Windows users have recently begun mass-reporting that Microsoft's Defender antivirus program, which is integrated into Windows 10 and 11 by default, is
I’m not sure about the browser, but a lot of malware used to ship with the tor binary and used it to connect to the CNC. I can totally see it ending up in the indicator list.
I love bashing MS as much as the next guy, but this is not completely indefensible behavior given typical user use cases and needs. As long as it’s easy to add an exception of you installed it on purpose.
Yeah I’m guessing this is a false positive based on heuristic analysis, i.e. the TOR program has a lot of the same behaviors as malicious programs. Of course it is more accurate to say that the malicious programs are copying TOR behavior or just straight using TOR code, whatever the case may be.
My main issue is that it kind of shows a lack of due diligence. I assume the official TOR binaries are signed, so the official TOR binaries should be exempted from these heuristic positives. If the binaries are unsigned/have no valid certificates, then I can totally understand the false positive. At that point, the user should know they are installing software that cannot be automatically verified as being safe, and antivirus should never assume that something is safe otherwise. Like you said, for typical users this should be the expected behavior. Users can always undo Windows Defender actions and add exemptions.
Windows has both WDAC and Applocker for allowlisting, not just for exes, but stuff such as powershell scripts and what drivers run in the kernel as well.
In it’s strongest form (a signed WDAC policy) even admin access can’t easily override it, and a well written policy can even enforce stuff such as downgrade protection (example: only allow firefox.exe signed by Mozilla at or above a certain version) which prevents an attacker from loading older versions of an executable.
The problem is that it’s not so easy to use in practice - an installer will often drop loads of unsigned files. Tor Browser ironically enough is a prime example, and any WDAC policies allowing it have to fallback on hash rules, which are fragile and must be regenerated every update, or filepath rules which are not so robust.
Microsoft is trying to make allowlisting more accessible with Smart App Control, which runs WDAC under the hood. It does save the hassle of managing one’s own policies (and also blocks certain filetypes like lnks commonly used for malware), but it is not very customizable.
From my experience, Windows by default completely blocks non-Microsoft-verified .exes. It’s called S mode and usually requires a Microsoft account to exit.
Do you mean that it’s enough just to be on a microsoft account? On 10, I didn’t technically do anything to exit that and I just have an annoying popup first time I’m using an unverified app. I can just allow them.
Because it makes it the easiest thing to spoof an .exe which enables attacks of which you will never get out of. A legit.exe vs a spoofed legit.exe will be the exact same in every way except the coding in spoofed fucks you.
Edit: you’re trading security risk for security risk that makes it easier to hide. Not worth it.
Edit 2: their is nothing 100% secure MD5 and Sha1 are both spoofable. Checksums and anything is capable of being man in the middle. You people act like you just found something that can’t be broken. This is the real world the moment you switch most black hatters and white hatters will switch too…
I’m not sure that these things work the way you think they do… an antivirus wouldn’t just look for the name of an executable to be “legit.exe” but rather would look at what the program calls itself in it’s manifest, compute the hash for the executable binary file, and compare that hash against a database of known good hashes. If the contents of the executable compute a hash identical to the known good hash, then you know the contents of the executable are clean.
Still getting into programming and having a bit of trouble understanding what a “manifest” is. What does this technically entail? Are “manifests” implemented differently by PL or OS?
The manifest (at least how I am using the term) is whatever metadata a file has, and the format and location of this metadata can differ between operating systems. Usually the manifest is generated by the operating system based off of header data from the file itself, and details about the file that the operating system can deduce, such as file size, origin, location, file type, etc. In Windows you can view this info by right clicking/opening the context menu on any file and selecting “Properties”, on macOS by opening the context menu and selecting “Get Info”, and on other OSes such as linux/freeBSD it will be something similar.
There are other usages for “manifest” depending on the context, for example a manifest.xml would be something a developer would include with an android app that has configuration settings and properties for the app.
Lmao your edit 2 is completely silly. SHA-256 is what would be used for checksum verification, and SHA-256 is pretty much collision resistant, and even then if two files computed the same hash they would have such different contents/properties that it would be obvious they are not the same file. MD5 and SHA-1 have been phased out for any serious usage for a while now.
Seriously tho, if you don’t know what you are talking about you should probably stop making a fool of yourself
It’s defensible only from the perspective that it’s safer to flag many innocent apps than to miss something harmful. That said, it heavily punishes many legitimate developers and creators, as documented here. I was personally affected on many occasions and there hasn’t been a single one where Microsoft wouldn’t admit to false-flagging upon a manual review.
I’m not sure about the browser, but a lot of malware used to ship with the tor binary and used it to connect to the CNC. I can totally see it ending up in the indicator list.
I love bashing MS as much as the next guy, but this is not completely indefensible behavior given typical user use cases and needs. As long as it’s easy to add an exception of you installed it on purpose.
Yeah I’m guessing this is a false positive based on heuristic analysis, i.e. the TOR program has a lot of the same behaviors as malicious programs. Of course it is more accurate to say that the malicious programs are copying TOR behavior or just straight using TOR code, whatever the case may be.
My main issue is that it kind of shows a lack of due diligence. I assume the official TOR binaries are signed, so the official TOR binaries should be exempted from these heuristic positives. If the binaries are unsigned/have no valid certificates, then I can totally understand the false positive. At that point, the user should know they are installing software that cannot be automatically verified as being safe, and antivirus should never assume that something is safe otherwise. Like you said, for typical users this should be the expected behavior. Users can always undo Windows Defender actions and add exemptions.
I still don’t understand why Windows doesn’t use .exe whitelisting instead of bothering with endless blacklists and heuristics and antiviruses.
On any given system there’s a handful of legit .exe while out there there’s like a billion malware .exe, and more created every minute.
Or at least switch to an explicit “executable” flag like on MacOS and Linux.
Windows has both WDAC and Applocker for allowlisting, not just for exes, but stuff such as powershell scripts and what drivers run in the kernel as well.
https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/
In it’s strongest form (a signed WDAC policy) even admin access can’t easily override it, and a well written policy can even enforce stuff such as downgrade protection (example: only allow firefox.exe signed by Mozilla at or above a certain version) which prevents an attacker from loading older versions of an executable.
The problem is that it’s not so easy to use in practice - an installer will often drop loads of unsigned files. Tor Browser ironically enough is a prime example, and any WDAC policies allowing it have to fallback on hash rules, which are fragile and must be regenerated every update, or filepath rules which are not so robust.
Microsoft is trying to make allowlisting more accessible with Smart App Control, which runs WDAC under the hood. It does save the hassle of managing one’s own policies (and also blocks certain filetypes like lnks commonly used for malware), but it is not very customizable.
From my experience, Windows by default completely blocks non-Microsoft-verified .exes. It’s called S mode and usually requires a Microsoft account to exit.
Do you mean that it’s enough just to be on a microsoft account? On 10, I didn’t technically do anything to exit that and I just have an annoying popup first time I’m using an unverified app. I can just allow them.
You need to “download” normal mode from the store, which requires a Microsoft account to use. All of the W11 computers I’ve gotten came in S mode.
Because it makes it the easiest thing to spoof an .exe which enables attacks of which you will never get out of. A legit.exe vs a spoofed legit.exe will be the exact same in every way except the coding in spoofed fucks you.
Edit: you’re trading security risk for security risk that makes it easier to hide. Not worth it.
Edit 2: their is nothing 100% secure MD5 and Sha1 are both spoofable. Checksums and anything is capable of being man in the middle. You people act like you just found something that can’t be broken. This is the real world the moment you switch most black hatters and white hatters will switch too…
I’m not sure that these things work the way you think they do… an antivirus wouldn’t just look for the name of an executable to be “legit.exe” but rather would look at what the program calls itself in it’s manifest, compute the hash for the executable binary file, and compare that hash against a database of known good hashes. If the contents of the executable compute a hash identical to the known good hash, then you know the contents of the executable are clean.
Still getting into programming and having a bit of trouble understanding what a “manifest” is. What does this technically entail? Are “manifests” implemented differently by PL or OS?
The manifest (at least how I am using the term) is whatever metadata a file has, and the format and location of this metadata can differ between operating systems. Usually the manifest is generated by the operating system based off of header data from the file itself, and details about the file that the operating system can deduce, such as file size, origin, location, file type, etc. In Windows you can view this info by right clicking/opening the context menu on any file and selecting “Properties”, on macOS by opening the context menu and selecting “Get Info”, and on other OSes such as linux/freeBSD it will be something similar.
There are other usages for “manifest” depending on the context, for example a manifest.xml would be something a developer would include with an android app that has configuration settings and properties for the app.
Manifests are like an abstract for an executable.
How is this getting upvoted. This is ridiculous garbage, every exe whitelist would obviously have checksums attached, not just a filename.
Please don’t reply to comments when you’re talking out your ass, that doesn’t help anyone. You don’t know wtf you’re on about, at all.
Not really, WDAC doesn’t usually just look at the filename. It can look at the certificate it was signed by, or fallback to using hashes.
Lmao your edit 2 is completely silly. SHA-256 is what would be used for checksum verification, and SHA-256 is pretty much collision resistant, and even then if two files computed the same hash they would have such different contents/properties that it would be obvious they are not the same file. MD5 and SHA-1 have been phased out for any serious usage for a while now.
Seriously tho, if you don’t know what you are talking about you should probably stop making a fool of yourself
deleted by creator
Oh god I hate that spelling of C2 lol
I have other associations too 😈
Same here. Totally talking about Computer Numerical Control of course, absolutely no other association. Nope, definitely not. 😇
It’s defensible only from the perspective that it’s safer to flag many innocent apps than to miss something harmful. That said, it heavily punishes many legitimate developers and creators, as documented here. I was personally affected on many occasions and there hasn’t been a single one where Microsoft wouldn’t admit to false-flagging upon a manual review.