6 ms·

Windows Defender Antivirus and layered machine learning defenses

hs86 9y ago
Will they do anything about its terrible performance? According to [1] the Windows Defender causes a 5x increase of Chrome's build times and it delays a process start by 260 ms. [1] https://twitter.com/BruceDawson0xB/status/940747236614574080 https://twitter.com/BruceDawson0xB/status/940747236614574080
- nucleardog 9y ago
  Do you have any numbers from other products to show this is an issue with Windows Defender's performance, and not just with the general concept of scan-on-access antivirus?
- dontyouremember 9y ago
  You can exclude bin directories from Defender: https://support.microsoft.com/en-us/help/4028485/windows-10-add-an-exclusion-to-windows-defender-antivirus https://support.microsoft.com/en-us/help/4028485/windows-10-...
- cptskippy 9y ago
  What measure are you using to determine the performance is terrible? As a developer, I have always had issues with Antivirus. If your compile times are crap then AV should be one of the first things you try disabling. Hell, I've had overly aggressive AV (McAfee) locking files in temp data folders causing performance to falter in running applications (Visual Studio, Pidgin, Outlook, Office). Why does the end user care about compile times?
  - Someone1234 9y ago
    I've had the same experience, I've just taken to whitelisting all of the cache, assembly, and lib folders throughout the workflow (and processes). Never found an AV which didn't seriously hamper build times, since building often involves a lot of process start/stops and new small files, both of which are kryptonite to AV. MalwareBytes Enterprise recently got completely uninstalled as it was locking random files during compilation indefinitely. They have a fix but only for the consumer branch.
  - emmelaich 9y ago
    Yes, you can disable anti-virus per directory or per-process. AFAIK. Certainly for some anti-virus software.
- bitmapbrother 9y ago
  I wonder if their anti-virus also delays the start of their Edge browser.
cjsuk 9y ago
Does it still run as SYSTEM? If so, fix that and come back later please. https://bugs.chromium.org/p/project-zero/issues/detail?id=1282&desc=2 https://bugs.chromium.org/p/project-zero/issues/detail?id=12...
- ksk 9y ago
  Can you explain what you mean by "fix that"? How is that helpful? I read your link and it doesn't provide any actionable items. In any case, it doesn't "run as SYSTEM". The invoking credentials for a process are not necessarily relevant on a kernel like NT. A process can choose modify its security token after process invocation. For e.g. User mode apps, can downgrade their read/write rights, limiting them to a fixed directory, so even if they had exploitable bugs, the damage could be limited. Chrome on windows uses these same protections. I'm sure similar tech exists on competing kernels. MsMpEng.exe AFAICT runs as a 'system protected process'. Certainly, it looks like there were severe bugs but its not clear where the bugs lie. It could be that the protection mechanism itself is flawed (which would be very bad), or maybe the way it's being used is incorrect, etc etc
  - Someone1234 9y ago
    Different poster... Certain parts of an AV product need to run with the top-most privileges. But that component should be relatively lean, and quickly hand off dangerous work to lower-privilege, memory isolated, processes. Windows Defender has a process called NScript which is a full JavaScript processing engine, running in SYSTEM. A JavaScript engine is inherently complicated enough to have bugs, and running as SYSTEM with no isolation could allow escalating a bug into a full blown code execution just by visiting a web page. None of this is theoretical, it was found and exploited May 2017 [0]. You're correct in saying that Windows does allow more nuanced token control than the full user's context, but I'm yet to read that Windows Defender actually utilises that. None of the previous bugs have been stopped by low-priv style access control, it has been a full SYSTEM leak. Do you have specific information about Windows Defender which suggests they're using voluntary revocation of token privileges? [0] https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5 https://bugs.chromium.org/p/project-zero/issues/detail?id=12...
wjnc 9y ago
This is both pretty impressive and pretty scary. Impressive to detect new malware with such a low N. This massively changes the economics of creating malware. Scary now that pretty much any file that flags as suspicious locally can be sent to the cloud for further inspection. That would seem a no go for many corporate clients?
- colemannugent 9y ago
  That was my first impression as well. As someone who likes to understand what my computer is doing I was never aware that Windows Defender was anything more than the typical definition based AV. Does this mean that Windows Defender is now something to disable on HIPAA compliant workstations because there is a chance that Defender thinks some medical records look suspicious and it decided to upload them for analysis? But for the home and small business this stuff is amazing. It really continues the anti-"virus" analogy by effectively creating an immune system comprised of most Windows machines.
- mtgx 9y ago
  It's how Reality Winner's NSA files were sent to Kaspersky, too. Just some food for thought. I never trust any "cloud-based" antivirus solution.
  - fosco 9y ago
    that may be true.... but... all leading security vendors have cloud based solutions with some of them offering 'private-cloud' based solutions which if was the case what they should be using... I cannot fathom this sort of situation as an real 'accident' and not some other form of misinformation. if you are not utilizing the global up-to-second cloud-herd communication and technology you are more susceptible to attacks than others that are utilizing them. I believe the purpose of these solutions is literally economic warfare. We are making it astronomically more expensive to have successful attacks more than _once_ (_if_ security is done right) to occur by implementing cloud based automation and sharing of information.
  - ganoushoreilly 9y ago
    Reality winter printed out a classified document at work, I think you're confusing her with Nghia Pho, whom appears to have been the Kaspersky leak victim.
dfox 9y ago
One thing I'm very eager to see is how Defender and Microsoft in general will interact with various third-party AV and "enterprise security" solutions which almost invariably contain rootkit-ish/malware-ish modules.
booleandilemma 9y ago
I’ve been recommending msft antivirus to my tech illiterate family over symantec/mcafee/avast/whatever since win7.
- ganoushoreilly 9y ago
  It's extremely effective on win10 without creating further security issues with the cabal of AV products out there. We tell our clients save the cash, use Defender, and invest in other more effective technologies in the stack.
  - giancarlostoro 9y ago
    At my old job we used Defender and Deep Freeze. Never had any incidents.

hs86 9y ago

Will they do anything about its terrible performance? According to [1] the Windows Defender causes a 5x increase of Chrome's build times and it delays a process start by 260 ms. [1] https://twitter.com/BruceDawson0xB/status/940747236614574080 https://twitter.com/BruceDawson0xB/status/940747236614574080

nucleardog 9y ago
Do you have any numbers from other products to show this is an issue with Windows Defender's performance, and not just with the general concept of scan-on-access antivirus?
dontyouremember 9y ago
You can exclude bin directories from Defender: https://support.microsoft.com/en-us/help/4028485/windows-10-add-an-exclusion-to-windows-defender-antivirus https://support.microsoft.com/en-us/help/4028485/windows-10-...
cptskippy 9y ago
What measure are you using to determine the performance is terrible? As a developer, I have always had issues with Antivirus. If your compile times are crap then AV should be one of the first things you try disabling. Hell, I've had overly aggressive AV (McAfee) locking files in temp data folders causing performance to falter in running applications (Visual Studio, Pidgin, Outlook, Office). Why does the end user care about compile times?
- Someone1234 9y ago
  I've had the same experience, I've just taken to whitelisting all of the cache, assembly, and lib folders throughout the workflow (and processes). Never found an AV which didn't seriously hamper build times, since building often involves a lot of process start/stops and new small files, both of which are kryptonite to AV. MalwareBytes Enterprise recently got completely uninstalled as it was locking random files during compilation indefinitely. They have a fix but only for the consumer branch.
- emmelaich 9y ago
  Yes, you can disable anti-virus per directory or per-process. AFAIK. Certainly for some anti-virus software.
bitmapbrother 9y ago
I wonder if their anti-virus also delays the start of their Edge browser.

cjsuk 9y ago

Does it still run as SYSTEM? If so, fix that and come back later please. https://bugs.chromium.org/p/project-zero/issues/detail?id=1282&desc=2 https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

ksk 9y ago
Can you explain what you mean by "fix that"? How is that helpful? I read your link and it doesn't provide any actionable items. In any case, it doesn't "run as SYSTEM". The invoking credentials for a process are not necessarily relevant on a kernel like NT. A process can choose modify its security token after process invocation. For e.g. User mode apps, can downgrade their read/write rights, limiting them to a fixed directory, so even if they had exploitable bugs, the damage could be limited. Chrome on windows uses these same protections. I'm sure similar tech exists on competing kernels. MsMpEng.exe AFAICT runs as a 'system protected process'. Certainly, it looks like there were severe bugs but its not clear where the bugs lie. It could be that the protection mechanism itself is flawed (which would be very bad), or maybe the way it's being used is incorrect, etc etc
- Someone1234 9y ago
  Different poster... Certain parts of an AV product need to run with the top-most privileges. But that component should be relatively lean, and quickly hand off dangerous work to lower-privilege, memory isolated, processes. Windows Defender has a process called NScript which is a full JavaScript processing engine, running in SYSTEM. A JavaScript engine is inherently complicated enough to have bugs, and running as SYSTEM with no isolation could allow escalating a bug into a full blown code execution just by visiting a web page. None of this is theoretical, it was found and exploited May 2017 [0]. You're correct in saying that Windows does allow more nuanced token control than the full user's context, but I'm yet to read that Windows Defender actually utilises that. None of the previous bugs have been stopped by low-priv style access control, it has been a full SYSTEM leak. Do you have specific information about Windows Defender which suggests they're using voluntary revocation of token privileges? [0] https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5 https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

wjnc 9y ago

This is both pretty impressive and pretty scary. Impressive to detect new malware with such a low N. This massively changes the economics of creating malware. Scary now that pretty much any file that flags as suspicious locally can be sent to the cloud for further inspection. That would seem a no go for many corporate clients?

colemannugent 9y ago
That was my first impression as well. As someone who likes to understand what my computer is doing I was never aware that Windows Defender was anything more than the typical definition based AV. Does this mean that Windows Defender is now something to disable on HIPAA compliant workstations because there is a chance that Defender thinks some medical records look suspicious and it decided to upload them for analysis? But for the home and small business this stuff is amazing. It really continues the anti-"virus" analogy by effectively creating an immune system comprised of most Windows machines.
mtgx 9y ago
It's how Reality Winner's NSA files were sent to Kaspersky, too. Just some food for thought. I never trust any "cloud-based" antivirus solution.
- fosco 9y ago
  that may be true.... but... all leading security vendors have cloud based solutions with some of them offering 'private-cloud' based solutions which if was the case what they should be using... I cannot fathom this sort of situation as an real 'accident' and not some other form of misinformation. if you are not utilizing the global up-to-second cloud-herd communication and technology you are more susceptible to attacks than others that are utilizing them. I believe the purpose of these solutions is literally economic warfare. We are making it astronomically more expensive to have successful attacks more than _once_ (_if_ security is done right) to occur by implementing cloud based automation and sharing of information.
- ganoushoreilly 9y ago
  Reality winter printed out a classified document at work, I think you're confusing her with Nghia Pho, whom appears to have been the Kaspersky leak victim.

dfox 9y ago

One thing I'm very eager to see is how Defender and Microsoft in general will interact with various third-party AV and "enterprise security" solutions which almost invariably contain rootkit-ish/malware-ish modules.

booleandilemma 9y ago

I’ve been recommending msft antivirus to my tech illiterate family over symantec/mcafee/avast/whatever since win7.

ganoushoreilly 9y ago
It's extremely effective on win10 without creating further security issues with the cabal of AV products out there. We tell our clients save the cash, use Defender, and invest in other more effective technologies in the stack.
- giancarlostoro 9y ago
  At my old job we used Defender and Deep Freeze. Never had any incidents.