Live data from Hacker News

Firefox engineers discover a Windows Defender bug that causes high CPU usage

bugzilla.mozilla.org

171–180 of 223 posts

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#171
post #106

It used to be possible to disable real-time protection but know it’s not. The UI toggle is only for a limited time and the Group Policy option doesn’t work anymore.

The gpedit option to disable the real time component continues to work. The toggle for disabling all of it doesn’t.

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#172
post #4

TL;DR: Windows Defender had a bug that made certain system calls expensive on CPU cycles when Defender's Real-time Protection feature is enabled. After discovery, Mozilla reported this issue to Microsoft. Microsoft is releasing a patch that should result in lower CPU usage when using Firefox on sites like YouTube (a ~75% CPU usage reduction was noted when browsing YouTube in Firefox with the fixed version of Defender…

I've seen some really weird performance behavior from Defender and I just keep it disabled on my desktop device now. I'm not surprised to see it affecting Firefox like this. Defender's dropped all the way to the bottom of the list in effectiveness anyway, so I don't feel it's a big loss.

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#173
post #47

Earlier quoted context omitted.

On my base M1 MacBook Air FireFox is noticeably slower than Chrome/Edge/Safari.

Strange, I have the same laptop on a fast network and I can't tell the difference.

I can't tell the difference either even with all the add-ons I use. FF runs great on my M1.

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#174
post #106

It used to be possible to disable real-time protection but know it’s not. The UI toggle is only for a limited time and the Group Policy option doesn’t work anymore.

Try `Set-MpPreference -DisableRealtimeMonitoring $true` from admin powershell.

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#175

Windows Defender is a long standing bug in the Windows operating system. ;) My impression is that its invention was for the sole purpose of eradicating the idea that Windows is insecure and prone to viruses, which explains why it can be overzealous and CPU hungry. I would only enable it for family members who don't know what they are doing. For some reason, I haven't needed any form of active virus scanning in someth…

There's a misconception that you need to do something "stupid" to get a virus which is simply not the case. 0 days exist, and worms are still a thing (looking at you samba). A great example is Pytorch just recently had a supply chain attack, and installing the nightly version between December 25th and December 30th, 2022 - would result in your home directory getting uploaded including ssh keys. Chrome also just had a…

> A great example is Pytorch just recently had a supply chain attack, and installing the nightly version between December 25th and December 30th, 2022 - would result in your home directory getting uploaded including ssh keys.

Do you think Defender would have helped with that? I'm highly doubtful.

What would probably have, is if MS's implementation of protected folders, or whatever it's called, wouldn't have been completely brain-dead.

> EDIT: Also there's a misconception that linux somehow doesn't get viruses - however the Pytorch attack affected linux users. Making a virus for windows gives you far more targets then linux, which is why they're far more common.

That's correct. But at least on Linux, if you're so inclined, you can spend a couple of hours setting up some AppArmor or SELinux profiles to prevent random crap for accessing ~/.ssh and ~/top-secret.

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#177

Windows Defender is a long standing bug in the Windows operating system. ;) My impression is that its invention was for the sole purpose of eradicating the idea that Windows is insecure and prone to viruses, which explains why it can be overzealous and CPU hungry. I would only enable it for family members who don't know what they are doing. For some reason, I haven't needed any form of active virus scanning in someth…

There's a misconception that you need to do something "stupid" to get a virus which is simply not the case. 0 days exist, and worms are still a thing (looking at you samba). A great example is Pytorch just recently had a supply chain attack, and installing the nightly version between December 25th and December 30th, 2022 - would result in your home directory getting uploaded including ssh keys. Chrome also just had a…

Would windows defender have protected against this?

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#178
post #77

Is Windows Defender even worth enabling? It eats up a lot of CPU. It doesn’t seem like much help in a default update enabled system where you are using a regular user account instead of an administrator account. In addition, anti-virus and real time scanning is itself potential surface area for an exploit (for example a few years back there was an exploit based on Norton antivirus email scanner).

Yes. It uses next to no system resources (issues like this aside), it integrates perfectly with Windows (it comes from Microsoft, after all), it's reasonably effective (to the chagrin of AV vendors the world over), and it isn't intrusive.

Its definitely as intrusive as other AV products. with Microsoft's push for more telemetry collection.

but it does integrate with the system well since its from Microsoft.

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#179

Earlier quoted context omitted.

It's not just mozilla, been working defender issues for the last few years on thousands of windows vm's. Mostly due to the enabling the more intensive heuristic real time engine and they have different code bases depending on versions installed on different windows builds, and patching does seem to trigger it. For months we had issues where we couldnt log into some vm's due to high cpu for defender, and had to bounce…

I have malwarebytes premium and defender CPU usage is nearly 100% at times bringin Firefox to a halt. Chrome works fine..I've been blaming Firefox so far.

Did you report this on Bugzilla? Even if it's not Firefox's fault if you don't report it no-one knows about the issue.

Recent versions of Firefox allow you to block some stuff like that: https://support.mozilla.org/en-US/kb/identify-problems-third...

Though it's possible they use different code injection tricks to make blocking impossible. (You can't block Defender from listening to events for example)

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#180
post #35
post #4

TL;DR: Windows Defender had a bug that made certain system calls expensive on CPU cycles when Defender's Real-time Protection feature is enabled. After discovery, Mozilla reported this issue to Microsoft. Microsoft is releasing a patch that should result in lower CPU usage when using Firefox on sites like YouTube (a ~75% CPU usage reduction was noted when browsing YouTube in Firefox with the fixed version of Defender…

Well, also Firefox is making an excessive number of calls to that slow system call compared to other browsers (Chrome, Edge).

What determines "excessive"? In this case it's for a security feature that Chrome lacks(!).
Post reply on HN