Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ruined my vacation by reverse engineering WSC

blog.es3n1n.eu

Post reply on HN
Print view View original

191–196 of 196 posts

Re: I ruined my vacation by reverse engineering WSC

#191

Post by tmcdos »

kenjackson wrote: post #120
stuffoverflow wrote: post #53

Earlier quoted context omitted.

I have yet to see concrete evidence that disabling Windows update and windows defender would elevate risk of having the system compromised in any meaningful way. I installed Windows 10 2016 ltsc on a VM at the end of last year out of curiosity to test that. Disabled wupdate and defender before letting it access the internet so that it was basically 8 years behind on any updates. I tried browsing all kinds of sketchy…

You benefit from the fact that most machines are patched. If a lot more people used 2016 builds and didn’t patch you’d see a lot more exploits.

I use stock Win7 SP1 with just a couple updates (recently TLS and SHA-512, but only 27 hotfixes in total) and the only way to break something is if I deliberately run unverified executables that were manually downloaded from untrusted sources. And since I don't do this - my machine is still running the same installation that I did on December 24th 2014.

Re: I ruined my vacation by reverse engineering WSC

#192

Post by musjleman »

AStonesThrow wrote: post #182
musjleman wrote: post #157

Earlier quoted context omitted.

> Let’s cut the bullshit, Defender is basically unchanged as a concept since Windows Vista or maybe even Windows XP. It runs completely fine on 15 year old hardware. Exactly. It's the same legacy scan every fucking thing you open AV architecture. Back in the day of spinning disks it probably wouldn't have been too noticeable for the AV to marshal scanning to its usermode service and the filesystem to pull the data fr…

Yeah so like, every time I ran AV software it was quite obvious where the paranoia settings were, and how to tone down the aggressive "scan everything everywhere every time" settings. For 98% of systems, there is probably no reason to scan every file on opening it. If people have enabled that setting, or left that default on, then that's their problem; it's not Windows Defender's fault. My current AV dashboards are s…

> If people have enabled that setting, or left that default on, then that's their problem; it's not Windows Defender's fault.

There is no such setting for Defender. The file scanning is either on or defender is completely off. To even access some of the better stuff like ASR rules (that are disabled by default) you need third-party software or pay for their enterprise offering.

Consumer Defender literally has like 4 toggles in total. It's a dumbed down and extremely permissive AV because it runs on every Windows machine.

Re: I ruined my vacation by reverse engineering WSC

#193

Post by rstuart4133 »

janc_ wrote: post #178
rstuart4133 wrote: post #172

Earlier quoted context omitted.

> How does this skill works? I've been using computers for 40 years, have never installed and have always disabled malware scanners, and never had a virus. Maybe I'm special. But I'm not that special. There are 3 billion Android uses in the world, almost all of them don't have malware scanners, and almost all of them have never been infected by a malware. Ditto iPhone users. To be fair, I haven't used Windows for the…

Most Android users have the malware scanner in Google Play Services enabled.

It's called Google Play Protect. Comparing it to a Windows malware scanner it like comparing a house door lock to security in a jail.

All Google Play Protect does is compare the installed apps on your device to a list of known bad ones, and uninstalls any Google doesn't like. For the most part all it's doing is looking for apps you've installed that Google later deemed bad and removed from the app store. That's a slight exaggeration, but not a big one. The performance impact is what you would expect from that description - almost none.

A windows virus scanner tries to get itself involved in most mouse clicks. Open an email - it's reading it over your shoulder. View a web page - it's looking at it too. Copy a file from USB - it's inspecting every byte. Every time you write a file, it's sniffing over the new contents. The performance impact is what you would expect from that description, ranging from noticeable to crippling in the worst cases. When it does find a virus it can't "just uninstall it". It may well have replaced parts of Windows itself.

Google Play protect is all you need when you design an OS with security in mind. The situation on Windows is where you end up when focus on delivered features, security be damned.

Re: I ruined my vacation by reverse engineering WSC

#194

Post by keepamovin »

amne wrote: post #163
keepamovin wrote: post #69

Earlier quoted context omitted.

Correct! The browser is now the key vector because it's the most promiscuous and lascivious-for-code-and-data software on most devices. Browser-zero days are why I factored out a way to distribute "web RPA agent creation" on any device, with no download - into its own product layer for browser-isolation. It's a legitimate defense layer but main barriers to adoption are operating friction, even tho it makes the task o…

Just the other day I went to a website to flash a new firmware on a zigbee dongle. Straight from a chrome tab. wild! Then it hit me: the only thing keeping a rogue website from sweeping your entire life is a browser's permissions popup.

Crazy right? On the whole I think it’s great and wonderful that the web platform has grown into the gorgeous monster that it is. I mean what better than a unified technology to serve us all the worlds information from any device in a basically sandboxed environment. I’m even all for the beautiful way The platform has developed rapidly added capabilities on how the language JavaScript HTMLNCSS has evolved. I think all that is wonderful. And I really enjoyed the ride.

But all of that growth and integration comes with these vulnerabilities, and so the cyber and DLP control aspect of web browsers is a very important one.

If this resonates with you, i invite you to check out my company’s project BrowserBox on GitHub

Re: I ruined my vacation by reverse engineering WSC

#195

Post by asqueella »

Yizahi wrote: post #153
bob1029 wrote: post #63

Earlier quoted context omitted.

A skilled user. I understand and mostly support the idea of mandatory AV for the people who can barely handle the concept of a file system. There is also a class of user forged in the fires of the primordial internet who would never in a trillion years be tricked into clicking a fake explorer.exe window in their browser. Giving users choice is the best option. Certainly, make it very hard to disable the AV. But, don'…

Skilled in what exactly? In x-raying all data storages on a system with a naked eye and spotting there a malware? In sniffing ether around the system and smelling a malicious bits on the radio spectrum coming in? How does this skill works?

Skilled in not falling for the kind of malware, that Defender is able to catch.

It’s not a very high bar: I have not seen it find anything in a long time, neither on my machines, nor on the ones I inspected after they had been owned.

Re: I ruined my vacation by reverse engineering WSC

#196

Post by wpm »

dangus wrote: post #119
wpm wrote: post #115

Earlier quoted context omitted.

> In what universe is windows defender “resource-crippling?” This one? Not all of us want to throw perfectly usable hardware in the e-waste pile. Windows 10 was perfectly fine on my old Haswell miniPC, save for Defender wasting CPU cycles and IO doing..."checks".

Let’s cut the bullshit, Defender is basically unchanged as a concept since Windows Vista or maybe even Windows XP. It runs completely fine on 15 year old hardware. We are in the “Windows users complain endlessly and refuse to switch to Linux” bingo card right now. Windows has been this way since before you bought that mini PC.

No, it doesn't.

I can go install Windows 10 on my Haswell mini-PC again if you'd like, show you a screencap of Defender eating 100% of the CPU if you'd like. Literally the only reason I commented was because I saw this behavior in real life, causing framedrops while playing video in Firefox. Am I a liar?

Post reply on HN