3 ms·

Microsoft upgrades Defender to lock down Linux devices for their own good

23 points by LinuxBender 4y ago

rolph 4y ago
the balkan state of microsoft casts its shadow over this. if you flip the coin it looks like lets blacklist linux devices from using services or resources that hop through a Defender firewall. why would this be limited to enterprise LAN and not eventually be adopted to blacklist linux based devices over home internet connections? how does this not disable intentional honeypots, or holes, critical to threat response?
- jonathantf2 4y ago
  It's a feature of EDR products, it lets IT isolate a device from the network to stop malware hitting other devices on the network. If you so wanted you could build a firewall that blocked all Linux devices based on something like Nmap's OS detection.
- waste_monk 4y ago
  Our corporate overlords IT folk have turned on conditional access in our shared tenancy and only allow domain-joined Win10 devices to access M365 resources, so our Linux users are already blacklisted from many useful things. If this could eventually allow Linux devices secured by defender to become "blessed" and pass conditional access it would make my life a lot easier.
rejectfinite 4y ago
Yes? A good EDR should do this. Pretty sure Sentinelone and Crowdstrike does this too? This is for company equipment that may need this.
stonogo 4y ago
"Microsoft recommends that enterprises use a split-tunneling VPN for cloud-based traffic for both Defender for Endpoint and Defender Antivirus." Breathtaking. Just double the complexity of the host networking, opening up all-new attack services, so our IPS can phone home! It's a shame that Defender for Endpoint is really the only game in town, but if anyone is looking for a massive untapped market, a competent runtime security daemon would sell. White House cybersecurity EOs and current DISA guidance mandate such tools, and almost none of them run on Linux. Those that do focus on kubernetes security or the like; there are almost no options for bare-metal Linux.
somat 4y ago
The openbsd pf has an "os" keyword that lets you police packets based on tcp syn fingerprinting. block out on $ext_if proto tcp from any os "Windows" http://man.openbsd.org/pf.conf#OPERATING_SYSTEM_FINGERPRINTING http://man.openbsd.org/pf.conf#OPERATING_SYSTEM_FINGERPRINTI...

23 points by LinuxBender 4y ago

the balkan state of microsoft casts its shadow over this. if you flip the coin it looks like lets blacklist linux devices from using services or resources that hop through a Defender firewall. why would this be limited to enterprise LAN and not eventually be adopted to blacklist linux based devices over home internet connections? how does this not disable intentional honeypots, or holes, critical to threat response?

jonathantf2 4y ago
It's a feature of EDR products, it lets IT isolate a device from the network to stop malware hitting other devices on the network. If you so wanted you could build a firewall that blocked all Linux devices based on something like Nmap's OS detection.
waste_monk 4y ago
Our corporate overlords IT folk have turned on conditional access in our shared tenancy and only allow domain-joined Win10 devices to access M365 resources, so our Linux users are already blacklisted from many useful things. If this could eventually allow Linux devices secured by defender to become "blessed" and pass conditional access it would make my life a lot easier.

rejectfinite 4y ago

Yes? A good EDR should do this. Pretty sure Sentinelone and Crowdstrike does this too? This is for company equipment that may need this.

stonogo 4y ago

"Microsoft recommends that enterprises use a split-tunneling VPN for cloud-based traffic for both Defender for Endpoint and Defender Antivirus." Breathtaking. Just double the complexity of the host networking, opening up all-new attack services, so our IPS can phone home! It's a shame that Defender for Endpoint is really the only game in town, but if anyone is looking for a massive untapped market, a competent runtime security daemon would sell. White House cybersecurity EOs and current DISA guidance mandate such tools, and almost none of them run on Linux. Those that do focus on kubernetes security or the like; there are almost no options for bare-metal Linux.

somat 4y ago

The openbsd pf has an "os" keyword that lets you police packets based on tcp syn fingerprinting. block out on $ext_if proto tcp from any os "Windows" http://man.openbsd.org/pf.conf#OPERATING_SYSTEM_FINGERPRINTING http://man.openbsd.org/pf.conf#OPERATING_SYSTEM_FINGERPRINTI...