Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MS Windows Defender and DeCSS

arch13.com

Post reply on HN
Print view View original

141–150 of 211 posts

Re: MS Windows Defender and DeCSS

#141

Post by magicalhippo »

kwonkicker wrote: post #15
john_moscow wrote: post #9

To be fair, this does look like a false positive. In general, the desktop antivirus space in 2021 is a mess. Because of the sheer number of malware, and some obfuscation techniques used by some of it, antivirus software has to use very broad regular expressions for describing the malware, counterbalanced by huge whitelists of known mainstream software. If you don't qualify as a "mainstream software vendor", simply bu…

I don't care how broad your definition is, it shouldn't include the mp4 files in my hard drive.

I think most users would be happy to avoid getting infected via content files like videos and pictures[1][2].

Us power users can always just configure the exception list.

[1]: https://docs.microsoft.com/en-us/security-updates/SecurityBu...

[2]: https://www.kb.cert.org/vuls/id/297462

Re: MS Windows Defender and DeCSS

#142

Post by SCHiM »

A properly configured Defender ATP instance in a network is a beast to circumvent for attackers. It's a really nice piece of software as far as I'm concerned.

Defender on personal systems owned & maintained by a knowledgeable power user, maybe less useful.

Still, Defender ATP in the corporate environment is so much, much more than just an anti-virus scanner. There its primary functionality is EDR first, anti-virus distant second. And it works phenomenally.

Re: MS Windows Defender and DeCSS

#143

Post by marcosdumay »

grishka wrote: post #136
ddalex wrote: post #133

Earlier quoted context omitted.

> There's nothing to stop you from booting into another OS and deleting the files implementing the harmful functionality. If there are checks for the presence of these files in other parts of the OS, you can remove them Encrypted disks with TPM-stored keys will certainly prevent unauthorised modification to a filesystem > hardware allows booting arbitrary code And this particular cat is already out of the bag with Wi…

So this might be a dumb question, but what's there to prevent someone emulating a TPM? What's there to prevent someone nop'ing out the code that implements the TPM functionality in Windows? Where does the root of trust (or, rather, distrust) come from?

The TPM chip has a builtin key that you, as the device owner is not allowed to read. That key is certified by the manufacturer.

If any manufacturer starts selling chips where you can read the key, it will be disallowed by Microsoft.

Re: MS Windows Defender and DeCSS

#144

Post by marcosdumay »

rovr138 wrote: post #125
mszcz wrote: post #120

Earlier quoted context omitted.

Care to elaborate? I'm using Windows as a primary dev machine for years and I've encountered no problems aside from the infuriating update-related restarts. What am I missing? This is an actual, emotionless, genuine question? Always looking to find new ways to procrastinate by trying out new tools ;)

Ultimately it depends on what you need and what you develop for. If you’re developing for the Linux kernel, I bet you’re missing out on some stuff. If you’re building web, it doesn’t matter. If you’re building docker images, you can do it on Windows/Mac, but there’s just better performance on Linux if you’re ever debugging speed. Java? Doesn’t matter either.

More specifically, Windows is an horrible environment for C, C++, or Rust, Haskell, or any kind of language where most developers do not like IDEs. Bad for Python, Ruby, PHP, Perl where IDEs do exist, but it's not a given that they are better than simple editors. Not really good for Javascript or any language with extensive use of dependencies and configuration.

It's not better than Linux for any language, but it comes really close for the IDE oriented ones.

Re: MS Windows Defender and DeCSS

#145

Post by gruez »

Xylakant wrote: post #67
geofft wrote: post #21

Earlier quoted context omitted.

Er, doesn't that assume that the mp4 files on your hard drive can't genuinely be infected with viruses? Why is that assumption true?

Especially given how common media files are as an attack vector.

Are they? Compared to other forms (eg. trojans or browser/os 0days) they're not really common. I suspect you have a better chance of getting infected from a site asking you to download a "codec", than you have of the site serving you a malformed media file.

Re: MS Windows Defender and DeCSS

#146

Post by grishka »

marcosdumay wrote: post #143
grishka wrote: post #136

Earlier quoted context omitted.

So this might be a dumb question, but what's there to prevent someone emulating a TPM? What's there to prevent someone nop'ing out the code that implements the TPM functionality in Windows? Where does the root of trust (or, rather, distrust) come from?

The TPM chip has a builtin key that you, as the device owner is not allowed to read. That key is certified by the manufacturer. If any manufacturer starts selling chips where you can read the key, it will be disallowed by Microsoft.

So okay, you again assume that software is immutable. But Windows has to store these trusted keys somewhere. What if I emulate the TPM with a key I generated myself, and patch Windows to trust that key?

Re: MS Windows Defender and DeCSS

#147

Post by Xylakant »

gruez wrote: post #145
Xylakant wrote: post #67

Earlier quoted context omitted.

Especially given how common media files are as an attack vector.

Are they? Compared to other forms (eg. trojans or browser/os 0days) they're not really common. I suspect you have a better chance of getting infected from a site asking you to download a "codec", than you have of the site serving you a malformed media file.

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jpeg returns 390 results. And that’s jpeg alone. It’s fairly common that you see some sort of media file format parsing bug to lead to command execution.

Re: MS Windows Defender and DeCSS

#148

Post by dane-pgp »

marcosdumay wrote: post #143
grishka wrote: post #136

Earlier quoted context omitted.

So this might be a dumb question, but what's there to prevent someone emulating a TPM? What's there to prevent someone nop'ing out the code that implements the TPM functionality in Windows? Where does the root of trust (or, rather, distrust) come from?

The TPM chip has a builtin key that you, as the device owner is not allowed to read. That key is certified by the manufacturer. If any manufacturer starts selling chips where you can read the key, it will be disallowed by Microsoft.

So control over all the computers in a country comes down to just a few keys held by "approved" manufacturers; or rather a single key, held by the government, which signs the list of approved manufacturer keys.

Then all they need to do is require that ISPs only allow packets to be sent by computers that have passed a Measured/Trusted Boot check, and suddenly all online activity is restricted to "approved" computers, running code from "approved" app stores.

"One Ring to rule them all, One Ring to find them, One Ring to bring them all and in the darkness bind them."

Re: MS Windows Defender and DeCSS

#149

Post by userbinator »

grishka wrote: post #136
ddalex wrote: post #133

Earlier quoted context omitted.

> There's nothing to stop you from booting into another OS and deleting the files implementing the harmful functionality. If there are checks for the presence of these files in other parts of the OS, you can remove them Encrypted disks with TPM-stored keys will certainly prevent unauthorised modification to a filesystem > hardware allows booting arbitrary code And this particular cat is already out of the bag with Wi…

So this might be a dumb question, but what's there to prevent someone emulating a TPM? What's there to prevent someone nop'ing out the code that implements the TPM functionality in Windows? Where does the root of trust (or, rather, distrust) come from?

What's there to prevent someone nop'ing out the code that implements the TPM functionality in Windows?

Nothing absolute, mainly a long series of annoying hurdles - including the constant barrage of updates.

Re: MS Windows Defender and DeCSS

#150

Post by marcosdumay »

grishka wrote: post #146
marcosdumay wrote: post #143

Earlier quoted context omitted.

The TPM chip has a builtin key that you, as the device owner is not allowed to read. That key is certified by the manufacturer. If any manufacturer starts selling chips where you can read the key, it will be disallowed by Microsoft.

So okay, you again assume that software is immutable. But Windows has to store these trusted keys somewhere. What if I emulate the TPM with a key I generated myself, and patch Windows to trust that key?

Then you will discover that Secure Boot will stop your computer from starting until you reinstall something signed by Microsoft.
Post reply on HN