[deleted]
Avoid Non-Microsoft Antivirus Software
351–360 of 388 posts
Re: Avoid Non-Microsoft Antivirus Software
#352Earlier quoted context omitted.
Yeah, through the new Windows control panel ("Settings" -> "Update & Security" -> "Windows Defender"). Windows will hound you about that (and there is no way I know to turn off the nag).
I've heard if you disable the service directly, then the "Windows Defender reports that the service is turned off" message stops happening. sc.exe config "WinDefend" start= disabled sc.exe stop "WinDefend"
No good I'm afraid, gave me:
[SC] OpenService FAILED 5:
Access is denied.
Re: Avoid Non-Microsoft Antivirus Software
#353I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software dev…
Not to detract from the main point but for Bitdefender specifically ssl MITM looks like a paid feature. Which is ironic.
So, just use free version. I am not sure if it sends out all the plain url's though. If anybody knows for sure please let us know.
Re: Avoid Non-Microsoft Antivirus Software
#354I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software dev…
I am not disagreeing with you, but I want to point out that, usually, the certificate is generated locally during setup and then installed in the trusted certificates store. So no one else should have that certificate. I also assume there is an option somewhere to disable the MITM scanner.
Bitdefender free version doesn't have ssl MITM feature.
Neither it installs root cert as far as I can see.
Re: Avoid Non-Microsoft Antivirus Software
#355Earlier quoted context omitted.
No, I don't think so and if it does, please tell me which browser does it so I can keep away from it, because that defeats the purpose of TLS. Either way, Bitdefender installs their own root certificate and generates their own for google.com. I've got proof if you want.
I have bitdefender and I was wondering how I can check if it does it on my pc and mac and how I can disable it (if possible). Could you help me in the right direction?
Open https://www.google.com/ and see what cert you've got.
If it's "bitdefender something" instead of google
then uncheck "Scan SSL" in bitdefender and google how to remove root cert from trusted root cert store assuming former doesn't do it for you.
Re: Avoid Non-Microsoft Antivirus Software
#356Earlier quoted context omitted.
I am not disagreeing with you, but I want to point out that, usually, the certificate is generated locally during setup and then installed in the trusted certificates store. So no one else should have that certificate. I also assume there is an option somewhere to disable the MITM scanner.
> I also assume there is an option somewhere to disable the MITM scanner. By default this is ON and users don't have the competence to recognize that this is in fact increasing the surface area for attacks and to disable it. The mere existence of a setting that is ON by default doesn't absolve such AV companies. But speaking of Bitdefender in particular, I installed it on my wife's computer, disabled that option, con…
When I was using bitdefender, this was the first setting I disabled after installing it. Bitdefender also has a slew of other issues, including BSODing after installation.
Re: Avoid Non-Microsoft Antivirus Software
#357Earlier quoted context omitted.
> In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. It doesn't have to be insecure. If the software that does the MITM checks the certificates correctly, I don't see how it would be worse than letting the browser handle it. Not that I'd ever use an antivirus, of course.
It actually is worse. The problem comes "what does the interception do when it encounters an invalid certificate"? So for example a self-signed cert. does it a) create a "valid" cert itself, hiding the error from the user? This is obviously dangerous b) create an "invalid" self-signed cert. This is messy as a user will then see a self-signed cert from the A-V vendor, which they may be more or less inclined to trust c…
I think what bluecoat proxy at my work does in this case is just inspect traffic and pass invalid cert to the client, since it is invalid already. If the cert is valid, replaces it with its own cert.
Re: Avoid Non-Microsoft Antivirus Software
#358Earlier quoted context omitted.
With cloud reputation service all AV user base (provided sufficiently large) turn into global sensor network, along with honeypots vendors maintain separately. This allows (at the cost of users' privacy) to detect new emerging threats within hours, then acquire samples, analyze them and deploy new signatures within days. Google can of course react equally fast. But "signal delay" may be much higher, as users report o…
Google owns VirusTotal, so they either alternatively have a strong set of tagged samples to work with, or an incentive to not disrupt their partnerships with exiting vendors.
Good point. A huge, high quality dataset to train their own AI-based malware detection engine. Someone must be doing this already, at least as a research project.
Re: Avoid Non-Microsoft Antivirus Software
#359Earlier quoted context omitted.
> I also assume there is an option somewhere to disable the MITM scanner. By default this is ON and users don't have the competence to recognize that this is in fact increasing the surface area for attacks and to disable it. The mere existence of a setting that is ON by default doesn't absolve such AV companies. But speaking of Bitdefender in particular, I installed it on my wife's computer, disabled that option, con…
Bitdefender likes to revert to default settings frequently. I prefer Windows Firewall (Win7) and have to turn off the Bitdefender firewall usually at least once a week.
What is the reason you're using the software at all? What is it achieving for you? Genuinely interested in the motivations.