Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ruined my vacation by reverse engineering WSC

blog.es3n1n.eu

Post reply on HN
Print view View original

51–60 of 196 posts

Re: I ruined my vacation by reverse engineering WSC

#51

Post by nsteel »

perching_aix wrote: post #49
londons_explore wrote: post #36

Earlier quoted context omitted.

Since the rest of the world updates their PC's, malware authors rarely focus on exploiting older versions. Both Chrome and Windows are now in that position. Basically, unless you are of interest to state level attackers, in 2025 even unpatched Chrome/Windows wont get drive by exploited.

Would suck if an exploit was present for years, sometimes decades. Would especially suck if people piled up old exploits and fell back on them as needed.

Imagine if this was all automated, even scripted, so even kiddies could do it, or others with almost zero security knowledge.

I'd really, really like to think most of us don't follow this terrible security practice based on a bad premise.

Re: I ruined my vacation by reverse engineering WSC

#52

Post by magicalhippo »

es3n1n wrote: post #45
Washuu wrote: post #38

Earlier quoted context omitted.

It needs to be closer to where the acronym is first introduced. The definition, on my screen, is below the fold so it can not be seen in context of where the acronym is first introduced. If it was defined below the title, I would understand. * https://apastyle.apa.org/style-grammar-guidelines/abbreviati... * https://www.stylemanual.gov.au/grammar-punctuation-and-conve... * https://learn.microsoft.com/en-us/style-guid…

This is a somewhat useful feedback, however I am not too sure how this can be fixed given the structure of my blog post. Do you think if I just add a line `*WSC is short for Windows Security Center` in the first paragraph this will be enough?

My suggestion:

In this post I will briefly describe the journey I went through while implementing defendnot, a tool that disables Windows Defender by using the Windows Security Center (WSC) service API directly.

Re: I ruined my vacation by reverse engineering WSC

#53

Post by stuffoverflow »

subscribed wrote: post #29
vachina wrote: post #12

Earlier quoted context omitted.

You can also disable Windows Update entirely by taking ownership of wuaueng.dll and .exe. It’s the only effective method on Windows Home.

But disabling updates on the system connected to the Internet is a terrible idea. How do you update that afterwards?

I have yet to see concrete evidence that disabling Windows update and windows defender would elevate risk of having the system compromised in any meaningful way.

I installed Windows 10 2016 ltsc on a VM at the end of last year out of curiosity to test that. Disabled wupdate and defender before letting it access the internet so that it was basically 8 years behind on any updates. I tried browsing all kinds of sketchy sites with Firefox and chrome, clicking ads etc. but wasn't able to get the system infected.

I would guess that keeping your browser updated is more important.

Re: I ruined my vacation by reverse engineering WSC

#54

Post by chii »

quietbritishjim wrote: post #41
chii wrote: post #22

Earlier quoted context omitted.

can someone well versed in explaining CPP magic explain what is going on and why it is cursed?

We're starting with this code: defer->void { CoUninitialize(); }; Using the macros in the second linked file, this expands to: auto _defer_instance_1234 = Defer{} % [&]()->void { CoUninitialize(); }; * The 1234 is whatever the line number is, which makes the variable name unique. * auto means infer the type of this local variable from the expression after the =. * Defer{} means default construct a Defer instance. Def…

That's interesting! So i assume that this macro allows code to get registered to be run after the 'current' scope exits.

But from my understanding (or lack thereof), the `auto _defer_instance_1234 =` is never referenced post construction. Why doesn't the compiler immediately detect that this object is unused and thus optimize away the object as soon as possible? Is it always guaranteed that the destructor gets called only after the current scope exits?

Re: I ruined my vacation by reverse engineering WSC

#55

Post by mappu »

geocar wrote: post #24
ThrowawayTestr wrote: post #6

Is the point to actually disable defender or to highlight a vulnerability?

I think the point is to disable defender: Air-gapped machines, kiosks, industrial applications, and so on, have no need to eat gobs of ram and waste loads of cpu checking the same files over and over again. For other applications, WD provides dubious benefits. It is annoying that there isn't a switch that says "I know how to operate a computer". Evildoers don't need to bother with this: If they have access at this po…

> It is annoying that there isn't a switch that says "I know how to operate a computer".

I found one such switch: Install Linux

Re: I ruined my vacation by reverse engineering WSC

#56

Post by alias_neo »

es3n1n wrote: post #45
Washuu wrote: post #38

Earlier quoted context omitted.

It needs to be closer to where the acronym is first introduced. The definition, on my screen, is below the fold so it can not be seen in context of where the acronym is first introduced. If it was defined below the title, I would understand. * https://apastyle.apa.org/style-grammar-guidelines/abbreviati... * https://www.stylemanual.gov.au/grammar-punctuation-and-conve... * https://learn.microsoft.com/en-us/style-guid…

This is a somewhat useful feedback, however I am not too sure how this can be fixed given the structure of my blog post. Do you think if I just add a line `*WSC is short for Windows Security Center` in the first paragraph this will be enough?

The typical solution, is to include the expansion in brackets after the first use.

Simple rule I learned on my Electronic Engineering degree (where we're guilty of many, many acronyms): When you write an acronym/initialism in a paper (or anywhere for others to read reall), assume the reader doesn't know what it stands for and include the expansion in brackets immediately after the first use.

EDIT: As my sibling comment also suggests, writing it in full the first time, and using the acronym/initialism in brackets is also acceptable.

Re: I ruined my vacation by reverse engineering WSC

#57

Post by devwastaken »

71bw wrote: post #7
nyanpasu64 wrote: post #4

The most invasive but effective way I've found to disable Defender is to boot into a live Linux USB, rename "C:\ProgramData\Microsoft\Windows Defender", and create an empty file in its place.

Group policies still work so effectively that I've set up a local domain using a controller in my homelab that does nothing but change the defender policies automatically for all users.

group policy no longer works on win11. updates will reverse it. additionally defender detects turning off realtime monitoring as malware.

Re: I ruined my vacation by reverse engineering WSC

#59

Post by 71bw »

devwastaken wrote: post #57
71bw wrote: post #7

Earlier quoted context omitted.

Group policies still work so effectively that I've set up a local domain using a controller in my homelab that does nothing but change the defender policies automatically for all users.

group policy no longer works on win11. updates will reverse it. additionally defender detects turning off realtime monitoring as malware.

And yet I have none of these issues on 11 LTSC 24H2? Sounds like you forgot to disable Tamper Protection

Re: I ruined my vacation by reverse engineering WSC

#60

Post by OsrsNeedsf2P »

71bw wrote: post #59
devwastaken wrote: post #57

Earlier quoted context omitted.

group policy no longer works on win11. updates will reverse it. additionally defender detects turning off realtime monitoring as malware.

And yet I have none of these issues on 11 LTSC 24H2? Sounds like you forgot to disable Tamper Protection

As someone who moved to Linux 10 years ago, this comment chain shows Windows became the real hacker distro
Post reply on HN