Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MS Windows Defender and DeCSS

arch13.com

Post reply on HN
Print view View original

101–110 of 211 posts

Re: MS Windows Defender and DeCSS

#101

Post by 1_player »

qwerty456127 wrote: post #90
1_player wrote: post #84

Earlier quoted context omitted.

I don't know if my installation is broken, but I haven't had Defender remove what I thought was a legitimate binary since I first installed Windows 10. Literally not one single time on half a dozen installations. FWIW I installed and ran qBitTorrent recently and it didn't complain.

> I haven't had Defender remove what I thought was a legitimate binary Probably because you are closer to a "typical" kind of user who doesn't use "hack tools" (which some people like me use for absolutely legal and benevolent purposes "hacking" their own PC, e.g. to backup the passwords and e-mail records saved on it). By the way it also is very important to distinguish between a legitimate hack tool and an infected…

I just checked, perhaps the fact that I have "reputation-based" blocking always disabled helps, which seems to avoid that kind of false positive. I am not a fan of my OS phoning home to check every single executable I run. Either it's in the virus database, or I'm tech-savvy enough not to run any .exe I receive via e-mail.

https://www.tenforums.com/tutorials/32236-enable-disable-mic...

Re: MS Windows Defender and DeCSS

#102

Post by unixhero »

I work in Cyber Security and I would never want to run any Next Gen antivirus software (such as Defender ATP) on my private computers. For a corporation or organization that wants tight control, these are perfect products. You can go full Orwell 1984 on your org with these tools and they do provide good endpoint protection including graph and AI based (post-signature) antivirus and full Event Detection and Respond* (essentially a spy-black-box), which is great if you're a company or org. However this is a future you do not want to be part of in your private life.

* See for instance documentation on Microsoft Defender ATP EDR in Block Mode

Re: MS Windows Defender and DeCSS

#104

Post by mattbee »

colejohnson66 wrote: post #97
bob1029 wrote: post #96

Maybe this is a good time to ask a dumb question.... how do yall disable windows defender? I spent a weekend on it last year and couldn't figure it out. Best I could surmise is that I need to wipe my hard drive and install a sketchy copy of "mad max edition" windows 10 enterprise, which I would have to download on TPB or some other Warez site.

Not sure why you’d want to disable virus protection, but Microsoft has a guide should you want to: https://support.microsoft.com/en-us/windows/turn-off-defende...

There's a registry (or group policy?) tweak to turn it off for good.

It was absolutely necessary on my 2015-era laptop, especially in the era of WSL1 where every Linux-side file operation caused a Defender operation - made a huge difference running test suites, git operations and so on.

I've tried to leave it on my new laptop (esp on WSL2 where Defender doesn't get a look-in) but I can _smell_ when it's slowing me down.

Re: MS Windows Defender and DeCSS

#105

Post by tempfs »

unixhero wrote: post #102

I work in Cyber Security and I would never want to run any Next Gen antivirus software (such as Defender ATP) on my private computers. For a corporation or organization that wants tight control, these are perfect products. You can go full Orwell 1984 on your org with these tools and they do provide good endpoint protection including graph and AI based (post-signature) antivirus and full Event Detection and Respond* (…

Your concerns extend to the OS itself by the way. Windows is a full blown surveillance platform now.

Defender ATP telemetry also sends much more home than the customer can ever see. They claim to anonymize it but anyone who works in security for a living knows just how much story you can tell with relatively little data.

Re: MS Windows Defender and DeCSS

#106

Post by Wowfunhappy »

bob1029 wrote: post #96

Maybe this is a good time to ask a dumb question.... how do yall disable windows defender? I spent a weekend on it last year and couldn't figure it out. Best I could surmise is that I need to wipe my hard drive and install a sketchy copy of "mad max edition" windows 10 enterprise, which I would have to download on TPB or some other Warez site.

To turn it off permanently, there's a registry entry:

https://itty.bitty.site/#Disable_Real_Time_Protection_Perman...

I'm not sure whether or not it works on non-pro versions of Windows.

Re: MS Windows Defender and DeCSS

#107

Post by qwerty456127 »

1_player wrote: post #101
qwerty456127 wrote: post #90

Earlier quoted context omitted.

> I haven't had Defender remove what I thought was a legitimate binary Probably because you are closer to a "typical" kind of user who doesn't use "hack tools" (which some people like me use for absolutely legal and benevolent purposes "hacking" their own PC, e.g. to backup the passwords and e-mail records saved on it). By the way it also is very important to distinguish between a legitimate hack tool and an infected…

I just checked, perhaps the fact that I have "reputation-based" blocking always disabled helps, which seems to avoid that kind of false positive. I am not a fan of my OS phoning home to check every single executable I run. Either it's in the virus database, or I'm tech-savvy enough not to run any .exe I receive via e-mail. https://www.tenforums.com/tutorials/32236-enable-disable-mic...

I didn't even know there is such a "reputation" option. Today Windows configuration windows are way harder to find anything (what you don't already know is there/where) in than they used to be even in Windows 7, let alone XP (where everything was way more intuitive and easy to discover). As for submitting the files to Microsoft - I believe I have disabled that but in the today context I can't be sure it didn't get enabled on itself.

Re: MS Windows Defender and DeCSS

#108

Post by eurasiantiger »

pwdisswordfish8 wrote: post #63
eurasiantiger wrote: post #59

Earlier quoted context omitted.

What would it match against? ASCII strings? Add a whitelisted string and make your malware pass. The heuristics are much more complex than that, cf. spamassassin rules.

Opcode sequences. Regular expressions may be applied to any formal language, not just ones based on human-readable alphabets.

That kinda makes sense, thanks.

However, wouldn’t this kind of heuristic be extremely simple to counter by obfuscating the machine code, e.g. by inserting complex noops and using threaded subroutines which individually look innocuous? Or, are this kind of techniques looking at known syscall patterns or something like that, and ignoring the general program flow?

To me, regex doesn’t seem applicable to static analysis of machine code, but what do I know :)

Re: MS Windows Defender and DeCSS

#109

Post by ocdtrekkie »

gspr wrote: post #76
nix23 wrote: post #71

Earlier quoted context omitted.

Wait...your are local Admin on your machine?

I'd quit my job if work didn't let me be root on my work machine.

And anywhere with a good IT department would say "bye". From my experience, people with reasonable technical skills are the most likely people to defy IT policies, even without admin rights.
Post reply on HN