised about how many high profile silicon valley companies use similar software such as crowdstrike or carbon black.
It's a scourge.
It's a scourge.
Unfortunately many big customers insist on it as part of security questionaires and depending on who audits your compliance with certain security standards, they may insist it's required too.
My work mac has both Carbon Black and FireEye. It takes 30% longer to do a large build of an open source project than my personal laptopk, despite having 2 more cores and twice the RAM.
We even have McAfee on our Linux machines...
And yes, doing a build is impacted by this...
Holy caracho!! I understand if you have it on a file-server (bad rep if you send a MS-Word-Macrovirus to a Customer) but on a linux build server?? That's just madness!
Depending on the use, the server could be immune to malware and still transmit it to their clients.
Then check the binary before installation/tests if you have to, but not on the linux build server itself...that's ridiculous. A HIDS would be the the answer, so you can be ~sure that your tools are not altered to inject code into your compiled product.
I'm guessing they're covering the case where a feature or a vulnerability allows uploading Windows malware and exposing it with other users.
A Mac with AntiVirus software written by Microsoft.
Lol, we have to have it on our *nix servers as well. Despite the fact that it's almost completely useless.
MS Windows Defender is generally good (I actually prefer it and preferred its SecurityEssentials predecessor to all the other antiviruses) but seems really notorious in removing non-virus "threats". It also removes NirSoft (and some Sysinternals IIRC) utilities regularly. Yesterday, trying to download the recent version of LibreOffice, I have even found found out I have no qBitTorrent installed any more - it killed it also. I really wish I could just put a regex filter to bulk-allow some classes of "threats" ("HackTool:" and "PUA:") permanently.
I don't know if my installation is broken, but I haven't had Defender remove what I thought was a legitimate binary since I first installed Windows 10. Literally not one single time on half a dozen installations.
FWIW I installed and ran qBitTorrent recently and it didn't complain.
FWIW I installed and ran qBitTorrent recently and it didn't complain.
> I haven't had Defender remove what I thought was a legitimate binary
Probably because you are closer to a "typical" kind of user who doesn't use "hack tools" (which some people like me use for absolutely legal and benevolent purposes "hacking" their own PC, e.g. to backup the passwords and e-mail records saved on it). By the way it also is very important to distinguish between a legitimate hack tool and an infected hack tool and I am not sure they do.
> I installed and ran qBitTorrent recently and it didn't complain.
They just added a slightly old version to their threats database and didn't add the most recent version there yet.
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclo...
https://www.reddit.com/r/qBittorrent/comments/lwqjm9/qbitbor...
Probably because you are closer to a "typical" kind of user who doesn't use "hack tools" (which some people like me use for absolutely legal and benevolent purposes "hacking" their own PC, e.g. to backup the passwords and e-mail records saved on it). By the way it also is very important to distinguish between a legitimate hack tool and an infected hack tool and I am not sure they do.
> I installed and ran qBitTorrent recently and it didn't complain.
They just added a slightly old version to their threats database and didn't add the most recent version there yet.
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclo...
https://www.reddit.com/r/qBittorrent/comments/lwqjm9/qbitbor...
I just checked, perhaps the fact that I have "reputation-based" blocking always disabled helps, which seems to avoid that kind of false positive. I am not a fan of my OS phoning home to check every single executable I run. Either it's in the virus database, or I'm tech-savvy enough not to run any .exe I receive via e-mail.
https://www.tenforums.com/tutorials/32236-enable-disable-mic...
https://www.tenforums.com/tutorials/32236-enable-disable-mic...
I didn't even know there is such a "reputation" option. Today Windows configuration windows are way harder to find anything (what you don't already know is there/where) in than they used to be even in Windows 7, let alone XP (where everything was way more intuitive and easy to discover). As for submitting the files to Microsoft - I believe I have disabled that but in the today context I can't be sure it didn't get enabled on itself.
I disagree that it is good. It was good. But now it is indistinguishable from a malware. It regularly takes 100% CPU, it prevents many of my own apps from running, and if you switch off real-time protection it switches itself back on like any respectable rootkit.
Use Deluge. The best IMO.
To be fair, this does look like a false positive.
In general, the desktop antivirus space in 2021 is a mess. Because of the sheer number of malware, and some obfuscation techniques used by some of it, antivirus software has to use very broad regular expressions for describing the malware, counterbalanced by huge whitelists of known mainstream software.
If you don't qualify as a "mainstream software vendor", simply building a random piece of code into an exe file will get you about 10% chance of getting flagged by one of the "heuristic engines" if you upload it to VirusTotal.
You can contact the A/V vendor and they will usually add it to the whitelist, but it only lasts until the next rebuild. Or you can rebuild it a couple of times with different optimization levels, and the detection sometimes goes away.
In general, the desktop antivirus space in 2021 is a mess. Because of the sheer number of malware, and some obfuscation techniques used by some of it, antivirus software has to use very broad regular expressions for describing the malware, counterbalanced by huge whitelists of known mainstream software.
If you don't qualify as a "mainstream software vendor", simply building a random piece of code into an exe file will get you about 10% chance of getting flagged by one of the "heuristic engines" if you upload it to VirusTotal.
You can contact the A/V vendor and they will usually add it to the whitelist, but it only lasts until the next rebuild. Or you can rebuild it a couple of times with different optimization levels, and the detection sometimes goes away.
Deleting both the exe and the source code makes a false positive seem rather unlikely to me.
The source code in question appears to have been obfuscated (possibly just for brevity). I'd guess the Defender signature in question was written around the packer/obfuscator.
Wanna bet the signature is the hex key?
yeah, that'd be my guess. It's going to be in different representations in the source and the executable but if I was writing a signature for it straight up I'd probably add the C escape representation as well for good measure.
[deleted]
I don't care how broad your definition is, it shouldn't include the mp4 files in my hard drive.
How so? Everything that's interacted with by a computer can be exploited - in case of media files, here's[0] one example that gets talked about. I understand your frustration about flagging your harmless files as malicious, but it really shows just how difficult is to properly detect malware.
[0] https://security.stackexchange.com/questions/97856/can-simpl...
[0] https://security.stackexchange.com/questions/97856/can-simpl...
Er, doesn't that assume that the mp4 files on your hard drive can't genuinely be infected with viruses? Why is that assumption true?
Especially given how common media files are as an attack vector.
pledge(4)ing an image or video viewer under OpenBSD doesn't look difficult at all.
Also, you can convert your PNG images to Farbleld (+.gz | +.xz) without losing quality.
And the farbleld image format it's more difficult to exploit.
Also, you can convert your PNG images to Farbleld (+.gz | +.xz) without losing quality.
And the farbleld image format it's more difficult to exploit.
I think running pledge(2) on Windows is quite difficult. :)
(At least, I'm assuming the question here is "What should Windows Defender do?" I agree that the answer to "What should OpenBSD's built-in antivirus do?" is "Literally not even exist," which it already does.)
(At least, I'm assuming the question here is "What should Windows Defender do?" I agree that the answer to "What should OpenBSD's built-in antivirus do?" is "Literally not even exist," which it already does.)
Are they? Compared to other forms (eg. trojans or browser/os 0days) they're not really common. I suspect you have a better chance of getting infected from a site asking you to download a "codec", than you have of the site serving you a malformed media file.
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jpeg returns 390 results. And that’s jpeg alone. It’s fairly common that you see some sort of media file format parsing bug to lead to command execution.
But how many of those are actually exploited, and how does that compare to the other vectors I mentioned? Media file exploits seem in same class of exploits as spectre/rowhammer. You hear about them often (not as often as spectre/rowhammer, but I frequently see security fixes being mentioned in media player changelogs), but you rarely hear about attacks that use them.
I think most users would be happy to avoid getting infected via content files like videos and pictures[1][2].
Us power users can always just configure the exception list.
[1]: https://docs.microsoft.com/en-us/security-updates/SecurityBu...
[2]: https://www.kb.cert.org/vuls/id/297462
Us power users can always just configure the exception list.
[1]: https://docs.microsoft.com/en-us/security-updates/SecurityBu...
[2]: https://www.kb.cert.org/vuls/id/297462
The amount of false-positives with WinDef is insane, it's pretty much like any desktop link to as shared drive is considered malware right of the bat without even inspecting it.
Let alone documents with macros...
Having said that, I wouldn't want to be one of those having to implement detection logics because the malware jungle is so creative that it's pretty much an impossible job they have to do.
Let alone documents with macros...
Having said that, I wouldn't want to be one of those having to implement detection logics because the malware jungle is so creative that it's pretty much an impossible job they have to do.
> In general, the desktop antivirus space in 2021 is a mess.
I don’t think that antivirus is helpful in 2021. I think the most important thing you can do is make sure you are all patched and do not run as administrator.
Antivirus is likely to be unable to catch the really bad stuff, and it actually increases your attack surface. In addition, you pay a performance tax all the time. IMO, just not worth it.
I don’t think that antivirus is helpful in 2021. I think the most important thing you can do is make sure you are all patched and do not run as administrator.
Antivirus is likely to be unable to catch the really bad stuff, and it actually increases your attack surface. In addition, you pay a performance tax all the time. IMO, just not worth it.
> In general, the desktop antivirus space in 2021 is a mess. Because of the sheer number of malware, and some obfuscation techniques used by some of it, antivirus software has to use very broad regular expressions for describing the malware, counterbalanced by huge whitelists of known mainstream software.
Why do they have to use regular expressions?
Why do they have to use regular expressions?
"Regular expressions" as a concept, not PCRE regex.
In the sense of https://en.wikipedia.org/wiki/Regular_language ?
That's even more restricted than PCRE regex. (Which is often a good thing, but not sure about here.)
That's even more restricted than PCRE regex. (Which is often a good thing, but not sure about here.)
I don't believe they use regular expressions.
Why not? I.e. is that from experience on working on anti malware remediation systems?
What would it match against? ASCII strings? Add a whitelisted string and make your malware pass.
The heuristics are much more complex than that, cf. spamassassin rules.
The heuristics are much more complex than that, cf. spamassassin rules.
Opcode sequences. Regular expressions may be applied to any formal language, not just ones based on human-readable alphabets.
That kinda makes sense, thanks.
However, wouldn’t this kind of heuristic be extremely simple to counter by obfuscating the machine code, e.g. by inserting complex noops and using threaded subroutines which individually look innocuous? Or, are this kind of techniques looking at known syscall patterns or something like that, and ignoring the general program flow?
To me, regex doesn’t seem applicable to static analysis of machine code, but what do I know :)
However, wouldn’t this kind of heuristic be extremely simple to counter by obfuscating the machine code, e.g. by inserting complex noops and using threaded subroutines which individually look innocuous? Or, are this kind of techniques looking at known syscall patterns or something like that, and ignoring the general program flow?
To me, regex doesn’t seem applicable to static analysis of machine code, but what do I know :)
antiviruses are composed of multiple systems and techniques. Regexp is just one.
That also makes sense. Got any further reading?
The thing is, malware vendors can do the same. At least for zero day attacks you just test them on the target’s antivirus to make sure it will not discover the malware.
His comment in /r/sysadmin:
"Setting a Windows Defender exception to the folder does not prevent the quarantine from occurring. I re-ran this test three times trying exceptions and even the entire NAS drive as on the excluded list."
Windows Defender is overriding the user whitelist?
"Setting a Windows Defender exception to the folder does not prevent the quarantine from occurring. I re-ran this test three times trying exceptions and even the entire NAS drive as on the excluded list."
Windows Defender is overriding the user whitelist?
Microsoft knows better. We are here to protect you.
People who ignored the AV exception requested by Kaseya didn't get a surprise ransomware in their systems
In addition, Windows also quarantines and deletes innocuous Windows activation crack tools that contain no malware whatsoever, but can be used to activate Windows independently of Microsoft.
It's really amazing the attitude Microsoft takes regarding hardware that isn't theirs, including the nonconsensual forced autoupdate.
It's really amazing the attitude Microsoft takes regarding hardware that isn't theirs, including the nonconsensual forced autoupdate.
That's not just a Windows feature, though. My experience with _every other antivirus_ has always been that anything related to cracking or keygens is flagged as a virus.
In my opinion, Windows Defender is still the best antivirus software for consumers. That's not a compliment to Windows Defender, that's an insult to antivirus companies all over the world.
In my opinion, Windows Defender is still the best antivirus software for consumers. That's not a compliment to Windows Defender, that's an insult to antivirus companies all over the world.
I'm pretty happy with ESET NOD32
I was under the impression that with Windows 10 we shifted to the product being the users data. The customers are now advertisers.
From what I’ve understood, that is a correct impression.
Oh no, they’re making the world safer by encouraging the adoption of the latest security patches and bug fixes? And giving away best-in-class security software that you can disable at any time? How evil. You must really have loved the days of Norton Antivirus.
you may have misread the parent comment? it is deleting things completely unrelated to malware
For future reference, that comment seems to be at https://old.reddit.com/r/sysadmin/comments/oof29b/windows_de...
I wonder if it's related to the tamper protection setting? I know that setting makes it ignore other settings like group policy, though I've never seen it ignore whitelists, but maybe they've changed that?
Absolutely it does. I had one problematic file that I had to add it to the whitelist every month or so, otherwise Defender removed it. Nevermind the fact that adding it to the whitelist was a PITA, I never figured out why the setting haven't stuck; the file in question wasn't changing at all.
ughhh this is why i ended up completely disabling it
I fear anti-virus and firewall software may in the near future be used to guarantee DRM features.
I fear the day when I try to play media I legally own from another region and can't play it because of region blocking and can't circumvent it because my "defense" software prevents me.
Another thing that scares me: services requiring said kinds of software. The mobile world is somewhat like this already and it is basically what bars users from using their mobile phones as full blown computers even though said phone are powerful enough for that.
I fear the day when I try to play media I legally own from another region and can't play it because of region blocking and can't circumvent it because my "defense" software prevents me.
Another thing that scares me: services requiring said kinds of software. The mobile world is somewhat like this already and it is basically what bars users from using their mobile phones as full blown computers even though said phone are powerful enough for that.
As long as the hardware allows booting arbitrary code, this kind of DRM remains technically impossible.
There's nothing to stop you from booting into another OS and deleting the files implementing the harmful functionality. If there are checks for the presence of these files in other parts of the OS, you can remove them.
IMO it's a very dangerous attitude when people consider software immutable. You can achieve a lot by modifying software made by other people.
There's nothing to stop you from booting into another OS and deleting the files implementing the harmful functionality. If there are checks for the presence of these files in other parts of the OS, you can remove them.
IMO it's a very dangerous attitude when people consider software immutable. You can achieve a lot by modifying software made by other people.
> There's nothing to stop you from booting into another OS and deleting the files implementing the harmful functionality. If there are checks for the presence of these files in other parts of the OS, you can remove them
Encrypted disks with TPM-stored keys will certainly prevent unauthorised modification to a filesystem
> hardware allows booting arbitrary code
And this particular cat is already out of the bag with Win 11 REQUIRING TPM support with verified boot.
The war against general-purpose computing is in the final stages, and the garden-keepers have already won for almost everything that matters. Yes, you can still source open hardware and they will not fight against technical elites - a minority - but for the vast majority of users, it's over because they LIKE the closed apps holding data hostage.
Encrypted disks with TPM-stored keys will certainly prevent unauthorised modification to a filesystem
> hardware allows booting arbitrary code
And this particular cat is already out of the bag with Win 11 REQUIRING TPM support with verified boot.
The war against general-purpose computing is in the final stages, and the garden-keepers have already won for almost everything that matters. Yes, you can still source open hardware and they will not fight against technical elites - a minority - but for the vast majority of users, it's over because they LIKE the closed apps holding data hostage.
So this might be a dumb question, but what's there to prevent someone emulating a TPM? What's there to prevent someone nop'ing out the code that implements the TPM functionality in Windows? Where does the root of trust (or, rather, distrust) come from?
The TPM chip has a builtin key that you, as the device owner is not allowed to read. That key is certified by the manufacturer.
If any manufacturer starts selling chips where you can read the key, it will be disallowed by Microsoft.
If any manufacturer starts selling chips where you can read the key, it will be disallowed by Microsoft.
So control over all the computers in a country comes down to just a few keys held by "approved" manufacturers; or rather a single key, held by the government, which signs the list of approved manufacturer keys.
Then all they need to do is require that ISPs only allow packets to be sent by computers that have passed a Measured/Trusted Boot check, and suddenly all online activity is restricted to "approved" computers, running code from "approved" app stores.
"One Ring to rule them all, One Ring to find them, One Ring to bring them all and in the darkness bind them."
Then all they need to do is require that ISPs only allow packets to be sent by computers that have passed a Measured/Trusted Boot check, and suddenly all online activity is restricted to "approved" computers, running code from "approved" app stores.
"One Ring to rule them all, One Ring to find them, One Ring to bring them all and in the darkness bind them."
> So control over all the computers in a country comes down to just a few keys
Notice that I didn't mention "country" anywhere. There's no country restriction.
> or rather a single key, held by the government, which signs the list of approved manufacturer keys
Hum, no. The single key is held by Microsoft.
And yeah, that's basically what the Trusted Computing Consortium was designing at the early 00. But people pushed back enough that they stopped publishing public documents and delayed the implementation. We are just getting there.
Notice that I didn't mention "country" anywhere. There's no country restriction.
> or rather a single key, held by the government, which signs the list of approved manufacturer keys
Hum, no. The single key is held by Microsoft.
And yeah, that's basically what the Trusted Computing Consortium was designing at the early 00. But people pushed back enough that they stopped publishing public documents and delayed the implementation. We are just getting there.
> There's no country restriction.
The technology may not care about countries, but countries care about technology. If (or rather when) a government passes a law limiting internet access to approved operating systems and hardware, the ISPs in that country will logically have to listen for signed updates to the whitelist.
In practice the list might be very short, containing just intermediate keys representing Microsoft, Apple, Google, a few commercially-backed Linux distros, and the CPUs that support them (with the necessary TPMs). The intermediate keyholders would have the responsibility to revoke approval of versions / model numbers that have known vulnerabilities which allow arbitrary user-controlled code to run.
The technology may not care about countries, but countries care about technology. If (or rather when) a government passes a law limiting internet access to approved operating systems and hardware, the ISPs in that country will logically have to listen for signed updates to the whitelist.
In practice the list might be very short, containing just intermediate keys representing Microsoft, Apple, Google, a few commercially-backed Linux distros, and the CPUs that support them (with the necessary TPMs). The intermediate keyholders would have the responsibility to revoke approval of versions / model numbers that have known vulnerabilities which allow arbitrary user-controlled code to run.
So okay, you again assume that software is immutable. But Windows has to store these trusted keys somewhere. What if I emulate the TPM with a key I generated myself, and patch Windows to trust that key?
Then you will discover that Secure Boot will stop your computer from starting until you reinstall something signed by Microsoft.
Can't you just turn that off in the BIOS settings?
Not if BIOS doesn't allow that to be turned off.
Uh, that's a thing?! How do people install Linux then? How does that work with PCI cards that contain executable code in their ROMs, does that code have to be signed by overlords now?
> How do people install Linux then?
Basically, when MS started requiring Secure Boot on Windows computers, there were a few anti-trust actions against then that looked at this action. So they back-pedaled and required that people should be able to disable Secure Boot on x86 and amd64 computers. They also created a 3rd party certification program, that those distros one buys could pay for and get signed.
But make no mistake, MS completely control the specs of any PC available to you, and will not miss a chance to remove the support for 3rd party OSes.
Basically, when MS started requiring Secure Boot on Windows computers, there were a few anti-trust actions against then that looked at this action. So they back-pedaled and required that people should be able to disable Secure Boot on x86 and amd64 computers. They also created a 3rd party certification program, that those distros one buys could pay for and get signed.
But make no mistake, MS completely control the specs of any PC available to you, and will not miss a chance to remove the support for 3rd party OSes.
I just feel like if everything available gets locked down, people would simply resort to running more open OSes in emulators or virtual machines. Set to autostart in full-screen, so the only part of modern Windows they ever see would be the boot sequence. Like you could install DOSBox on an iPad and basically use it like a full-fledged early 90s computer, especially if you have a keyboard.
You'll boot Windows but can't mount the system volume if it's protected by a Bitlocker key derived from the TPM key.
Even if you do a clean install yourself? Well then, gotta patch the installer. There's always a way!
What's there to prevent someone nop'ing out the code that implements the TPM functionality in Windows?
Nothing absolute, mainly a long series of annoying hurdles - including the constant barrage of updates.
Nothing absolute, mainly a long series of annoying hurdles - including the constant barrage of updates.
Earlier this year I spent a month or 2 working on a little Go project for a very niche little usecase (it would read a MIDI file and write it to a text file in a format that could be inserted into Super Mario World romhacks [or try to anyway])
After spending all that time working on it, I was hoping that I could just compile to the various OS/architectures and distribute that, but once someone tried using it I quickly found out that as soon as you downloaded my program, Windows Defender would flag it as malware and quarantine it. Even the builds in my project workspace that I compiled myself would get flagged/quarantined once it caught them.
I tried doing some research and it seems to just be a regular thing with Go apps because I think the runtime code would be common across malware written in Go, so basically all Go programs are automatically assumed to be malware by Windows unless you buy a cert and/or get enough people using it.
Or maybe this is more common than just Go programs. I've never really done anything like this before. But I ended up just abandoning attempting to release it properly and left the source code up on Github so if someone wants to compile it themselves they can. But the whole experience was a bit discouraging. It seems like there's really no cheap/easy way to distribute software. Webapps require hosting, and native code is assumed to be malware by default.
After spending all that time working on it, I was hoping that I could just compile to the various OS/architectures and distribute that, but once someone tried using it I quickly found out that as soon as you downloaded my program, Windows Defender would flag it as malware and quarantine it. Even the builds in my project workspace that I compiled myself would get flagged/quarantined once it caught them.
I tried doing some research and it seems to just be a regular thing with Go apps because I think the runtime code would be common across malware written in Go, so basically all Go programs are automatically assumed to be malware by Windows unless you buy a cert and/or get enough people using it.
Or maybe this is more common than just Go programs. I've never really done anything like this before. But I ended up just abandoning attempting to release it properly and left the source code up on Github so if someone wants to compile it themselves they can. But the whole experience was a bit discouraging. It seems like there's really no cheap/easy way to distribute software. Webapps require hosting, and native code is assumed to be malware by default.
windows defender
aggressively scan every .jar, but totally ignores .net executables
no wonder they do something similar with go executables, it's easy to recognize them after all
aggressively scan every .jar, but totally ignores .net executables
no wonder they do something similar with go executables, it's easy to recognize them after all
What I really don't like about Defender and other antivirus products is they'll silently send your files to the mothership to be analyzed, without even letting you know that's happened, or any straightforward way to find out. I understand that's a large source of new malware samples for them, but it's an awful antiprivacy behavior.
Another dark pattern here is that there's an option to turn this off, and I turned it off, only to be nagged weekly to turn it back on! Fuckers don't take no for an answer, until I'm nagged into clicking yes. And the UI acts like this is some security warning, with a yellow exclamation mark and everything.
In Windows Security click settings on the bottom left and then you can manage notifications.
Defender, as per Windows 10 philosophy, is extremely annoying to use with its UI and behavior that makes you feel every setting and button you press is entirely useless and nothing will change. A shame the old Security Essentials UI was removed entirely, it was the only bearable hack-y way to use it. I just disable it permanently on every machine. The anti-malware service likes to eat disk activity when you're working, and most importantly, exceptions handling is useless: I've seen it delete or quarantine (and then delete) files put into exceptions multiple times, repeatedly, as if the exception list was getting reset, or expired. This kind of software behavior is unacceptable in any way or form.
It's packed, which for some reason that tends to trigger a lot of AVs... although the fact that it's a packer from roughly 2 decades ago and one that any respectable AV should be able to easily unpack by now certainly doesn't inspire confidence.
Then again, AVs detecting things as innocent as freshly-compiled "Hello World" programs is not new, and certainly makes one wonder just what exactly they are trying to detect.
Then again, AVs detecting things as innocent as freshly-compiled "Hello World" programs is not new, and certainly makes one wonder just what exactly they are trying to detect.
I'm guessing that some virus signatures detect packers instead of unpacking the code and detecting malware code there.
I wonder when Anti-Virus will start deleting files that express opinions they don't like.
Reminds me of the famous Earworm https://www.youtube.com/watch?v=-JlxuQ7tPgQ
Reminds me of the famous Earworm https://www.youtube.com/watch?v=-JlxuQ7tPgQ
I get annoyed with AV when it quarantines "Potentially unwanted software" like ProduKey. While it may be able to be used maliciously, that's not why I have it installed, and I do want it on my machine.
My win10 install recently started deleting my install of qBittorrent, which I very much want installed and use daily, as "potentially unwanted software". Exceptions kept getting ignored so just today I disabled the entire category of potentially unwanted software in win defender. It feels like they're just getting capricious in their scope for flagging things now.
I personally never really vibed with qbittorrent. Stuck with deluge for years.
May I ask why you use qbit?
May I ask why you use qbit?
That's entirely off-topic.
Do tech aware people like nearly everyone in this forum, need Defender (or another AV) to run at all? How many people here completely or partially stop it from running?
It was really infuriating to disable, FWIW. I spent hours fighting with it one day. The UI doesn't let you fully disable it: you have to use registry keys and the group policy editor. The end result has this hilarious property where it is flagging the fact that I disabled it as tampering that might indicate malware? I don't know if I even can disable that part... and I apparently didn't even succeed fully anyway as I now am getting occasional notifications saying Defender did a scan and I am like "as far as I can tell, Defender us fully off" :/. At least I did--as far as I have so far been able to tell--succeed in disabling the "real-time" thing that kept "quarantining" my files.
should only take a moment in the group policy editor. you can actually filter settings by name to zero in on things quickly.
the only real cosmetic change i can see is for instance on the virus & threat protection page in windows 10, it says in red at the top of the window:
Your Virus & threat protection is managed by your organization.
the only real cosmetic change i can see is for instance on the virus & threat protection page in windows 10, it says in red at the top of the window:
Your Virus & threat protection is managed by your organization.
windows defender was one of the (many) reasons I gave up on windows and replaced the last windows machine I had with a Mac Mini. (FC33 on my main)
Very similar experience here, coupled with windows defender randomly switching itself back on and quaranteening half my (completely benign) development folder.
The last time it did that I spent an entire afternoon trying to get it disabled and get my files back onto the machine with only limited success.
I think it may be a windows home vs windows professional thing.
But rather than wrestle with it further I just gave up. Only thing I had left that really needed windows was word and excel which ironically actually now work better and crash less on the mac mini than they ever did on windows.
Very similar experience here, coupled with windows defender randomly switching itself back on and quaranteening half my (completely benign) development folder.
The last time it did that I spent an entire afternoon trying to get it disabled and get my files back onto the machine with only limited success.
I think it may be a windows home vs windows professional thing.
But rather than wrestle with it further I just gave up. Only thing I had left that really needed windows was word and excel which ironically actually now work better and crash less on the mac mini than they ever did on windows.
I assume by the downvotes its not a home vs professional issue?
In which case Im more glad i didnt waste money on the professional version, than I am sorry you would prefer my personal experience be kept quiet.
In which case Im more glad i didnt waste money on the professional version, than I am sorry you would prefer my personal experience be kept quiet.
> I don't know if I even can disable that part
It's tamper protection, you can disable it. (I hate it too.)
It's tamper protection, you can disable it. (I hate it too.)
Try to uninstall it.
I had to get signed permission from our IT contractors to disable it. But then again, I was trying to get a PDF of a Categorical Logic paper from an Italian university’s website and the filters kept blocking for pornography and sending emergency messages to the contractor to audit my computer.
Sounds weird...
Do you know to what extent those are correlated? That is: is the contractor told every time the filter thinks it has found adult entertainment? Or was your case exceptional?
[deleted]
This reply is really delayed, but our office rather small and so the contractor is notified and the event logged every time the filter thinks it blocks adult entertainment. I was being stubborn and repeatedly trying to access the site via other directories, link patches, etc. and that’s why the contractor was actually notified in real time.
I personally don't see a reason to have any kind of AV installed on my system(AV software is generally a performance decrease anyways). I should note that I used to work in the AV industry many years ago, so I consider my security knowledge above average and almost everything that I consider non-essential is being run inside a VM(also do RE as a hobby).
I will contend that antivirus is a net-positive to absolutely nobody. Not technically adept users, not office workers, not grandma, nobody.
It slows down literally everything you do with your computer in the best case. In the worst case it breaks things and is itself an exploitation avenue. Mostly it just isn't actually very good at its job and malware defeats it regularly.
This is a bad tradeoff and other mitigation strategies make more sense in every scenario I can conceive of.
It slows down literally everything you do with your computer in the best case. In the worst case it breaks things and is itself an exploitation avenue. Mostly it just isn't actually very good at its job and malware defeats it regularly.
This is a bad tradeoff and other mitigation strategies make more sense in every scenario I can conceive of.
Oh no, it certainly helps grandmas and the one-per-classroom public computers (China, 2008-). You get all the USB sticks coming in and out, and before you know it you get that one obnoxious virus that hides all folders and replaces them with a .exe of the same name.
And yeah they do boot from a readonly C: with some magic to make it appear writable per session. But re-infection is quick, especially when you have extra writable data partitions.
And yeah they do boot from a readonly C: with some magic to make it appear writable per session. But re-infection is quick, especially when you have extra writable data partitions.
I think application whitelisting by signature is a better fit for that use case. If for some reason you are required to allow arbitrary applications then the malware protection is probably going to cause more problems than it solves anyway.
On one very tiring day I decided I wanted to see that stupid useless video someone had sent me, and I updated Flash to see it. It failed and I thought no more of it.
Happily, the worm detected Avast and shut it down regularly and that's how I 4h later found out I had behaved like a regular user instead of a power one.
AV helps: 1) People do stupid things 2) defense in depth
Happily, the worm detected Avast and shut it down regularly and that's how I 4h later found out I had behaved like a regular user instead of a power one.
AV helps: 1) People do stupid things 2) defense in depth
Do professional drivers need to wear seatbelts?
The truth is that even really good technologists sometimes make mistakes. My insurance agent's email got hacked recently. I was in the process of renewing a policy, so opened the link to a phishing site and entered credentials. Oops. Thankfully I immediately noticed and changed the password (+ had two factor on.) Had that been an attached PDF instead I probably would have opened it.
At this point, consumer/end machine AV is a bit like vaccinations for diseases that are largely under control- attacks aren't spreading because the there are many protections in place, but if the unprotected population rises (especially in high value targets like developers) than the attacks will increase.
Configure AV? Sure. In fact just last week or so I had to validate that a server level product was really scanning user uploaded files correctly, so I had purposefully download known bad file (The sample file from EICAR) https://www.eicar.org/?page_id=3950). Getting defender setup so I could handle that file was annoying but manageable. I've also disabled real time scanning of certain applications and processes for performance reasons.
However, would I run without it on at all? Nope- I'm pretty good driver, but I still wear my seatbelt.
The truth is that even really good technologists sometimes make mistakes. My insurance agent's email got hacked recently. I was in the process of renewing a policy, so opened the link to a phishing site and entered credentials. Oops. Thankfully I immediately noticed and changed the password (+ had two factor on.) Had that been an attached PDF instead I probably would have opened it.
At this point, consumer/end machine AV is a bit like vaccinations for diseases that are largely under control- attacks aren't spreading because the there are many protections in place, but if the unprotected population rises (especially in high value targets like developers) than the attacks will increase.
Configure AV? Sure. In fact just last week or so I had to validate that a server level product was really scanning user uploaded files correctly, so I had purposefully download known bad file (The sample file from EICAR) https://www.eicar.org/?page_id=3950). Getting defender setup so I could handle that file was annoying but manageable. I've also disabled real time scanning of certain applications and processes for performance reasons.
However, would I run without it on at all? Nope- I'm pretty good driver, but I still wear my seatbelt.
first thing i do for a fresh windows install: i jump in the group policy editor and disable Defender and other things. been burned way too many times. granted, some of my projects definitely raise a lot of red flags heuristically...being packed and self modifying, etc.
Sadly it’s often a contractual / insurance requirement.
At home?
If anything I think it makes more sense to have higher security requirements for a computer that will be primarily used outside of a controlled corporate network.
i have been using no av on my main machine for a long time. in the rare cases i was doing RE or sketchy execution, vm or dedicated offline old machine
If you joined a domain, you're not alone anymore.
the "reputable source" you downloaded from can always be compromised
Do you disassemble every EXE file before running it? Do you have an absolute protection against zero-days? (In the latter case it can't protect you against initial infection, but it will clear things up once the threat is discovered.)
Do you? With sufficient expertise that would provide better protection than AV software.
Tried it. Windows Defender thinks it's "Trojan:Win32/Orsam!rfn" on my PC, which is different from "Glupteba!ml". It does let me override and keep it.
I work in Cyber Security and I would never want to run any Next Gen antivirus software (such as Defender ATP) on my private computers. For a corporation or organization that wants tight control, these are perfect products. You can go full Orwell 1984 on your org with these tools and they do provide good endpoint protection including graph and AI based (post-signature) antivirus and full Event Detection and Respond* (essentially a spy-black-box), which is great if you're a company or org. However this is a future you do not want to be part of in your private life.
* See for instance documentation on Microsoft Defender ATP EDR in Block Mode
* See for instance documentation on Microsoft Defender ATP EDR in Block Mode
Your concerns extend to the OS itself by the way. Windows is a full blown surveillance platform now.
Defender ATP telemetry also sends much more home than the customer can ever see. They claim to anonymize it but anyone who works in security for a living knows just how much story you can tell with relatively little data.
Defender ATP telemetry also sends much more home than the customer can ever see. They claim to anonymize it but anyone who works in security for a living knows just how much story you can tell with relatively little data.
It's things like this that are making me less and less likely to continue using Windows at home.
I've been running Linux KDE dual booting for a year or so, and I've have touched Windows in (uptime...) - 22 days or so.
With Windows 11 coming bundled with Teams, and other "stuff" from Windows 10 including it becoming an 'internet first OS (x)' I'm getting stuff I don't want or need.
(x) although it's documented on the interwebs how to circumvent the dark pattern UI dialogs to turn stuff off.
I've been running Linux KDE dual booting for a year or so, and I've have touched Windows in (uptime...) - 22 days or so.
With Windows 11 coming bundled with Teams, and other "stuff" from Windows 10 including it becoming an 'internet first OS (x)' I'm getting stuff I don't want or need.
(x) although it's documented on the interwebs how to circumvent the dark pattern UI dialogs to turn stuff off.
> I've been running Linux KDE dual booting for a year or so, and I've have touched Windows in (uptime...) - 22 days or so.
Sounds like how I ended up on Linux full time. I dual booted for a while before I one day realized I hadn't booted into Windows for months. At that point I saw no valid reason to keep my Windows partition at all and just put in the effort to get my last few "Windowsy" activities switched over to Linux applications (mostly gaming and graphics related stuff).
Sounds like how I ended up on Linux full time. I dual booted for a while before I one day realized I hadn't booted into Windows for months. At that point I saw no valid reason to keep my Windows partition at all and just put in the effort to get my last few "Windowsy" activities switched over to Linux applications (mostly gaming and graphics related stuff).
15 years ago, often you found infected binaries on keygens and cracking tools.
On DeCSS, that made me nostalgic ahout DVDCSS and cracking a DVD movie in "just" 20 minutes with MPlayer. The key was cached, luckily.
On DeCSS, that made me nostalgic ahout DVDCSS and cracking a DVD movie in "just" 20 minutes with MPlayer. The key was cached, luckily.
Firefox 90.0b12 on Linux also reports that file as a virus/threat, and warns on download
A properly configured Defender ATP instance in a network is a beast to circumvent for attackers. It's a really nice piece of software as far as I'm concerned.
Defender on personal systems owned & maintained by a knowledgeable power user, maybe less useful.
Still, Defender ATP in the corporate environment is so much, much more than just an anti-virus scanner. There its primary functionality is EDR first, anti-virus distant second. And it works phenomenally.
Defender on personal systems owned & maintained by a knowledgeable power user, maybe less useful.
Still, Defender ATP in the corporate environment is so much, much more than just an anti-virus scanner. There its primary functionality is EDR first, anti-virus distant second. And it works phenomenally.
IIRC, there is a group policy setting called "Turn off routine remediation" to stop defender from auto-removing stuff.
There is also a setting to permanently disable automatic sample reporting. I enabled that on all my Windows machines after the first time I caught Defender exfiltrating sensitive files like places.sqlite database out of my FF profile directory.
There is also a setting to permanently disable automatic sample reporting. I enabled that on all my Windows machines after the first time I caught Defender exfiltrating sensitive files like places.sqlite database out of my FF profile directory.
Maybe this is a good time to ask a dumb question.... how do yall disable windows defender?
I spent a weekend on it last year and couldn't figure it out. Best I could surmise is that I need to wipe my hard drive and install a sketchy copy of "mad max edition" windows 10 enterprise, which I would have to download on TPB or some other Warez site.
I spent a weekend on it last year and couldn't figure it out. Best I could surmise is that I need to wipe my hard drive and install a sketchy copy of "mad max edition" windows 10 enterprise, which I would have to download on TPB or some other Warez site.
Stopping by later in the day to offer a solution to my own question in case someone else is struggling with the same:
https://github.com/AveYo/LeanAndMean
If you can run as TrustedInstaller, it becomes feasible to rip all of this kind of bullshit out.
Just got my latest patched Win10 Pro copy running totally free of defender. Service is properly stopped. I was able to stop it like you would any other with TI privileges. Local admin just gets denied.
https://github.com/AveYo/LeanAndMean
If you can run as TrustedInstaller, it becomes feasible to rip all of this kind of bullshit out.
Just got my latest patched Win10 Pro copy running totally free of defender. Service is properly stopped. I was able to stop it like you would any other with TI privileges. Local admin just gets denied.
To turn it off permanently, there's a registry entry:
https://itty.bitty.site/#Disable_Real_Time_Protection_Perman...
I'm not sure whether or not it works on non-pro versions of Windows.
https://itty.bitty.site/#Disable_Real_Time_Protection_Perman...
I'm not sure whether or not it works on non-pro versions of Windows.
This does not work anymore.
https://www.pcgamer.com/permanently-disabling-windows-10s-bu...
https://www.pcgamer.com/permanently-disabling-windows-10s-bu...
...oh. Uh, that's super bad. I didn't know because I'm on LTSC.
Not sure why you’d want to disable virus protection, but Microsoft has a guide should you want to: https://support.microsoft.com/en-us/windows/turn-off-defende...
> Follow these steps to temporarily turn off real-time Microsoft Defender antivirus protection in Windows Security.
How long is "temporary"?
> Not sure why you’d want to disable virus protection
Because Microsoft's implementation drags ass when fighting with one of Microsoft's other terrible messes - visual studio.
Also. It's my fucking computer.
How long is "temporary"?
> Not sure why you’d want to disable virus protection
Because Microsoft's implementation drags ass when fighting with one of Microsoft's other terrible messes - visual studio.
Also. It's my fucking computer.
You can (depending on group policy if domain joined) disable real time scanning on individual processes, files, and folders in a more permanent manner IRC.
There's a registry (or group policy?) tweak to turn it off for good.
It was absolutely necessary on my 2015-era laptop, especially in the era of WSL1 where every Linux-side file operation caused a Defender operation - made a huge difference running test suites, git operations and so on.
I've tried to leave it on my new laptop (esp on WSL2 where Defender doesn't get a look-in) but I can _smell_ when it's slowing me down.
It was absolutely necessary on my 2015-era laptop, especially in the era of WSL1 where every Linux-side file operation caused a Defender operation - made a huge difference running test suites, git operations and so on.
I've tried to leave it on my new laptop (esp on WSL2 where Defender doesn't get a look-in) but I can _smell_ when it's slowing me down.
O&O ShutUp10: https://www.oo-software.com/en/shutup10
First, you are relying on Kaspersky which I don't think is that reliable of a source anymore give what we know. Second, I can definitely say there are something up with a lot of keygens and cracks. I thought a lot of big name scene groups were reputable and there is no way that they'd sneak in a trojan, but low and behold after ignoring a few Windows Defender warnings... I could literally hear my computer randomly spinning up at random times, it would never sleep, games were choppy, etc.
Did a complete reinstall without installing any scene software and the problem was solved. Just because people haven't taken the time to properly investigate the security of cracks and keygens doesn't mean that they don't contain actual trojans.
Did a complete reinstall without installing any scene software and the problem was solved. Just because people haven't taken the time to properly investigate the security of cracks and keygens doesn't mean that they don't contain actual trojans.
No shit, cracks and keygen are at extremely elevated risk of malware lol.
https://www.arch13.com/ms-windows-defender-decss-part-ii/
OP Here. That lasted 3 days and then the file got blacklisted again as a generic definition.
Whitelists and exceptions in MS Defender still do not work. It ignores them and yeets the file anyway.
OP Here. That lasted 3 days and then the file got blacklisted again as a generic definition.
Whitelists and exceptions in MS Defender still do not work. It ignores them and yeets the file anyway.
[deleted]
The ML antivirus detections are out of control.
Ok, honest question. How do they come up with those names for the malware?
Glupteba!ml looks like a randomly generated thing, but I’m sure it’s not.
Glupteba!ml looks like a randomly generated thing, but I’m sure it’s not.
The "!ml" stands for machine learning so what else could the name be except randomly generated?
He said DirectConnect!
and this is why you use the group policy editor
Wait until Windows 11 comes along and has more security features enabled.
There's a hidden feature in Defender, that will delight any user : it can turn your 15" MacBook Pro into a full breakfast machine. Want pancakes ? Start a zoom call.
While you wait for your favorite video conference app to start, don't hope to finish your docker pull/save/build in less than 30 times its usual time. Your laptop I/O will be so cripled that you might get better bandwith with a floppy disk drive (I'm exagerating a bit, but that's how it feels to go from 120MB/s to 4MB/s on a SSD).
Our Mac IT is completely powerless. I never thought I would ever regret getting rid of Symantec. I was wrong.