9 ms·

It's not just mozilla, been working defender issues for the last few years on thousands of windows vm's. Mostly due to the enabling the more intensive heuristic

It's not just mozilla, been working defender issues for the last few years on thousands of windows vm's. Mostly due to the enabling the more intensive heuristic real time engine and they have different code bases depending on versions installed on different windows builds, and patching does seem to trigger it. For months we had issues where we couldnt log into some vm's due to high cpu for defender, and had to bounce the vm and apply a temp defender fix. I think its a growing issue, as they mature/migrate their older code base, issues become less frequent.

psychphysic 4y ago
I have malwarebytes premium and defender CPU usage is nearly 100% at times bringin Firefox to a halt. Chrome works fine..I've been blaming Firefox so far.
- Yoric 4y ago
  In my experience (as a former Firefox dev), antivirus / antimalware software are really poorly behaved. They tend to: - require admin rights (which means that if they have vulnerabilities, it can take control of the entire machine, even if Firefox itself is sanboxed); - monkey-patch the Firefox executable in memory, which works (when it does) as long as the version of the software tracks closely the version of Firefox, which may or may not be the case; - ... and also decreases the memory-safety of Firefox, which makes it easier to pwn; - ... and also makes the crash reports unreliable; - install encryption certificates that are actually less trustworthy than Mozilla's, hence decreasing the security of https; - block Firefox and add-on security updates, also decreasing security; - install privileged add-ons, many of which are easy to exploit from any webpage; - ... Part of the work on Crash Scene Investigations was attempting to determine whether the crash was in Firefox or in code or in some bogus foreign code. Depressingly often, it was the latter. In your case, it's entirely possible that malwarebytes was simply untested on Firefox.
  - genocidicbunny 4y ago
    > - monkey-patch the Firefox executable in memory, which works (when it does) as long as the version of the software tracks closely the version of Firefox, which may or may not be the case; This one was a frustratingly common cause of crashes when I worked in gamedev. So many crashes would end up being some overlay or antivirus monkeying about with memory.
  - jbritton 4y ago
    I had always assumed that one application could not touch the memory of another application. Does running as Admin allow breaking this boundary?
    - codedokode 4y ago
      This is wrong, on Windows there are system calls to access memory of other process and on Linux you can do it using debugging. Also on Windows there is a tradition to inject libraries into other processes, create threads in processes etc.
      - account42 4y ago
        On Linux, ptrace permissions can be restricted [0] and some distributions do this by default. Whether this provides any meaningful security is questionable unless you pair it with filesystem isolation to prevent malicious programs from modifying config files / bashrc / etc. Meanwhile it does make legit uses of ptrace more annoying. [0] https://www.kernel.org/doc/Documentation/security/Yama.txt https://www.kernel.org/doc/Documentation/security/Yama.txt
    - rootw0rm 4y ago
      Yes. However, I think parent process can gain access to child process memory without admin rights.
      - insanitybit 4y ago
        All that's generally required is being the same user at the same or higher integrity.
    - genocidicbunny 4y ago
      Yes, in general on Windows processes with higher privilege levels can get access to read/write another processes memory, or even inject code into them. And even Admin-level processes can still be broken into by something running as a service with even more elevated privileges like NT AUTHORITY\SYSTEM. This has long been a leaky part of Windows security. If your malware can get its code running inside a highly privileged service or process, it can do more or less whatever it wants to the rest of the system. But even when not used for nefarious purposes, it is still an extremely dangerous capability in that it can be very easy to create problems .
  - bboygravity 4y ago
    This almost reads like Defender makes machines less secure on purpose. Makes me wonder: Does windows Defender just double as another deliberate NSA backdoor?
    - tsujamin 4y ago
      Pretty sure Defender is one of the few anti malware/edr that doesn’t need to do this, because it’s so tied to the platform. 3rd party antimalware and EDR are much more likely to inject hooks and dlls into other processes
    - foepys 4y ago
      Why would Microsoft need to put a NSA backdoor specifically into Defender when it could put it anywhere else into Windows with their monthly patch? It doesn't make sense to single out Defender. The same is valid for Apple, Google, and every other US company.
  - mschuster91 4y ago
    > - install encryption certificates that are actually less trustworthy than Mozilla's, hence decreasing the security of https; Given that in many industries insurances and, in some cases like banking, the law requires companies to monitor HTTPS traffic of browsers for compliance, it might be better if browsers had a dedicated filter / monitor API.
    - Yoric 4y ago
      WebExtensions definitely have such an API. That's how AdBlock, uBlock, etc. work.
  - maccard 4y ago
    > Part of the work on Crash Scene Investigations was attempting to determine whether the crash was in Firefox or in code or in some bogus foreign code. Depressingly often, it was the latter. A shockingly large number of crashes and performance issues in PC gaming are related to poorly behaved overlay programs and overclocking tools like RivaTuner, Overwolf, and the Discord Overlay. I'd well believe your points.
- gcp 4y ago
  Did you report this on Bugzilla? Even if it's not Firefox's fault if you don't report it no-one knows about the issue. Recent versions of Firefox allow you to block some stuff like that: https://support.mozilla.org/en-US/kb/identify-problems-third-party-modules-firefox-windows#w_block-modules-that-cause-firefox-to-crash https://support.mozilla.org/en-US/kb/identify-problems-third... Though it's possible they use different code injection tricks to make blocking impossible. (You can't block Defender from listening to events for example)
- rejectfinite 4y ago
  I am on Windows 10, Malwarebytes premium and using Firefox Nightly on Youtube right now and it is using miniscule CPU and has so for a long time. On a i7 4790k desktop machine. Firefox itself is at 4-5% and the whole machine is at 14% Normal Firefox was also fine last I used it.

psychphysic 4y ago

I have malwarebytes premium and defender CPU usage is nearly 100% at times bringin Firefox to a halt. Chrome works fine..I've been blaming Firefox so far.

Yoric 4y ago
In my experience (as a former Firefox dev), antivirus / antimalware software are really poorly behaved. They tend to: - require admin rights (which means that if they have vulnerabilities, it can take control of the entire machine, even if Firefox itself is sanboxed); - monkey-patch the Firefox executable in memory, which works (when it does) as long as the version of the software tracks closely the version of Firefox, which may or may not be the case; - ... and also decreases the memory-safety of Firefox, which makes it easier to pwn; - ... and also makes the crash reports unreliable; - install encryption certificates that are actually less trustworthy than Mozilla's, hence decreasing the security of https; - block Firefox and add-on security updates, also decreasing security; - install privileged add-ons, many of which are easy to exploit from any webpage; - ... Part of the work on Crash Scene Investigations was attempting to determine whether the crash was in Firefox or in code or in some bogus foreign code. Depressingly often, it was the latter. In your case, it's entirely possible that malwarebytes was simply untested on Firefox.
- genocidicbunny 4y ago
  > - monkey-patch the Firefox executable in memory, which works (when it does) as long as the version of the software tracks closely the version of Firefox, which may or may not be the case; This one was a frustratingly common cause of crashes when I worked in gamedev. So many crashes would end up being some overlay or antivirus monkeying about with memory.
- jbritton 4y ago
  I had always assumed that one application could not touch the memory of another application. Does running as Admin allow breaking this boundary?
  - codedokode 4y ago
    This is wrong, on Windows there are system calls to access memory of other process and on Linux you can do it using debugging. Also on Windows there is a tradition to inject libraries into other processes, create threads in processes etc.
    - account42 4y ago
      On Linux, ptrace permissions can be restricted [0] and some distributions do this by default. Whether this provides any meaningful security is questionable unless you pair it with filesystem isolation to prevent malicious programs from modifying config files / bashrc / etc. Meanwhile it does make legit uses of ptrace more annoying. [0] https://www.kernel.org/doc/Documentation/security/Yama.txt https://www.kernel.org/doc/Documentation/security/Yama.txt
  - rootw0rm 4y ago
    Yes. However, I think parent process can gain access to child process memory without admin rights.
    - insanitybit 4y ago
      All that's generally required is being the same user at the same or higher integrity.
  - genocidicbunny 4y ago
    Yes, in general on Windows processes with higher privilege levels can get access to read/write another processes memory, or even inject code into them. And even Admin-level processes can still be broken into by something running as a service with even more elevated privileges like NT AUTHORITY\SYSTEM. This has long been a leaky part of Windows security. If your malware can get its code running inside a highly privileged service or process, it can do more or less whatever it wants to the rest of the system. But even when not used for nefarious purposes, it is still an extremely dangerous capability in that it can be very easy to create problems .
- bboygravity 4y ago
  This almost reads like Defender makes machines less secure on purpose. Makes me wonder: Does windows Defender just double as another deliberate NSA backdoor?
  - tsujamin 4y ago
    Pretty sure Defender is one of the few anti malware/edr that doesn’t need to do this, because it’s so tied to the platform. 3rd party antimalware and EDR are much more likely to inject hooks and dlls into other processes
  - foepys 4y ago
    Why would Microsoft need to put a NSA backdoor specifically into Defender when it could put it anywhere else into Windows with their monthly patch? It doesn't make sense to single out Defender. The same is valid for Apple, Google, and every other US company.
- mschuster91 4y ago
  > - install encryption certificates that are actually less trustworthy than Mozilla's, hence decreasing the security of https; Given that in many industries insurances and, in some cases like banking, the law requires companies to monitor HTTPS traffic of browsers for compliance, it might be better if browsers had a dedicated filter / monitor API.
  - Yoric 4y ago
    WebExtensions definitely have such an API. That's how AdBlock, uBlock, etc. work.
- maccard 4y ago
  > Part of the work on Crash Scene Investigations was attempting to determine whether the crash was in Firefox or in code or in some bogus foreign code. Depressingly often, it was the latter. A shockingly large number of crashes and performance issues in PC gaming are related to poorly behaved overlay programs and overclocking tools like RivaTuner, Overwolf, and the Discord Overlay. I'd well believe your points.
gcp 4y ago
Did you report this on Bugzilla? Even if it's not Firefox's fault if you don't report it no-one knows about the issue. Recent versions of Firefox allow you to block some stuff like that: https://support.mozilla.org/en-US/kb/identify-problems-third-party-modules-firefox-windows#w_block-modules-that-cause-firefox-to-crash https://support.mozilla.org/en-US/kb/identify-problems-third... Though it's possible they use different code injection tricks to make blocking impossible. (You can't block Defender from listening to events for example)
rejectfinite 4y ago
I am on Windows 10, Malwarebytes premium and using Firefox Nightly on Youtube right now and it is using miniscule CPU and has so for a long time. On a i7 4790k desktop machine. Firefox itself is at 4-5% and the whole machine is at 14% Normal Firefox was also fine last I used it.