23 ms·

Windows Defender is enough, if you harden it

560 points by h0ek 5y ago

jmrm 5y ago
As a "family SysAdmin" I'm pretty happy about how good Windows Defender and MRT updates works. Aside from clearly aimed ransomeware, today's pretty difficult to have virus problems in Windows. Most of the time I have to repair any Windows machine is due to a driver install problem (specially sound cards) or a system update problem.
veganhouseDJ 5y ago
trifit 5y ago
Most people don’t even download an antivirus so this is a good walkthrough.
Comevius 5y ago
I have to say I never used an antivirus software before except I guess the built-in one in Windows. I think sandboxes are better for software you don't trust. I imagine antivirus heuristics are only useful against a handful of common threats, if at all.
0xbadc0de5 5y ago
Defender has been the only worthwhile Windows AV solution for years. All others have been at best, on-par and at worst, net-negative (opening vulnerabilities that would not otherwise exist).
thrower123 5y ago
I haven't had a virus problem since the days of Windows 2000. I've had an incredible number of problems caused by antivirus software interfering with legitimate software.
- encryptluks2 5y ago
  None that you know of. I think virus creators have probably adapted from breaking things to silently collect information.
  - tupac_speedrap 5y ago
    They already have, most AV software nowadays is adware. If you are lucky they'll just slurp your data and maybe get you to install Chrome or some other random piece of software but some are even using your PC to mine cryptocurrency nowadays.
  - seanw444 5y ago
    Word. Silent data farming is certainly worth more in the long run than ransomware encrypting the whole disk of some John Doe.
  - bartimus 5y ago
    But wouldn't those infections be detected eventually? They would need to update/hide their "solution" every time A/V software comes with updates to detect them. It would be too late already.
- shaunpud 5y ago
  You're amazing... So I guess you've never had to help a family member clean their system of said virus/malware/adware?
giantg2 5y ago
- Natsu 5y ago
  I don't like the idea of an internet permit, but I do agree with the idea that users should be taught internet safety. About 20 years ago I volunteered at the library and taught such a class, but only recently have I seen such classes as part of workplace training. It should probably be something that is taught in schools, as well. Or maybe it is covered now and I just don't know?
  - giantg2 5y ago
    It was loosely covered in school when I went. We had some basic stuff even in middle school (20+ years ago) about use anti-virus, don't click links from unknown sources, etc. If schools aren't teaching the basics, then that could be a big security hole for the district. At the least, it reduces the protection of defense in depth and forces the school to wholly rely on systems to protect the network, when users are often the "in".
- vore 5y ago
  I think because your original post was a wildly off-topic nitpick of what the article is talking about as a whole.
  - giantg2 5y ago
    I don't think it's really a nitpick to point out factual inaccuracy. That happens all the time on here and is a feature of an audience committed to truth. As a secondary point, do you think the author's use of licensing examples was on-topic? I don't see them go into any detail licensing, and it has little to nothing to do with the topic of hardening Defender. That said, yes, I do see that my initial comment was lacking the context later added in the edit.
- damagednoob 5y ago
  > "If you want to shoot a gun, you need to get a permit." > Not in the US, This statement seems to lack nuance and could be the reason for the downvotes. > Federal law does not require individuals to obtain a license or permit to purchase a firearm. Several states, however, have permit-to-purchase laws that function similarly to universal background check laws. https://www.rand.org/research/gun-policy/analysis/license-to-own.html https://www.rand.org/research/gun-policy/analysis/license-to...
sumthinprofound 5y ago
My firm belief is the that hardware vendors do end users a disservice by preloading 3rd party anti-virus software that expires ans requires payment after a period of time for virus signature updates. Typically this 3rd party software disables Defender, so once the pre-installed AV trial runs out, the user is exposed.
- Nextgrid 5y ago
  > do end users a disservice by preloading 3rd party anti-virus software There's a reason they're paid for doing so. If it was beneficial they'd do it for free.
  - sumthinprofound 5y ago
    Agreed. Additionally I I think it may look more impressive to novice buyers when the product lists a bunch of free (albeit worthless) software included in their purchase.
  - 9wzYQbTYsAIc 5y ago
    For sure, at a minimum the only reason to be doing that is to put food on their table. I’m sure that there are other reasons - do you have any in mind?
- mojzu 5y ago
  Definitely, getting rid of them pretty much requires an OS reinstall too which is incredibly annoying when it feels like I've had to waste an hour or so of my time so that the hardware vendor could make an extra buck. I occasionally get batches to do at work and I advocate against buying from vendors that do this kind of thing (for the little good it does, since they all seem to these days)
  - sumthinprofound 5y ago
    My first steps with a new personal computer is to boot to thumb drive, format the disk and install what I believe to be a clean copy of windows. In a business environment I've always been an advocate of staging one machine taking a drive image and using that image to clone the rest. Resolved so many issues if the end-user mucks up their machines so bad you just reflash the drive image and send them on their way.
inglor 5y ago
Hey, sorry for all the name changes of Microsoft Defender. I work at MSec (Microsoft's security org). We ended up absorbing and acquiring a few companies to provide a better offering and a lot of re-branding happened. For example Security Center's old portal for active threat protection, automatic remediation, incident investigation etc is all now absorbed into (the better) security.microsoft.com which is (to my understanding, just an engineer) the current and last (for the foreseeable future) rebrand. The team I work at started as one person working on the frontend for MDE (Microsoft Defender for Endpoint) and now has hundreds of people working on the security portal across India, Israel and the US (as well as a few other smaller sites contributing). Also, as an engineer I have to say the offering is good. The anti-virus and the telemetry is worked on by some really smart people. Client information is sacred, logging into production takes multiple audits and PII is scrubbed (heavily) any time logs are needed. We still have a lot of room to improve but I am confident in Microsoft both delivering a good product and acting in good faith (and there is a clear business incentive in the enterprise security space to do so rather than benevolence).
- flower-giraffe 5y ago
  > Microsoft both delivering a good product and acting in good faith I’m going to call you out on that. Microsoft lost my trust to act in good faith with personal data when they started capturing my private OS user input (e.g. the history from Windows R (run) and forced me to link it to my personal identity.
  - autoexec 5y ago
    While MS isn't collecting your run history (at least not as you type it) the point stands. They've decided to use their OS to collect personal info on users for their own profit. The extent to which this happens can be limited, but not disabled entirely (for most users). That's reason enough to not trust them.
  - TedShiller 5y ago
    Microsoft lost my trust in the 1990's. Never been happier without them since.
4oo4 5y ago
I think most antivirus is security theater at this point, unless you're using endpoint security like CrowdStrike Falcon, Palo Alto Cortex, Carbon Black, etc. Which, I think only sell to B2B and not consumer.
- _dain_ 5y ago
  Was it ever not security theatre?
  - 4oo4 5y ago
    You're definitely right about that. I think it's from the XP days, but I remember reading about antivirus vendors creating their own security holes and vulnerabilities, where running antivirus software made your computer less secure than without it. And then when Microsoft wanted to create fixes to prevent said vulnerabilities from being exploitable, the antivirus vendors actually threatened to sue them to avoid putting in the engineering work to fix their shitty code. EDIT: In many cases, these security changes meant deep architectural changes were required to third party solutions. And most ecosystem vendors were not incented to invest heavily in their legacy apps. Some of these solutions took the unorthodox approach of modifying data structures and even instructions in the kernel in order to implement their functionality, bypassing APIs and multiprocessor locks, often causing havoc. At one point, something like 70% of all Windows “blue screens” were caused by these third party drivers and their unwillingness to use supported APIs to implement their functionality. Antivirus vendors were notorious for using this approach. In my role as head of Microsoft security, I personally spent years explaining to antivirus vendors why we would no longer allow them to “patch” kernel instructions and data structures in memory, why this was a security risk, and why they needed to use approved APIs going forward, that we would no longer support their legacy apps with deep hooks in the Windows kernel — the same approach that hackers were using to attack consumer systems. Our “friends”, the antivirus vendors, threatened to sue us in return, claiming we were blocking their livelihood and abusing our monopoly power! With friends like that, who needs enemies? They just wanted their old solutions to keep working even if that meant reducing the security of our mutual customers — the very thing they were supposed to be improving. https://blog.usejournal.com/what-really-happened-with-vista-an-insiders-retrospective-f713ee77c239?gi=86c23f881661 https://blog.usejournal.com/what-really-happened-with-vista-...
fuzzy2 5y ago
My only grief with Windows Defender is its resource use. My Windows 10 computer booted 26 hours ago. Windows Defender is using 2186 MiB of RAM. I don’t think that’s appropriate, even if I have 32 GiB in total. With Office 365 ATP, things get even slower, too, which is not so great on my work device. Detection rate is one thing. Performance is another. Both are important.
- EMM_386 5y ago
  > Windows Defender is using 2186 MiB of RAM. I don’t think that’s appropriate. These memory-type debates come up time and time again. Keep in mind I'm a programmer from the DOS days, note my user name on when this was an important issue. We had to cram every byte. These programs will use idle RAM as they see necessary to be performant. If you aren't using the RAM, why not actually use it for what it's for? Are you under memory pressure? How many GB of RAM do you currently have and how often are you capping it out? Try seeing what happens when you are at your GB RAM cap. "I don't think that's appropriate" is highly subjective and it depends on what it does, and what you are currently doing.
  - beagle3 5y ago
    Where’s the setting where one decides between file system cache, anti-virus, swap space, and other uses? If there was one, it would be fine.
    - TameAntelope 5y ago
      Why are you trying to manage it? Let the OS do its thing, it’s really good at memory management.
      - gruez 5y ago
        AFAIK the OS file cache doesn't get counted towards the process's memory usage, so if windows defender is showing up as using 2GB of memory, it really is using 2GB of memory for the app itself.
      - 5y ago
323 5y ago
Windows Defender doesn't have heuristics/behaviour based detection. For example, if you write a simple keylogger using the Windows API in C++/Python/..., compile it and run it, an antivirus like BitDefender will block it by default. It's up to you then to allow it or not. So it can sometimes detect and block unknown malware, a thing that Windows Defender can't. So for some people it might make sense to have a more "strict" antivirus.
- fletchern 5y ago
  > Windows Defender doesn't have heuristics/behaviour based detection. Yes it does, in fact mpengine has a built-in JIT compiler for converting executables that it's scanning into safely-runnable executable code within its sandbox environment (done for performance reasons, rather than simply emulating them).
- mrits 5y ago
  Well that isn't true.
- unnouinceput 5y ago
  1st - that "heuristic" used by BitDefender or other AV solutions are simply scanning the .exe for those APi calls. This is easy to overcome by simply encrypting with even a simple XOR and dynamically loading said API's for keylogging (I suspect you are referring to SetWindowsHookEx - the most used API loggers, malware or not). 2nd - BitDefender is a Romanian AV, but people forget that Windows Defender is Romanian too, at its heart, the formerly RAV (Reliable AntiVirus) that Microsoft acquired it in the ancient times of early 00's. See: https://en.wikipedia.org/wiki/GeCAD_Software https://en.wikipedia.org/wiki/GeCAD_Software and https://www.networkworld.com/article/2334189/microsoft-to-buy-romanian-antivirus-company.html https://www.networkworld.com/article/2334189/microsoft-to-bu... 3rd - BitDefender is the most hog resource AV. Also the most annoying. And it behaves like is the only application you are need it, constantly begging attention. I worked at a company who had it as license, I hated every day there only because of it. Windows Defender on the other hand is so quiet that I always forget is running. My 2 cents.
  - 5y ago
benbristow 5y ago
One problem with Windows Defender I believe is that if you were a malware author the first AV you'd want to try and bypass is Windows Defender as it's the default which is used on most Windows PCs for your 'MVP'. Bypassing other AVs would really be a 'nice to have'
- staticassertion 5y ago
  Malware authors have tooling to run their payloads across many vendors all at once. I'm sure Defender is on the shortlist, but it probably doesn't matter much. Further, AV is inherently a "catches known threats" technology, as much as any AV may pretend otherwise. Some people will always get owned but by virtue of those users' AV picking up samples the sample will eventually make it to various AVs. If your goal is to avoid AV bypasses, I'd suggest changing your goals. Instead, treat AV as it is - a technology for finding known bad things. If you want to avoid unknown bad things you need to take another approach.
  - icare_1er 5y ago
    The time where AV business was just catching signatures, is long gone. ANYTHING that touches lsass.exe, no matter how, will trigger AV these days. Go and try to compile your own customized version of Mimikatz, unless you are malware developer, you will not manage to get one that doesn't get flagged.
    - staticassertion 5y ago
      I'm aware of the fact that AVs are not just hashing binaries or whatever. I'm well aware of how AV works in general. My points all stand imo. AV is a reactive technology.
ec109685 5y ago
Feels like one obvious step would be to make running as a non-admin user easier. Ended up giving up with kids computer given so much required admin password and no way (even through changing program’s options) to actually run a single program with true admin access. Also no way to say, “always allow” some action with some program.
joe-collins 5y ago
> Sometimes it is easier to break a person than their computer security. Then even the most expensive solution will not help. > Run this bat file!
- munchler 5y ago
  That’s where I stopped reading as well. There wasn’t even an attempt to explain what the batch file does.
  - edfletcher_t137 5y ago
    Came here to say just to say all of this. 100%. Also this is another direct quote from the article: > Reading some comments on random websites I guess you don’t even need a brain. Coupled with the "just run this" batch file with no explanation... huge facepalm.
  - Godel_unicode 5y ago
    There's only one reference to a bat file in the article that I saw, but that bat file is named "gpedit-enable.bat" and is at the end of a paragraph describing how that is for enabling the local group policy editor on home editions of Windows. That script itself is also quite clear with it's use of `rem` to explain what's happening. Perhaps read it again... "Local Group Policy Editor is available only in pro/enterprise edition, but you can add it to the Home version of Windows too."
    - munchler 5y ago
      Thank you for the explanation. That makes sense.
    - brobinson 5y ago
      The last two lines don't even work for me on Windows 10 Home. It looks like there's accidentally two `dir` invocations on the same line, PowerShell and Command Prompt both complain about the /B switch as if it were a missing path (I think the author meant "/b" for the bare file listing?), and the ClientExtensions and ClientTools directories don't exist for me.
9wzYQbTYsAIc 5y ago
So true. Windows Defender has a ton of neat advanced features and you don’t have to worry about keeping up with some other vendor of security software, either.
kubb 5y ago
So the default settings are not secure and I need to go 10 levels deep in gpedit.msc to enable the security features? What?
- Godel_unicode 5y ago
  All client security products are making tradeoffs between keeping the user safe and requiring them to read and understand configuration settings in their security products. The options recommended here fall into either the "this will break some legitimate stuff" bucket or the "this potentially uploads a lot of user data to the cloud". I agree with them being off by default; if you understand and can handle it, you can turn them on. If gpedit is scary, you should leave them alone.
Tempest1981 5y ago
I wonder what the performance impact of these changes is. There must be a reason they are disabled by default.
- proactivesvcs 5y ago
  I'd be more concerned of what sort of undocumented behaviour now occurs from a result of these changes, and whether any of the features/options will be available tomorrow.
caymanjim 5y ago
How are people even getting viruses? I've been using Windows to varying degrees since the 1980s, and I've never once in my life gotten a virus. I never used any antivirus software. I let Windows do whatever it does by default, but it never flags anything. Are people picking up viruses from pirated games or something?
- elorant 5y ago
  You, and me, and everyone else in here are not the average user. The average user clicks and opens files all the time.
- UberFly 5y ago
  "I've never once in my life gotten a virus. I never used any antivirus software." This is like saying your blood pressure is fine, but you've never had it measured. :) Email and internet are still places of entry to machines. Plenty of 0-Day stuff out there your average person can stumble into.
  - zamalek 5y ago
    > average person Even the most paranoid and careful person could be pwnd by a vulnerability in their browser, network stack, GPU driver, or whatever. If you at any point open a network-connected application on a popular OS then you are at risk. It doesn't matter if you "don't click links," or "be careful what you download."
    - UberFly 5y ago
      Amen to that. Plus I erred in saying 0-day. Actually, if not using any kind of AV, you're vulnerable to everything ever made if you're trusting your "intuition" alone.
- icare_1er 5y ago
  Most people whose computer has become part of a botnet don't know it.
jrm4 5y ago
I understand that many of you aren't in a position to bargain or move the needle here, but no claims of safety made by Microsoft should ever be taken seriously, ever. Not until a serious mea culpa on the extreme harm they've caused in this space.
alwaysanon 5y ago
The performance and battery life impacts of Windows Defender make it just not worth it for me though. I had a few months where I went back to Linux on my ThinkPad (unfortunately with an nvidia gpu - whose Linux drivers I think caused half my troubles) and it was soo much more performant - but it had enough various annoyances where I just went back to Windows 11 and WSL2. The idea that pushed me over the edge to try it again was that, this time, I'd try disabling Defender (as I was 1/2 convinced the Linux performance boost was not having AV) and keep a fresh/clean install strictly limited to Chrome (now that I had gotten used to just using the web versions of everything like Slack, Spotify, etc.), VS Code, WSL2 and that's it. Basically what I'd been doing with Linux. And so far that's been great - better performance, runs cooler and quieter, longer battery life etc. than I ever used to have with Windows. It is like a whole new machine. Knowing I don't have Defender I am even more careful about what I download (these days almost nothing - especially on the Windows side rather than the WSL2 Ubuntu dev side) and about ensuring everything is patched. But it is such a game-changer I am not going back...
- jorgec 5y ago
heavyset_go 5y ago
It's the first thing I disable in VMs because of what a resource hog it is.
technion 5y ago
I responded to multiple major compromises during the Hafnium Exchange hacks. https://www.theverge.com/2021/3/8/22319934/microsoft-hafnium-hack-exchange-server-email-flaw-white-house https://www.theverge.com/2021/3/8/22319934/microsoft-hafnium... In quite a few cases, we identified that ultimately a server has been popped using this unknown zero day, but never before seen webshells and Cobalt strike droppers all ended up dropped on servers and then deleted by Windows Defender. We recommended rebuilds regardless but the product clearly provided more security than people give it credit for. Then we identified a number of places it didn't appear to work. Why? The answer was people following "best practices" of adding AV exclusions for the whole web root folder, and for some reason the whole user profile folder. That big Kaseya hack? Every Kaseya user was told by Kaseya to add exclusions for every folder used by the product. One of the understated issues with modern EDR products is people simply following vendor advise and making it useless. I've got a software product that handles payment details that randomly drops EICAR test files in random folders all of the user PC while it's running just so it can shut itself down if it detects Defender in use "for support reasons". All the top EDR products in the world and all the hardening advice you can find can go down the toilet pretty quickly if you let vendors tell you how to run these products - ignoring them is a highly rated hardening tip.
- oauea 5y ago
  The performance impact is real
  - pvillano 5y ago
    what is your suggestion? why don't companies irl improve performance in ways that don't compromising security?
- jorgec 5y ago
_8j50 5y ago
This is an impossible question because of missing unfilled variables such as threat model, use case and the nature of data protected. I agree with the general sentiment. Let's say you're a journalist at an important news org. Even for your personal devices, the builtin defender isn't enough. There is a fundamental principle for sophisticated actors, that prevention is not enough. Your security software should do monitoring (off device) and do that very well. You are already compromised, you should be looking into the collected data to see where, when and by whom so you can do something about it. Unfortunately in the last fee years the line has been getting very blurry between sophisticated nation state actors and criminals and common criminals trying to score as much loot as possible (mostly due to being forced to use sophisticated tools and techniques because solutions like Defender have gotten very good). You maybe an average joe and still be a target for "sophisticated" actors or you may think you are an "average joe" but your pwnage offers a strategic value to someone resourceful, My advice is to take inventory of the data and resources you have access to and see (with help if needed) what threat model fits your use case. MS does offer a Defender ATP that's basically turning on few more switches and sending them a log of everything happening your machine. Back tracking a bit: Defender is really good. Cloud based protection is their secret sauce, turn it on and pretend they are to be trusted with collecting random files from your PC.
Terry_Roll 5y ago
Cant agree with this, the GPU seems to be a weakness, but in light of nVidia's recent hack, I'd suggest nVidia GPU's are the weakness in windows, but I know ATI also have some weaknesses, they are like sim cards working with a mobile phone OS but also independently accessing the mobile phone hardware.
- pelorat 5y ago
  It's only a weakness if you download random executables.
  - Terry_Roll 5y ago
    This isnt the 80's things are a little more sophisticated than that. They have to be.
  - stjohnswarts 5y ago
    Not true. There are 0 clicks/keypress necessary viruses out there that rip right through holes in servers without the user doing anything. They're certainly not as common as the "usual" types but no one is immune and you can bet state actors have a ton of those at their disposal as do well funded black hat crime syndicates.
Angostura 5y ago
What would be handy in an article like this is an explanation of why the options are turned off by default. Presumably MS didn't decide to e.g leave the Ransomware protection turned off out of spite. So presumably there is a compromise between additional protection and ... something?
- jsmith45 5y ago
  The ransomware protection (Controlled Folder access) blocks write to controlled folders. The admin specifies folders to be protected, which by default includes a bunch of user profile folders like "Documents". At that point no application can write to those folders unless whitelisted. The downside is that for a while after you enable it, you will need to keep granting applications write access to those folders, until eventually all apps that need write access have it. In a corporate environment, IT could pre-configure the white list to include any approved applications that need write access to those folders. Most companies claim that installing unapproved software is a fireable offence, so only the execs (who are immune to such policies) and developers are likely to notice.
fomine3 5y ago
Unpopular opinion: Defender can't be the best (but yes enough) because it's too popular, so every malware creator checks with it.
galaxyLogic 5y ago
How about a simple scheme where software producers can register their .exe with Microsoft and when I download an exe I could verify that the fingerprint of the exe is registered on the Microsoft whitelist? Or is this kind of thing already happening by the Defender? I have never seen a message saying "Defender does not recognize this application, are you sure you want to start it?" Also there's a lot of downloadable Open Source software where users are asked to "verify the keys". Couldn't Windows do this kind of thing automatically, or at least make it easy?
- pigbearpig 5y ago
  That's very similar to what SmartScreen is. https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview https://docs.microsoft.com/en-us/windows/security/threat-pro...
  - galaxyLogic 5y ago
    That seems very useful especially for web-sites. What I'm thinking of is something where Microsoft would keep a publicly visible registry of all apps that have been submitted to the registry. It would be beneficial for both software produces and Microsoft as the platform producer. The registry would run all kinds of malware checks on it, and also keep an ear out for reports of threats found.
tehdgvtd 5y ago
I read it all, and feel dumber than before. Why the convoluted scripts to get admin? Why execing file with "~3" in the name when you can use the proper one? So much needles silly steps, too little actual explaining of anything that would matter. Also, following that will just ensure you can never download curl or nmap lol. ...i guess, maybe i got the whole thing wrong. Who knows. I don't.
- kibwen 5y ago
  Ironically, while I agree with the thrust that Windows Defender is basically good enough, I find it extremely dubious for a security-focused article to suggest that anyone should be in the habit of copy-and-pasting arbitrary inscrutable code onto their machine in the service of making it safer.
- stinos 5y ago
  too little actual explaining of anything that would matter. This. It reads exactly like (suboptimal) code comments or commit messages explaining what gets done but no trace of why. Why does this stuff harden defender? Why does it make Defender enough?
- asmr 5y ago
  That script is a well known hack to get Pro/Enterprise features on Windows Home version, in this case the Group Policy Editor. Not necessary for most users.
kimown 5y ago
Complete useless and waste cpu/mem/electricity/time
ZYinMD 5y ago
I use my pc 12+ hours a day, haven't installed any 3rd party antivirus software since 2005, and haven't encountered a single problem, because I know what I'm doing. I think all people who read ycombinator should be able to do the same.
- dncornholio 5y ago
  I haven't used an anti-virus in all of my 20+ years of computering. I've been hit with some minor infections (mostly from torrents, which I knew was not safe). But that's it. Just do a reinstall of Windows every 2-3 months.
  - shaunpud 5y ago
    "thinking" meme; If I don't have antivirus, I won't be alerted to it.
Joe_Boogz 5y ago
Can anyone point me to the software that this blog uses? Or if the owner is lurking can you tell me what you use for your site? Looks really good, i'd like to create something similar for my site.
- victorstanciu 5y ago
  The generator meta tag says it's made with Hexo: https://hexo.io/ https://hexo.io/
- h0ek 5y ago
  Hello Joe_Boogz, Blog is using Hexo (https://hexo.io/ https://hexo.io/) and a little modified Cactus theme (https://probberechts.github.io/hexo-theme-cactus/ https://probberechts.github.io/hexo-theme-cactus/). If some of the websites looks interesting to you and you would like how they are built you can use Wappalyzer (https://www.wappalyzer.com/ https://www.wappalyzer.com/)
  - Joe_Boogz 5y ago
    Thank you!!
AniseAbyss 5y ago
Defender UI is absolutely terrible and keeps deleting things. It is enough for your average user though I'll give it that.
jve 5y ago
Windows Defender also features exploit protection: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/customize-exploit-protection?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/security/defe... And attack surface reduction rules (which you must configure) - which greatly reduces office worker possibility of catching some nasty stuff: Block abuse of exploited vulnerable signed drivers Block Adobe Reader from creating child processes Block all Office applications from creating child processes Block credential stealing from the Windows local security authority subsystem (lsass.exe) Block executable content from email client and webmail Block executable files from running unless they meet a prevalence, age, or trusted list criterion Block execution of potentially obfuscated scripts Block JavaScript or VBScript from launching downloaded executable content Block Office applications from creating executable content Block Office applications from injecting code into other processes Block Office communication application from creating child processes Block persistence through WMI event subscription * File and folder exclusions not supported. Block process creations originating from PSExec and WMI commands Block untrusted and unsigned processes that run from USB Block Win32 API calls from Office macros Use advanced protection against ransomware
icare_1er 5y ago
As a whitehat I can say that the AVs that i found the hardest to bypass was ESET32; Windefender, Kasperky, are just behind.
asmr 5y ago
Created a gist as a reference with all of the powershell commands and some additional info from this thread, such as exploit protection. I'm considering a full script. https://gist.github.com/superswan/1d6ed59e75273f90a481428964be3ae5 https://gist.github.com/superswan/1d6ed59e75273f90a481428964...
deleted 5y ago
[deleted]
HeavyStorm 5y ago
I've never used antivirus (other than defender). AFAICT, I wasn't ever affected by a virus with one exception, the Blaster (or Sasser) worm. This was before Defender existed. On the other hand, whenever I use a machine with an antivirus, I want to quit my job. Those things are slow. Very slow. My work machine has a multitude of security software that I can't disable, heck, I can't even touch. Doing a pip install on a common program takes 10, 15 minutes. The same installation on my personal machine takes about one minute. The culprit? The 3 different agents that spins out of control scanning my disk.
sandylovesa 5y ago
sandylovesa 5y ago
alexklark 5y ago
Microsoft Defender and microsoft security is a unfunny long lasting joke that even beat UAC stupidity. All they do is invent new protection names and is trying to syphon all possible data from the PC it is supposedly protecting. The copy speed of 7gbs ssd is close to 10 mbs because you getti “protected”. Do you want to get protected even more? Enable cloud protection, enable online account protection, want to submit file to our protected protection to get protected? No, oh, in this way you are not protected anymore! But you know, last 5 days of your computer idling, it was scanned 10 times and nothing found. Thats important to know. Oh wait I found a generic.generic in your old keygen music file on CD, you not protected anymore! But i will try to delete it for ever. So much defending, such protection. WOW!

560 points by h0ek 5y ago

jmrm 5y ago

As a "family SysAdmin" I'm pretty happy about how good Windows Defender and MRT updates works. Aside from clearly aimed ransomeware, today's pretty difficult to have virus problems in Windows. Most of the time I have to repair any Windows machine is due to a driver install problem (specially sound cards) or a system update problem.

veganhouseDJ 5y ago

trifit 5y ago

Most people don’t even download an antivirus so this is a good walkthrough.

Comevius 5y ago

I have to say I never used an antivirus software before except I guess the built-in one in Windows. I think sandboxes are better for software you don't trust. I imagine antivirus heuristics are only useful against a handful of common threats, if at all.

0xbadc0de5 5y ago

Defender has been the only worthwhile Windows AV solution for years. All others have been at best, on-par and at worst, net-negative (opening vulnerabilities that would not otherwise exist).

thrower123 5y ago

I haven't had a virus problem since the days of Windows 2000. I've had an incredible number of problems caused by antivirus software interfering with legitimate software.

encryptluks2 5y ago
None that you know of. I think virus creators have probably adapted from breaking things to silently collect information.
- tupac_speedrap 5y ago
  They already have, most AV software nowadays is adware. If you are lucky they'll just slurp your data and maybe get you to install Chrome or some other random piece of software but some are even using your PC to mine cryptocurrency nowadays.
- seanw444 5y ago
  Word. Silent data farming is certainly worth more in the long run than ransomware encrypting the whole disk of some John Doe.
- bartimus 5y ago
  But wouldn't those infections be detected eventually? They would need to update/hide their "solution" every time A/V software comes with updates to detect them. It would be too late already.
shaunpud 5y ago
You're amazing... So I guess you've never had to help a family member clean their system of said virus/malware/adware?

giantg2 5y ago

Natsu 5y ago
I don't like the idea of an internet permit, but I do agree with the idea that users should be taught internet safety. About 20 years ago I volunteered at the library and taught such a class, but only recently have I seen such classes as part of workplace training. It should probably be something that is taught in schools, as well. Or maybe it is covered now and I just don't know?
- giantg2 5y ago
  It was loosely covered in school when I went. We had some basic stuff even in middle school (20+ years ago) about use anti-virus, don't click links from unknown sources, etc. If schools aren't teaching the basics, then that could be a big security hole for the district. At the least, it reduces the protection of defense in depth and forces the school to wholly rely on systems to protect the network, when users are often the "in".
vore 5y ago
I think because your original post was a wildly off-topic nitpick of what the article is talking about as a whole.
- giantg2 5y ago
  I don't think it's really a nitpick to point out factual inaccuracy. That happens all the time on here and is a feature of an audience committed to truth. As a secondary point, do you think the author's use of licensing examples was on-topic? I don't see them go into any detail licensing, and it has little to nothing to do with the topic of hardening Defender. That said, yes, I do see that my initial comment was lacking the context later added in the edit.
damagednoob 5y ago
> "If you want to shoot a gun, you need to get a permit." > Not in the US, This statement seems to lack nuance and could be the reason for the downvotes. > Federal law does not require individuals to obtain a license or permit to purchase a firearm. Several states, however, have permit-to-purchase laws that function similarly to universal background check laws. https://www.rand.org/research/gun-policy/analysis/license-to-own.html https://www.rand.org/research/gun-policy/analysis/license-to...

sumthinprofound 5y ago

My firm belief is the that hardware vendors do end users a disservice by preloading 3rd party anti-virus software that expires ans requires payment after a period of time for virus signature updates. Typically this 3rd party software disables Defender, so once the pre-installed AV trial runs out, the user is exposed.

Nextgrid 5y ago
> do end users a disservice by preloading 3rd party anti-virus software There's a reason they're paid for doing so. If it was beneficial they'd do it for free.
- sumthinprofound 5y ago
  Agreed. Additionally I I think it may look more impressive to novice buyers when the product lists a bunch of free (albeit worthless) software included in their purchase.
- 9wzYQbTYsAIc 5y ago
  For sure, at a minimum the only reason to be doing that is to put food on their table. I’m sure that there are other reasons - do you have any in mind?
mojzu 5y ago
Definitely, getting rid of them pretty much requires an OS reinstall too which is incredibly annoying when it feels like I've had to waste an hour or so of my time so that the hardware vendor could make an extra buck. I occasionally get batches to do at work and I advocate against buying from vendors that do this kind of thing (for the little good it does, since they all seem to these days)
- sumthinprofound 5y ago
  My first steps with a new personal computer is to boot to thumb drive, format the disk and install what I believe to be a clean copy of windows. In a business environment I've always been an advocate of staging one machine taking a drive image and using that image to clone the rest. Resolved so many issues if the end-user mucks up their machines so bad you just reflash the drive image and send them on their way.

inglor 5y ago

Hey, sorry for all the name changes of Microsoft Defender. I work at MSec (Microsoft's security org). We ended up absorbing and acquiring a few companies to provide a better offering and a lot of re-branding happened. For example Security Center's old portal for active threat protection, automatic remediation, incident investigation etc is all now absorbed into (the better) security.microsoft.com which is (to my understanding, just an engineer) the current and last (for the foreseeable future) rebrand. The team I work at started as one person working on the frontend for MDE (Microsoft Defender for Endpoint) and now has hundreds of people working on the security portal across India, Israel and the US (as well as a few other smaller sites contributing). Also, as an engineer I have to say the offering is good. The anti-virus and the telemetry is worked on by some really smart people. Client information is sacred, logging into production takes multiple audits and PII is scrubbed (heavily) any time logs are needed. We still have a lot of room to improve but I am confident in Microsoft both delivering a good product and acting in good faith (and there is a clear business incentive in the enterprise security space to do so rather than benevolence).

flower-giraffe 5y ago
> Microsoft both delivering a good product and acting in good faith I’m going to call you out on that. Microsoft lost my trust to act in good faith with personal data when they started capturing my private OS user input (e.g. the history from Windows R (run) and forced me to link it to my personal identity.
- autoexec 5y ago
  While MS isn't collecting your run history (at least not as you type it) the point stands. They've decided to use their OS to collect personal info on users for their own profit. The extent to which this happens can be limited, but not disabled entirely (for most users). That's reason enough to not trust them.
- TedShiller 5y ago
  Microsoft lost my trust in the 1990's. Never been happier without them since.

4oo4 5y ago

I think most antivirus is security theater at this point, unless you're using endpoint security like CrowdStrike Falcon, Palo Alto Cortex, Carbon Black, etc. Which, I think only sell to B2B and not consumer.

_dain_ 5y ago
Was it ever not security theatre?
- 4oo4 5y ago
  You're definitely right about that. I think it's from the XP days, but I remember reading about antivirus vendors creating their own security holes and vulnerabilities, where running antivirus software made your computer less secure than without it. And then when Microsoft wanted to create fixes to prevent said vulnerabilities from being exploitable, the antivirus vendors actually threatened to sue them to avoid putting in the engineering work to fix their shitty code. EDIT: In many cases, these security changes meant deep architectural changes were required to third party solutions. And most ecosystem vendors were not incented to invest heavily in their legacy apps. Some of these solutions took the unorthodox approach of modifying data structures and even instructions in the kernel in order to implement their functionality, bypassing APIs and multiprocessor locks, often causing havoc. At one point, something like 70% of all Windows “blue screens” were caused by these third party drivers and their unwillingness to use supported APIs to implement their functionality. Antivirus vendors were notorious for using this approach. In my role as head of Microsoft security, I personally spent years explaining to antivirus vendors why we would no longer allow them to “patch” kernel instructions and data structures in memory, why this was a security risk, and why they needed to use approved APIs going forward, that we would no longer support their legacy apps with deep hooks in the Windows kernel — the same approach that hackers were using to attack consumer systems. Our “friends”, the antivirus vendors, threatened to sue us in return, claiming we were blocking their livelihood and abusing our monopoly power! With friends like that, who needs enemies? They just wanted their old solutions to keep working even if that meant reducing the security of our mutual customers — the very thing they were supposed to be improving. https://blog.usejournal.com/what-really-happened-with-vista-an-insiders-retrospective-f713ee77c239?gi=86c23f881661 https://blog.usejournal.com/what-really-happened-with-vista-...

fuzzy2 5y ago

My only grief with Windows Defender is its resource use. My Windows 10 computer booted 26 hours ago. Windows Defender is using 2186 MiB of RAM. I don’t think that’s appropriate, even if I have 32 GiB in total. With Office 365 ATP, things get even slower, too, which is not so great on my work device. Detection rate is one thing. Performance is another. Both are important.

EMM_386 5y ago
> Windows Defender is using 2186 MiB of RAM. I don’t think that’s appropriate. These memory-type debates come up time and time again. Keep in mind I'm a programmer from the DOS days, note my user name on when this was an important issue. We had to cram every byte. These programs will use idle RAM as they see necessary to be performant. If you aren't using the RAM, why not actually use it for what it's for? Are you under memory pressure? How many GB of RAM do you currently have and how often are you capping it out? Try seeing what happens when you are at your GB RAM cap. "I don't think that's appropriate" is highly subjective and it depends on what it does, and what you are currently doing.
- beagle3 5y ago
  Where’s the setting where one decides between file system cache, anti-virus, swap space, and other uses? If there was one, it would be fine.
  - TameAntelope 5y ago
    Why are you trying to manage it? Let the OS do its thing, it’s really good at memory management.
    - gruez 5y ago
      AFAIK the OS file cache doesn't get counted towards the process's memory usage, so if windows defender is showing up as using 2GB of memory, it really is using 2GB of memory for the app itself.
    - 5y ago

323 5y ago

Windows Defender doesn't have heuristics/behaviour based detection. For example, if you write a simple keylogger using the Windows API in C++/Python/..., compile it and run it, an antivirus like BitDefender will block it by default. It's up to you then to allow it or not. So it can sometimes detect and block unknown malware, a thing that Windows Defender can't. So for some people it might make sense to have a more "strict" antivirus.

fletchern 5y ago
> Windows Defender doesn't have heuristics/behaviour based detection. Yes it does, in fact mpengine has a built-in JIT compiler for converting executables that it's scanning into safely-runnable executable code within its sandbox environment (done for performance reasons, rather than simply emulating them).
mrits 5y ago
Well that isn't true.
unnouinceput 5y ago
1st - that "heuristic" used by BitDefender or other AV solutions are simply scanning the .exe for those APi calls. This is easy to overcome by simply encrypting with even a simple XOR and dynamically loading said API's for keylogging (I suspect you are referring to SetWindowsHookEx - the most used API loggers, malware or not). 2nd - BitDefender is a Romanian AV, but people forget that Windows Defender is Romanian too, at its heart, the formerly RAV (Reliable AntiVirus) that Microsoft acquired it in the ancient times of early 00's. See: https://en.wikipedia.org/wiki/GeCAD_Software https://en.wikipedia.org/wiki/GeCAD_Software and https://www.networkworld.com/article/2334189/microsoft-to-buy-romanian-antivirus-company.html https://www.networkworld.com/article/2334189/microsoft-to-bu... 3rd - BitDefender is the most hog resource AV. Also the most annoying. And it behaves like is the only application you are need it, constantly begging attention. I worked at a company who had it as license, I hated every day there only because of it. Windows Defender on the other hand is so quiet that I always forget is running. My 2 cents.
- 5y ago

benbristow 5y ago

One problem with Windows Defender I believe is that if you were a malware author the first AV you'd want to try and bypass is Windows Defender as it's the default which is used on most Windows PCs for your 'MVP'. Bypassing other AVs would really be a 'nice to have'

staticassertion 5y ago
Malware authors have tooling to run their payloads across many vendors all at once. I'm sure Defender is on the shortlist, but it probably doesn't matter much. Further, AV is inherently a "catches known threats" technology, as much as any AV may pretend otherwise. Some people will always get owned but by virtue of those users' AV picking up samples the sample will eventually make it to various AVs. If your goal is to avoid AV bypasses, I'd suggest changing your goals. Instead, treat AV as it is - a technology for finding known bad things. If you want to avoid unknown bad things you need to take another approach.
- icare_1er 5y ago
  The time where AV business was just catching signatures, is long gone. ANYTHING that touches lsass.exe, no matter how, will trigger AV these days. Go and try to compile your own customized version of Mimikatz, unless you are malware developer, you will not manage to get one that doesn't get flagged.
  - staticassertion 5y ago
    I'm aware of the fact that AVs are not just hashing binaries or whatever. I'm well aware of how AV works in general. My points all stand imo. AV is a reactive technology.

ec109685 5y ago

Feels like one obvious step would be to make running as a non-admin user easier. Ended up giving up with kids computer given so much required admin password and no way (even through changing program’s options) to actually run a single program with true admin access. Also no way to say, “always allow” some action with some program.

joe-collins 5y ago

> Sometimes it is easier to break a person than their computer security. Then even the most expensive solution will not help. > Run this bat file!

munchler 5y ago
That’s where I stopped reading as well. There wasn’t even an attempt to explain what the batch file does.
- edfletcher_t137 5y ago
  Came here to say just to say all of this. 100%. Also this is another direct quote from the article: > Reading some comments on random websites I guess you don’t even need a brain. Coupled with the "just run this" batch file with no explanation... huge facepalm.
- Godel_unicode 5y ago
  There's only one reference to a bat file in the article that I saw, but that bat file is named "gpedit-enable.bat" and is at the end of a paragraph describing how that is for enabling the local group policy editor on home editions of Windows. That script itself is also quite clear with it's use of `rem` to explain what's happening. Perhaps read it again... "Local Group Policy Editor is available only in pro/enterprise edition, but you can add it to the Home version of Windows too."
  - munchler 5y ago
    Thank you for the explanation. That makes sense.
  - brobinson 5y ago
    The last two lines don't even work for me on Windows 10 Home. It looks like there's accidentally two `dir` invocations on the same line, PowerShell and Command Prompt both complain about the /B switch as if it were a missing path (I think the author meant "/b" for the bare file listing?), and the ClientExtensions and ClientTools directories don't exist for me.

9wzYQbTYsAIc 5y ago

So true. Windows Defender has a ton of neat advanced features and you don’t have to worry about keeping up with some other vendor of security software, either.

kubb 5y ago

So the default settings are not secure and I need to go 10 levels deep in gpedit.msc to enable the security features? What?

Godel_unicode 5y ago
All client security products are making tradeoffs between keeping the user safe and requiring them to read and understand configuration settings in their security products. The options recommended here fall into either the "this will break some legitimate stuff" bucket or the "this potentially uploads a lot of user data to the cloud". I agree with them being off by default; if you understand and can handle it, you can turn them on. If gpedit is scary, you should leave them alone.

Tempest1981 5y ago

I wonder what the performance impact of these changes is. There must be a reason they are disabled by default.

proactivesvcs 5y ago
I'd be more concerned of what sort of undocumented behaviour now occurs from a result of these changes, and whether any of the features/options will be available tomorrow.

caymanjim 5y ago

How are people even getting viruses? I've been using Windows to varying degrees since the 1980s, and I've never once in my life gotten a virus. I never used any antivirus software. I let Windows do whatever it does by default, but it never flags anything. Are people picking up viruses from pirated games or something?

elorant 5y ago
You, and me, and everyone else in here are not the average user. The average user clicks and opens files all the time.
UberFly 5y ago
"I've never once in my life gotten a virus. I never used any antivirus software." This is like saying your blood pressure is fine, but you've never had it measured. :) Email and internet are still places of entry to machines. Plenty of 0-Day stuff out there your average person can stumble into.
- zamalek 5y ago
  > average person Even the most paranoid and careful person could be pwnd by a vulnerability in their browser, network stack, GPU driver, or whatever. If you at any point open a network-connected application on a popular OS then you are at risk. It doesn't matter if you "don't click links," or "be careful what you download."
  - UberFly 5y ago
    Amen to that. Plus I erred in saying 0-day. Actually, if not using any kind of AV, you're vulnerable to everything ever made if you're trusting your "intuition" alone.
icare_1er 5y ago
Most people whose computer has become part of a botnet don't know it.

jrm4 5y ago

I understand that many of you aren't in a position to bargain or move the needle here, but no claims of safety made by Microsoft should ever be taken seriously, ever. Not until a serious mea culpa on the extreme harm they've caused in this space.

alwaysanon 5y ago

The performance and battery life impacts of Windows Defender make it just not worth it for me though. I had a few months where I went back to Linux on my ThinkPad (unfortunately with an nvidia gpu - whose Linux drivers I think caused half my troubles) and it was soo much more performant - but it had enough various annoyances where I just went back to Windows 11 and WSL2. The idea that pushed me over the edge to try it again was that, this time, I'd try disabling Defender (as I was 1/2 convinced the Linux performance boost was not having AV) and keep a fresh/clean install strictly limited to Chrome (now that I had gotten used to just using the web versions of everything like Slack, Spotify, etc.), VS Code, WSL2 and that's it. Basically what I'd been doing with Linux. And so far that's been great - better performance, runs cooler and quieter, longer battery life etc. than I ever used to have with Windows. It is like a whole new machine. Knowing I don't have Defender I am even more careful about what I download (these days almost nothing - especially on the Windows side rather than the WSL2 Ubuntu dev side) and about ensuring everything is patched. But it is such a game-changer I am not going back...

jorgec 5y ago

heavyset_go 5y ago

It's the first thing I disable in VMs because of what a resource hog it is.

technion 5y ago

I responded to multiple major compromises during the Hafnium Exchange hacks. https://www.theverge.com/2021/3/8/22319934/microsoft-hafnium-hack-exchange-server-email-flaw-white-house https://www.theverge.com/2021/3/8/22319934/microsoft-hafnium... In quite a few cases, we identified that ultimately a server has been popped using this unknown zero day, but never before seen webshells and Cobalt strike droppers all ended up dropped on servers and then deleted by Windows Defender. We recommended rebuilds regardless but the product clearly provided more security than people give it credit for. Then we identified a number of places it didn't appear to work. Why? The answer was people following "best practices" of adding AV exclusions for the whole web root folder, and for some reason the whole user profile folder. That big Kaseya hack? Every Kaseya user was told by Kaseya to add exclusions for every folder used by the product. One of the understated issues with modern EDR products is people simply following vendor advise and making it useless. I've got a software product that handles payment details that randomly drops EICAR test files in random folders all of the user PC while it's running just so it can shut itself down if it detects Defender in use "for support reasons". All the top EDR products in the world and all the hardening advice you can find can go down the toilet pretty quickly if you let vendors tell you how to run these products - ignoring them is a highly rated hardening tip.

oauea 5y ago
The performance impact is real
- pvillano 5y ago
  what is your suggestion? why don't companies irl improve performance in ways that don't compromising security?
jorgec 5y ago

_8j50 5y ago

This is an impossible question because of missing unfilled variables such as threat model, use case and the nature of data protected. I agree with the general sentiment. Let's say you're a journalist at an important news org. Even for your personal devices, the builtin defender isn't enough. There is a fundamental principle for sophisticated actors, that prevention is not enough. Your security software should do monitoring (off device) and do that very well. You are already compromised, you should be looking into the collected data to see where, when and by whom so you can do something about it. Unfortunately in the last fee years the line has been getting very blurry between sophisticated nation state actors and criminals and common criminals trying to score as much loot as possible (mostly due to being forced to use sophisticated tools and techniques because solutions like Defender have gotten very good). You maybe an average joe and still be a target for "sophisticated" actors or you may think you are an "average joe" but your pwnage offers a strategic value to someone resourceful, My advice is to take inventory of the data and resources you have access to and see (with help if needed) what threat model fits your use case. MS does offer a Defender ATP that's basically turning on few more switches and sending them a log of everything happening your machine. Back tracking a bit: Defender is really good. Cloud based protection is their secret sauce, turn it on and pretend they are to be trusted with collecting random files from your PC.

Terry_Roll 5y ago

Cant agree with this, the GPU seems to be a weakness, but in light of nVidia's recent hack, I'd suggest nVidia GPU's are the weakness in windows, but I know ATI also have some weaknesses, they are like sim cards working with a mobile phone OS but also independently accessing the mobile phone hardware.

pelorat 5y ago
It's only a weakness if you download random executables.
- Terry_Roll 5y ago
  This isnt the 80's things are a little more sophisticated than that. They have to be.
- stjohnswarts 5y ago
  Not true. There are 0 clicks/keypress necessary viruses out there that rip right through holes in servers without the user doing anything. They're certainly not as common as the "usual" types but no one is immune and you can bet state actors have a ton of those at their disposal as do well funded black hat crime syndicates.

Angostura 5y ago

What would be handy in an article like this is an explanation of why the options are turned off by default. Presumably MS didn't decide to e.g leave the Ransomware protection turned off out of spite. So presumably there is a compromise between additional protection and ... something?

jsmith45 5y ago
The ransomware protection (Controlled Folder access) blocks write to controlled folders. The admin specifies folders to be protected, which by default includes a bunch of user profile folders like "Documents". At that point no application can write to those folders unless whitelisted. The downside is that for a while after you enable it, you will need to keep granting applications write access to those folders, until eventually all apps that need write access have it. In a corporate environment, IT could pre-configure the white list to include any approved applications that need write access to those folders. Most companies claim that installing unapproved software is a fireable offence, so only the execs (who are immune to such policies) and developers are likely to notice.

fomine3 5y ago

Unpopular opinion: Defender can't be the best (but yes enough) because it's too popular, so every malware creator checks with it.

galaxyLogic 5y ago

How about a simple scheme where software producers can register their .exe with Microsoft and when I download an exe I could verify that the fingerprint of the exe is registered on the Microsoft whitelist? Or is this kind of thing already happening by the Defender? I have never seen a message saying "Defender does not recognize this application, are you sure you want to start it?" Also there's a lot of downloadable Open Source software where users are asked to "verify the keys". Couldn't Windows do this kind of thing automatically, or at least make it easy?

pigbearpig 5y ago
That's very similar to what SmartScreen is. https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview https://docs.microsoft.com/en-us/windows/security/threat-pro...
- galaxyLogic 5y ago
  That seems very useful especially for web-sites. What I'm thinking of is something where Microsoft would keep a publicly visible registry of all apps that have been submitted to the registry. It would be beneficial for both software produces and Microsoft as the platform producer. The registry would run all kinds of malware checks on it, and also keep an ear out for reports of threats found.

tehdgvtd 5y ago

I read it all, and feel dumber than before. Why the convoluted scripts to get admin? Why execing file with "~3" in the name when you can use the proper one? So much needles silly steps, too little actual explaining of anything that would matter. Also, following that will just ensure you can never download curl or nmap lol. ...i guess, maybe i got the whole thing wrong. Who knows. I don't.

kibwen 5y ago
Ironically, while I agree with the thrust that Windows Defender is basically good enough, I find it extremely dubious for a security-focused article to suggest that anyone should be in the habit of copy-and-pasting arbitrary inscrutable code onto their machine in the service of making it safer.
stinos 5y ago
too little actual explaining of anything that would matter. This. It reads exactly like (suboptimal) code comments or commit messages explaining what gets done but no trace of why. Why does this stuff harden defender? Why does it make Defender enough?
asmr 5y ago
That script is a well known hack to get Pro/Enterprise features on Windows Home version, in this case the Group Policy Editor. Not necessary for most users.

kimown 5y ago

Complete useless and waste cpu/mem/electricity/time

ZYinMD 5y ago

I use my pc 12+ hours a day, haven't installed any 3rd party antivirus software since 2005, and haven't encountered a single problem, because I know what I'm doing. I think all people who read ycombinator should be able to do the same.

dncornholio 5y ago
I haven't used an anti-virus in all of my 20+ years of computering. I've been hit with some minor infections (mostly from torrents, which I knew was not safe). But that's it. Just do a reinstall of Windows every 2-3 months.
- shaunpud 5y ago
  "thinking" meme; If I don't have antivirus, I won't be alerted to it.

Joe_Boogz 5y ago

Can anyone point me to the software that this blog uses? Or if the owner is lurking can you tell me what you use for your site? Looks really good, i'd like to create something similar for my site.

victorstanciu 5y ago
The generator meta tag says it's made with Hexo: https://hexo.io/ https://hexo.io/
h0ek 5y ago
Hello Joe_Boogz, Blog is using Hexo (https://hexo.io/ https://hexo.io/) and a little modified Cactus theme (https://probberechts.github.io/hexo-theme-cactus/ https://probberechts.github.io/hexo-theme-cactus/). If some of the websites looks interesting to you and you would like how they are built you can use Wappalyzer (https://www.wappalyzer.com/ https://www.wappalyzer.com/)
- Joe_Boogz 5y ago
  Thank you!!

AniseAbyss 5y ago

Defender UI is absolutely terrible and keeps deleting things. It is enough for your average user though I'll give it that.

jve 5y ago

Windows Defender also features exploit protection: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/customize-exploit-protection?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/security/defe... And attack surface reduction rules (which you must configure) - which greatly reduces office worker possibility of catching some nasty stuff: Block abuse of exploited vulnerable signed drivers Block Adobe Reader from creating child processes Block all Office applications from creating child processes Block credential stealing from the Windows local security authority subsystem (lsass.exe) Block executable content from email client and webmail Block executable files from running unless they meet a prevalence, age, or trusted list criterion Block execution of potentially obfuscated scripts Block JavaScript or VBScript from launching downloaded executable content Block Office applications from creating executable content Block Office applications from injecting code into other processes Block Office communication application from creating child processes Block persistence through WMI event subscription * File and folder exclusions not supported. Block process creations originating from PSExec and WMI commands Block untrusted and unsigned processes that run from USB Block Win32 API calls from Office macros Use advanced protection against ransomware

icare_1er 5y ago

As a whitehat I can say that the AVs that i found the hardest to bypass was ESET32; Windefender, Kasperky, are just behind.

asmr 5y ago

Created a gist as a reference with all of the powershell commands and some additional info from this thread, such as exploit protection. I'm considering a full script. https://gist.github.com/superswan/1d6ed59e75273f90a481428964be3ae5 https://gist.github.com/superswan/1d6ed59e75273f90a481428964...

deleted 5y ago

[deleted]

HeavyStorm 5y ago

I've never used antivirus (other than defender). AFAICT, I wasn't ever affected by a virus with one exception, the Blaster (or Sasser) worm. This was before Defender existed. On the other hand, whenever I use a machine with an antivirus, I want to quit my job. Those things are slow. Very slow. My work machine has a multitude of security software that I can't disable, heck, I can't even touch. Doing a pip install on a common program takes 10, 15 minutes. The same installation on my personal machine takes about one minute. The culprit? The 3 different agents that spins out of control scanning my disk.

sandylovesa 5y ago

alexklark 5y ago

Microsoft Defender and microsoft security is a unfunny long lasting joke that even beat UAC stupidity. All they do is invent new protection names and is trying to syphon all possible data from the PC it is supposedly protecting. The copy speed of 7gbs ssd is close to 10 mbs because you getti “protected”. Do you want to get protected even more? Enable cloud protection, enable online account protection, want to submit file to our protected protection to get protected? No, oh, in this way you are not protected anymore! But you know, last 5 days of your computer idling, it was scanned 10 times and nothing found. Thats important to know. Oh wait I found a generic.generic in your old keygen music file on CD, you not protected anymore! But i will try to delete it for ever. So much defending, such protection. WOW!