4 ms·

What a horrible amount of overhead. Why does Defender need to scan the contents of a bunch of non-executable files? I suspect the answer runs deep and is at lea

What a horrible amount of overhead. Why does Defender need to scan the contents of a bunch of non-executable files? I suspect the answer runs deep and is at least somewhat horrifying.

jan6 6y ago
because windows has no concept of an executable bit, so a rename could make it runnable? or a benign looking program has a built-in interpreter run code from external file?
- mehrdadn 6y ago
  > windows has no concept of an executable bit Sure it does. Execution is a permission you can set in the security tab. > a rename could make it runnable This is more likely why.
- samb1729 6y ago
  > because windows has no concept of an executable bit, so a rename could make it runnable This much I understand - but why can something so tightly integrated into the OS not instead intercept a file rename event and scan at that point? I seem to be lacking sufficient information as to what specifically about Windows necessitates scanning everything on the filesystem when macOS and the various common Linux distros seem to do fine without it. It's not as if Windows is the only OS with interpreters, either.
mmis1000 6y ago
Virus do abuse non executables like js, vbs, or whatever script file. Antivirus can't really know if it is the case without open it.
- samb1729 6y ago
  What is it about Windows that makes this a problem where macOS and Linux seem to be fine? The same mechanisms exist in all three major operating systems, which is to say that technically any executable I choose to run on my computer can load a file and interpret it. Is it really just that Windows users download and run random junk? It's been so long that I've seen a virus of any kind anywhere at all that I genuinely have no clue how people become infected with them or indeed whether it still really happens at all. It certainly feels to me that the era of random toolbars and clearly visible desktop malware is over, but at the same time I live in a different bubble than in the past.
  - Shared404 6y ago
    > I genuinely have no clue how people become infected with them or indeed whether it still really happens at all. I'm a bit late to the conversation, but can confirm that yes, people do still get infected. We almost always turn something up while doing virus scans at the repair shop I work at, and we mostly use off the shelf products, along with a couple other tricks.
  - mkr-hn 6y ago
    It's possible you don't see random toolbars and malware now because Defender works. Microsoft could be smarter and offer default exclusions for some things.
    - mmis1000 6y ago
      But even file type that you think it is pretty safe (jpg, wav and some other media foramt) can abuse parser bug in viewers / explore.exe to result in code execution. And how do you prevent the malware just name its .js as .jpg and execute it with some interpreter? Some interpreters definitively don't care about file extensions.
    - Demiurge 6y ago
      If that was the default, wouldn’t it be immediately exploited?
magicalhippo 6y ago
> Why does Defender need to scan the contents of a bunch of non-executable files? While I agree the overhead is atrocious, buffer overflows and similar bugs can turn an "innocent" non-executable file into an executable, like this[1] JPEG file parser issue affecting a large number of applications using GDI+. That said, I'd be surprised if it couldn't be smarter about this. [1]: https://us-cert.cisa.gov/ncas/archives/alerts/TA04-260A https://us-cert.cisa.gov/ncas/archives/alerts/TA04-260A

What a horrible amount of overhead. Why does Defender need to scan the contents of a bunch of non-executable files? I suspect the answer runs deep and is at least somewhat horrifying.

jan6 6y ago

because windows has no concept of an executable bit, so a rename could make it runnable? or a benign looking program has a built-in interpreter run code from external file?

mehrdadn 6y ago
> windows has no concept of an executable bit Sure it does. Execution is a permission you can set in the security tab. > a rename could make it runnable This is more likely why.
samb1729 6y ago
> because windows has no concept of an executable bit, so a rename could make it runnable This much I understand - but why can something so tightly integrated into the OS not instead intercept a file rename event and scan at that point? I seem to be lacking sufficient information as to what specifically about Windows necessitates scanning everything on the filesystem when macOS and the various common Linux distros seem to do fine without it. It's not as if Windows is the only OS with interpreters, either.

mmis1000 6y ago

Virus do abuse non executables like js, vbs, or whatever script file. Antivirus can't really know if it is the case without open it.

samb1729 6y ago
What is it about Windows that makes this a problem where macOS and Linux seem to be fine? The same mechanisms exist in all three major operating systems, which is to say that technically any executable I choose to run on my computer can load a file and interpret it. Is it really just that Windows users download and run random junk? It's been so long that I've seen a virus of any kind anywhere at all that I genuinely have no clue how people become infected with them or indeed whether it still really happens at all. It certainly feels to me that the era of random toolbars and clearly visible desktop malware is over, but at the same time I live in a different bubble than in the past.
- Shared404 6y ago
  > I genuinely have no clue how people become infected with them or indeed whether it still really happens at all. I'm a bit late to the conversation, but can confirm that yes, people do still get infected. We almost always turn something up while doing virus scans at the repair shop I work at, and we mostly use off the shelf products, along with a couple other tricks.
- mkr-hn 6y ago
  It's possible you don't see random toolbars and malware now because Defender works. Microsoft could be smarter and offer default exclusions for some things.
  - mmis1000 6y ago
    But even file type that you think it is pretty safe (jpg, wav and some other media foramt) can abuse parser bug in viewers / explore.exe to result in code execution. And how do you prevent the malware just name its .js as .jpg and execute it with some interpreter? Some interpreters definitively don't care about file extensions.
  - Demiurge 6y ago
    If that was the default, wouldn’t it be immediately exploited?

magicalhippo 6y ago

> Why does Defender need to scan the contents of a bunch of non-executable files? While I agree the overhead is atrocious, buffer overflows and similar bugs can turn an "innocent" non-executable file into an executable, like this[1] JPEG file parser issue affecting a large number of applications using GDI+. That said, I'd be surprised if it couldn't be smarter about this. [1]: https://us-cert.cisa.gov/ncas/archives/alerts/TA04-260A https://us-cert.cisa.gov/ncas/archives/alerts/TA04-260A