10 ms·
Windows Defender detects malware in DMD
- gus_massa 8y agoSomething similar happened to Racket a few years ago with AVG. IIRC I just send an email to one or two of the antivirus companies and they fixed the problem in a few days. Anyone can send the report of the false positive to the AV companies. I don't understand why nobody took a few minutes to solve this.
- smt88 8y agoDoes it just mean very few D devs use Windows?
- gus_massa 8y agoI decided to try to solve it myself. I don't get any warning with Windows Defender (Win10). With VirusTotal I got only one report https://www.virustotal.com/#/file/e02d6aff4b59b2f66ed21fb74e7d5688ec0a552df6a156df78937140a08f6293/detection https://www.virustotal.com/#/file/e02d6aff4b59b2f66ed21fb74e... by Tencent . I went to the webpage of Tencent but I can't find the correct way to report a false positive. Most of the contact page is in Chinese, but I don't speak Chinese (Hi from Argentina!) I'm in doubt if I will send the report to whoever looks more relevant, or just forget about this.
- destructionator 8y agoI just whitelisted the entire directory for windows defender, and I know a lot of other D devs do the same. (Without that, even my own programs I compile will have startup lag - it doesn't flag them, but it takes an extra half second to run the program, presumably scanning it first, which is infuriating for an edit/compile/test cycle.) So for us who are already in, it is a "solved" problem. I recognize it doesn't help first timers though.
- WalterBright 8y agoDevs learn pretty quick to turn off AV. It's nigh impossible to run a test suite with AV on, for example, because it tries to scan/flag every executable built during the tests. After hearing "Wolf! Wolf!" a few thousand times, one is done with AV.
- smt88 8y agoIs there a reason this happens with D, but not with Rust, C++, or C#? I think if I had to turn Windows Defender off, it'd be better to just switch to *nix (which I assume doesn't have similar false positive problems for whatever reason).
- trothamel 8y agoIt's one of those things where it's a few minutes per company per release. And then you make a new release, and have to do it again. And again. And again. As a volunteer, it's hard to do that for software that seems to be financially motivated to report false positives, so the users can pretend the money they give antivirus companies is worthwhile.
- gus_massa 8y agoIn my case it was only one or two companies in only one release. It was not necessary to resubmit it in every release. Also, I understand that this is not top priority and that is a nice small task to be delegated to one of the newest contributors, specially the one that have the problem and are using the obscure AV. But after a few months, it's time to say "whatever" and try to solve it. [Anyway, I tried an hour ago, it's not so easy. See my other comment.]
- 0x8BADF00D 8y agoThat’s strange. Is the compiler binary packed at all? I wonder what heuristic they’re using to classify the D compiler as a Trojan.
- Lerc 8y agoI would imagine they encountered malware written in D, compared the executable to a bunch of others (not written in D) then decided the distinctive characteristics of D were indicative of malware. When there is no cost to providing a false positive, there is little incentive to avoid it.
- qaq 8y agoThere is incentive to avoid it but as you might imagine there are not that many D programs in corporate environments so prob not a pain point for any major customer and it's low priority.
- FrozenVoid 8y agoIt downloads files and starts a windows service: https://www.virustotal.com/#/file/007560cc35e78ba74d6fa9732e27032a1fd2f2d6cbadffd1c39ffff68d5dd100/behavior https://www.virustotal.com/#/file/007560cc35e78ba74d6fa9732e...
- tjoff 8y agoThe response on that issue was a bit depressing. Since noone seems to care I'm not surprised that it isn't fixed. But it is surprising to me that this isn't a top priority.
- themacguffinman 8y agoThere's probably a significant overlap between developers who use a non-mainstream language like D and developers who use non-mainstream OSs like Linux or macOS.
- tjoff 8y agoThey obviously put in the probably very non-trivial effort to make a windows version. This is about caring about the product they produce.
- bachmeier 8y agoIf "they" refers to the D Language community, there's nothing that they can do. The AV vendors are the ones doing it, and they don't care.
- joshstrange 8y agoI get where they are coming from. Windows is far from the top OS used by D programers, it only effects people who use anti-virus, and I'm betting you can whitelist it or otherwise bypass it. All of those things may seem like sizable hurdles but we are talking about programmers here, I think they can handle it. I know back when I used Windows I would get false positives for all kinds of things because I was on the bleeding edge or always trying new stuff that they hadn't seen or looked malicious (but wasn't). If you are going to run "anti-virus" as a developer you need to know what side-effects you might run into (the same way I know that PrivacyBadger and uMatrix in Chrome can cause issues, I don't go running to the website that is broken just because my extension broke it).
- tjoff 8y ago
- 9214 8y agoSome AV vendors (notably Avast, AVG, Avira, McAffee, Norton and Windows Defender) use extremely poor heuristics and never actually tweak them, instead just whitelisting a given file. You think that if false positive in a compiler or runtime is reported they'll at least will get serious about it? Nope. Consider Red, which gets hit by AV truck almost on a monthly basis [1]. Not only toolchain itself gets recognized as a "generic malware" †, but almost all compiled user applications get flagged too. Such false positives are alway duly reported, issue seems to be gone... and then cycle repeats, even though no changes in compiler output or runtime with REPL were made ‡. Just like that, sporadically. Some of them go nuts even over simple "hello world". Last year, as a last resort, developers directly twitted one of the most nastiest vendors (Avira) about this issue [2]. Nothing changed. They don't care at all, since 2012, when the Red project started. I know NirSoft [3] products suffer from that plague; network utilities (Wireshark, nmap) get hit, so as various packers (WinRar, also see [4]); re-reading the thread after the original post, I'm not even surprised that demoscene experiences problems with anti-virus software; but seeing this issue pertaining mainstream language such as D is, well, terrifying, to say the least ⁂. It can be easily brushed off as an anomaly in such mature, widely adopted code bases, but with non-mainstream, yet-in-development languages it's a scourge that hinders the adoption and serves as a constant source of headache both for developers and users. And, honestly, I can't see how this can be resolved without raising public awareness and engaging other developers in a debate. -- [1]: https://github.com/red/red/issues?utf8=%E2%9C%93&q=label%3Atype.AV+ https://github.com/red/red/issues?utf8=%E2%9C%93&q=label%3At... [2]: https://twitter.com/red_lang/status/887970289618829312 https://twitter.com/red_lang/status/887970289618829312 [3]: https://www.nirsoft.net/ https://www.nirsoft.net/ [4]: https://news.ycombinator.com/item?id=4152539 https://news.ycombinator.com/item?id=4152539 (apparently, original post is deleted, but still can be retrieved via Archive) -- † We can only guess what causes the trigger, as vendors never give any feedback. One guess is that toolchain generates a file layout different from VisualStudio or GCC linkers, and uses a custom compression of DATA segment. ‡ I think this happens after each update of heuristic DBs or AV engines which vendors share. IIRC Windows started to use machine learning for malware detection some time ago. Total bonanza. ⁂ Ever wondered what the very first issue in Nim repository was? (https://github.com/nim-lang/Nim/issues/1 https://github.com/nim-lang/Nim/issues/1)
- abductee_hg 8y agoall antivirus sw is blocking all the demoscene-releases(size coding 4k, 64k, etc.) and constantly deleting my own releases after windowsupdate turns the defender on again...
- wolfgke 8y agoExactly my experience. I downloaded a large archive of demoscenes. It lead to a lot of "fun" with Windows Defender. Just my imagination: If a malicious attacker would like to "convince" a victim to turn off the antivirus software, I can imagine this might be a good starting point how to annoy the user sufficiently.
- colejohnson66 8y agoThat’s probably due to the use of self modifying code
- cosarara 8y agoYou can whitelist a directory on WD's settings.
- weinzierl 8y agoI ran into similar problems with Rust executables like ripgrep and xsv. I don't know if it is Windows Defender or some other "endpoint security" solution but I have seen both of them blocked in a corporate environment.
- valarauca1 8y agolarge corporations often block users from setting executable permissions on files they created as a way curbing malware. Or at least I've encountered this in my career.
- nonfamous 8y agoAccording to the linked issue, it's not just Windows Defender; 21% of scanners reported by VirusTotal also flag D. What could cause so many independent virus checkers to throw a false positive like this?
- viraptor 8y agoCan't find the details now, but there were cases before of AVs using VirusTotal for getting their answers if they lacked any info / signatures for a binary. Could be what happened here, so they're not really independent. Edit: this describes the issue - https://mma.prnewswire.com/media/727967/VirusTotal_and_the_Comodo_Zeroday_Challenge_Black_Hat_2018.pdf https://mma.prnewswire.com/media/727967/VirusTotal_and_the_C...
- cookiecaper 8y agoAVs throw these all the time, for all kinds of applications and tools. They're triggered by patterns and signatures in the executable that "may indicate malicious behavior", etc., heuristically. It's in the AV vendor's interest to be overzealous and have lots of false positives rather than to have a single accidental false negative.
- windwake12 8y agoIt's pretty common for programs compiled by "uncommon" compilers, and since the D compiler is selfhosted, it would fall into that category. AV software isn't magic, they probably just look for stack/calling/allocation patterns that don't look "right" meaning none of the major compilers generate such code, and it "might" be bad somehow. I've a few flags from npm with Kaspersky, because there's so many packages that include some little binary, and since this is npm, it's often "unusual", like go.
- ynik 8y agoThe AV might not be even looking at patterns in the executable code. We've had an issue where we accidentally ran the msys strip tool over binaries compiled with the MSVC compiler. A quarter of the scanners on virustotal went crazy and "detected" our program. The same unstripped program was fine with them. And by "the same", I literally mean the same: virustotal showed that all sections in the "malicious" stripped executable had identical hashes to those in the clean unstripped executable. The only difference was some header bits that were irrelevant to the runtime behavior (I think it was the "linker version" field, and maybe some others).
- binarycrusader 8y agoThere's a process to report false positives and other problems: https://www.microsoft.com/en-us/wdsi/filesubmission https://www.microsoft.com/en-us/wdsi/filesubmission ...to ensure things like this get investigated. For what it's worth, I just downloaded the latest D compiler distribution for Windows and scanned it with Windows Defender -- it didn't report any problems.
- marktangotango 8y agoWith respect to this story, I have not seen any references to ken Thompson c compiler backdoor. Just because a compiler is compiled from source doesn’t mean it’s secure. http://wiki.c2.com/?TheKenThompsonHack http://wiki.c2.com/?TheKenThompsonHack
- vatueil 8y agoIncidentally there was also a blog post from Microsoft about preventing false positives just a couple months ago: https://cloudblogs.microsoft.com/microsoftsecure/2018/08/16/partnering-with-the-industry-to-minimize-false-positives/ https://cloudblogs.microsoft.com/microsoftsecure/2018/08/16/... Short summary: https://mspoweruser.com/microsoft-shares-ways-for-software-vendors-to-minimize-false-positives/amp/ https://mspoweruser.com/microsoft-shares-ways-for-software-v...
- userbinator 8y agoMicrosoft also noted that the best way to avoid false positives is to publish apps on the Microsoft Store as it scans for viruses or malware before publishing the app for the users. The overwhelming desire to lock people into their walled garden is so blatant. The first method to prevent a false positive is to ensure the software is digitally signed. To someone looking to make money from malware, the cost of code signing is probably insignificant. To someone innocent and just wanting to share some software for free, it's not. It shows that MS is clearly not interested in actually improving the detection accuracy of their AV much, but more interested in converting developers into a revenue stream.
- dawg 8y ago
- emmelaich 8y agonotavirus: - open source, used by many before - av companies frequently get false positives - virus companies probably use common sigs and heuristics - the installer might probe for higher privileges without actually being malicious isavirus: - not much Was clamav tried? Is ESET listed (my favourite AV)
- Roritharr 8y agoFor some reason Windows Defender started hogging my CPU today whenever I have my IDE open. In the multiple years since switching to Microsofts internal AV Solution i've never experienced this, does anyone else have a similar experience?
- detaro 8y agoMaybe your IDE started reindexing source files in the background, accessing many files very quickly? Defender can cause lots of load if that happens and it wants to inspect everything.
- Kenji 8y agoAnti viruses are broken and no longer work these days. Don't believe me? You don't have to take my word. You can take the word of John McAfee who developed the McAfee antivirus: Well anti-virus software no longer works. That paradigm that I invented does not work in the modern world of the internet and hackers and social engineering. New hacking techniques have obviated virus scanning software, it's simply, it's non-functional yet everyone continues to buy it because that's all that they know - John McAfee ( https://youtu.be/WBgFGwJA1D0?t=9m28s https://youtu.be/WBgFGwJA1D0?t=9m28s ) Lessons to learn here: Anti viruses are full of garbage heuristics with tons of false positives. The only good thing about anti viruses is that if a file is known to be malicious, that exact file can be recognized with its hash. However all the heuristics are nonsense.
- sriku 8y agoNot the same topic, but we recently faced malware that got distributed via Hadoop yarn - where what looked like crypto mining code would kick in and hog cpu once the scale of spark compute hit some point. It would kick in randomly and it installed itself as a cron job. It was crazy figuring out this was happening as it wasn't something we expected with java code and from such a distribution. We got rid of yarn to eliminate it at that point.
- userbinator 8y agoI've seen plenty of stories of "Hello World!" programs being detected, and on the other hand it's also pretty easy to modify malware so that it stops being detected. IMHO the fundamental aspect of how AVs work is broken because they're not behavioural but basically pattern-matching on binaries, and poorly matching at that. Combine that with their propensity to be used as censorware (detecting keygens, patchers, and other cracks which are otherwise non-malicious and functioning as intended), and you can understand why I don't trust nor use AV. Too bad Windows Defender is installed by default and a real pain to remove.
- PeterLGummybear 8y agoThe other day we saw an article about someone embedding a .zip in a jpeg that survived twitter's thumbnailing. What about doing similar things with the eicar string or other false positives that make antivirus freak out? This seems like it'd be an interesting DoS attack.
- BeardPower 8y agoTo make sure that our releases are clean we apply best practices like generating the Windows binaries on Linux servers running Wine. We test the binaries to the last detail with various AV packages. Malware analysis is also incorporated to get to the ground why some AV packages report the binaries as infected but to no avail. The heuristic engines of major AV vendors are tuned very severely, and there is no way of getting around it for us developers.