9 ms·
Microsoft Defender was flagging Tor browser as a trojan and removing it
- cj 3y agoAlternative source: https://www.hackread.com/microsoft-defender-tor-browser-win32-malgentmtb-malware/ https://www.hackread.com/microsoft-defender-tor-browser-win3... > Microsoft Defender is detecting the latest version of Tor Browser as malware because it is using a new heuristic detection method that is designed to identify Trojans that use Tor to hide their activity. However, the heuristic method is too broad and also flags the Tor Browser itself as malware. TLDR: Microsoft Defender is identifying any app trying to connect over Tor. The idea is malware sometimes uses Tor network to phone home, so detecting that would be a signal of potential malware. Obviously a false positive for the Tor Browser itself.
- slt2021 3y agothis is what happens when Microsoft's detections team is under pressure to constantly deliver new detections: they will just ship whatever without careful evaluation of FP/TP and broader impact
- TheRealPomax 3y agoThis is what's happened over and over and over, for decades, every time an AV company switched to a new heuristic engine. It has nothing to do with Microsoft being under pressure, this is literally what to expect from AV solutions on the regular. More folks knew this back when AV wasn't tightly integrated into Windows and we all ran at least two different AV applications all the time, but the "a new version is going to flag things it shouldn't" behaviour has been a given for coming up to 50 years now =) (Which is why you set your AV to quarantine, not delete items, so you can overrule it immediately, make it put the data it flagged back where it belongs, and send a false positive report so the next update, which can be as soon as the next day, won't repeat the mistake)
- magicalhippo 3y agoWe use Delphi at work, and virus/malware scanners flagging every Delphi exe as a threat is something that has plagued Delphi for over 20 years. Yes malware was written in Delphi for much the same reasons regular programs were[1], but had low enough exposure that none of the major scanner developers bothered including reference exe's to avoid flagging harmless run-time library code. [1]: https://en.wikipedia.org/wiki/Rapid_application_development https://en.wikipedia.org/wiki/Rapid_application_development
- TheRealPomax 3y agoIn short, "antivirus doing what antivirus has always done". Always set your AV to quarantine rather than blindly deleting data with potential infections, and review what it does, when it does it, so you can say "no, you will put this back" and you report the false positive (if your AV solution doesn't auto-submit that because it can, and it should)
- ferbivore 3y agoIt's been a while since I had to deal with Defender but IIRC the "put this back" option doesn't really work. It would regularly forget exceptions and quarantine binaries again.
- alyandon 3y agoThat's the problem with Windows Defender - Microsoft has basically removed the ability for a normal user to configure it to quarantine instead of auto-remediate (delete). After I caught Windows Defender uploading my places.sqlite in my FF profile "for analysis", I permanently disabled automatic sample submission, auto-remediation, etc via group policies. I still won't use any other AV though because they are generally even worse about making decisions without user input and don't respect group policies at all unless you are an actual enterprise customer.
- monocasa 3y agoYeah, exactly. This almost certainly isn't malicious, simply incompetence. I used to be work on a remote IT administration product. To be completely fair it is a foreign systems component that updated over the Internet with a goofy looking binary if you're expecting MSVC to build everything since that code was written in Go. On the other hand, it was signed properly, and the AV vendors couldn't give two shits about not flagging it despite their customers loudly complaining. It was really rough because when AV would flag this component, IT in a lot of cases couldn't get back in to mend the pieces left.
- LinuxBender 3y agoThere are some sandbox detection's on VT as well FWIW. [1] Some companies pay to ingest data from VT. MS probably had to override the findings in Defender. [1] - https://www.virustotal.com/gui/file/88c33af6f1963eb94683be1fecfada36d17546579098372dcad61ae2137ad7b3/relations https://www.virustotal.com/gui/file/88c33af6f1963eb94683be1f...
- nikanj 3y agoI just wish we told/heared more stories about antivirus being useful. As it stands, anti-malware sounds like the worst malware on the planet.
- bell-cot 3y agoI suspect that the #1 benefit of antivirus is that it makes success, especially more-than-shortlived success, far more difficult for Team Evil. (Yes, obviously it would be difficult at best to quantify that benefit.)
- TheRealPomax 3y agoSo go looking for it. Good news doesn't make the news, it makes people's blogs. Go google for folks talking about how they didn't get their entire network crypto-locked with bitcoin ransoms because their AV did its job. The stories are out there, they're just not delivered to your doorstep because there's no sensationalism in them with which to sell clicks and ad impressions.
- udev4096 3y agoAV at it's best prevents script kiddies. It is ridiculously easy to bypass an AV. However, most of the organizations rely on EDRs, not AVs
- charcircuit 3y agoAVs help prevent malware from scaling. Sure you can bypass an AV to hack O(10) pole, but can you bypass it to hack O(1000000) people?
- fullspectrumdev 3y agoThe scaling problem isn’t that hard with traditional signature based AV, the upfront work is largely the same irrelevant of scale of infections. You just keep updating your obfuscator/packer tool and constantly deploy new, undetected binaries. There’s online “crypter” services which are quite cheap that will do this for you - give you a constant stream of new, unique, undetected versions of your malware executable. AV is basically very good at blocking yesterdays threats - the shit it knows about. Professional blackhats just factor constant evasion into their operating costs (which includes other costs like new C&C domains, VPS’s, buying traffic for installs. etc) anyway.
- flotzam 3y agoflagged, past tense: https://forum.torproject.org/t/torbrowser-12-5-6-no-longer-flagged-by-windows-defender/9522 https://forum.torproject.org/t/torbrowser-12-5-6-no-longer-f... "With the latest signature database (1.397.1910.0), tor.exe is no longer considered a trojan by Windows Defender."
- neilv 3y agoJust because the car eventually rolled off the pedestrian, doesn't mean there's no news story. Reportedly, mass removal of Tor Browser happened, and damage is done: a lot of privacy/security stuff disabled, couldn't be used, some won't be reinstalled, there's extra vulnerability at reinstallation time, etc. And the demonstration that Microsoft can easily do this is of interest to people tho don't want that kind of thing to happen, as well as to people who would like that capability. Also, this is Microsoft actively removing a competing Web browser (after long ago being put on notice about sneakiness around competing browsers specifically).
- henriquez 3y agoI love outrage as much as the next edgelord but a) you can turn off Windows Defender if you don’t like it, b) false positives are a fact of any antivirus program, and c) Microsoft corrected it faster than you could even post. You are failing to make it seem like Microsoft acted in bad faith here. Comparing this to running cars over people is hyperbolic.
- neilv 3y agoI didn't say it was bad faith. Responding to the call to flag the post, I gave examples of impact, and why it's newsworthy and the post shouldn't be flagged just because Microsoft stopped the behavior after the damage had been done.
- vore 3y ago"this is Microsoft actively removing a competing Web browser" is definitely an allegation implying more bad faith than just Windows Defender had a false positive...
- neilv 3y ago> Windows users [...] for those wanting to ensure their online privacy. There's a bigger problem, right there. Tor Browser running on especially untrustworthy platforms should warn the user.
- c22 3y agoIt'd be great if more enduser software recognized Windows as a trojan and removed it.
- chx 3y ago[flagged]
- _cenw 3y agoOnline privacy is not an absolute and I wish we'd start threat modeling instead of mindlessly calling entire platforms compromised.
- neilv 3y agoI said "especially" because all the platforms have weaknesses, but some of the platforms are worse than others.
- ugjka 3y agoTried to give Windows 10 a shot a year or 2 ago but quickly went back to Linux because my dev env was much slower because defender constantly scans everything
- Filligree 3y agoAlso because NTFS is just... slow.
- dralley 3y agoNTFS isn't especially slow, the Windows filesystem layer as a whole is slow. All those layers of abstraction that allow for things like automatic security scanning of opened files don't come cheap.
- ynik 3y agoFun fact: NTFS on C: is extra slow. A Python script creating 10000 empty files takes 1.2s on C:, but only 0.5s on D:. Both are NTFS partitions on the same SSD, both partitions are using the default settings. (but the defaults differ: on the system drive Windows enables compatibility features such as 8dot3names, on additional partitions it does not)
- nixgeek 3y agoYou might want to check this out! https://devblogs.microsoft.com/engineering-at-microsoft/dev-drive-and-copy-on-write-for-developer-performance/ https://devblogs.microsoft.com/engineering-at-microsoft/dev-...
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- tssva 3y agoYou could have just disabled scanning of your dev env or disabled Defender completely.
- anonymfus 3y agoIs there an estimation what share of users was affected? I. e. how long mistaken heuristic was enabled compared to how often Defender checks heuristic updates?
- justsomehnguy 3y agoYesterday I helped in an 'investigation' why a remote WinSvr2012R2 VM with a public IPv4 is no longer allows logging in. To no one's surprise it was hacked, but what was quite amusing is what the hacker wannabe installed... RDPGuard to protect 'his' machine from other hacker wannabees. Also years ago mIRC was a popular component of the Windows 'rootkits' because it has control and communications built-in. Yes, Tor is used by malware to securely communicate so it's no wonder it can trigger AV. Refer to [0] for details. https://news.ycombinator.com/item?id=37740584 https://news.ycombinator.com/item?id=37740584
- supriyo-biswas 3y agoI'm more worried about the fact that the antivirus industry hasn't gone the way of the dodo due to EDR systems, which emit warnings based on behavioral analysis instead of moving stuff to quarantine just because it happened to see a pattern of bytes in the binary.
- SirMaster 3y agoI hate it. My little hobby projects that I write end up getting flagged by all these ML AV systems and I don't seem to have any recourse against it as a developer. It causes issues and general confusion by my albeit small communiy of users.
- Joker_vD 3y agoI once got my own program falsely detected as virus while developing it. It was such a bizarre experience: you press "Run" in the Visual Studio, it apparently builds successfully but then it can't run because the executable does not exist. Huh? Anyhow, it turned out that apparently my hand-coded base64-decoder was sufficiently similar to a base64-decoder used in some trojan out there (which was apparently built with the same version of MSVC): removing/sufficiently rewriting my decode_base64 function made the detection go away reliably. So yeah, I believe now that those virus signatures are quite arbitrary in nature.
- _cenw 3y agoThat'd be great if hardware vendors didn't use dirty hacks to control their devices. One of my laptops fan control software still requires an open source kernel driver that someone else once used to setup a bootkit in EFI, so now I have to run with vulnerable driver blocklist off forever.
- c7DJTLrn 3y agoSuch systems are even more useless than hash/pattern matching scanners. I've had CrowdStrike on my machines before and it would've had no qualms with me exposing root-level access over an RPC interface.
- helloooooooo 3y ago
- fortran77 3y agoI use Windows 11 on all my computers here, and run the Tor browser on my desktop and my laptop, and haven't seen this. In fact, I ran the Tor browser just this morning. I think this was, at worst, a temporary issue that was resolved.
- readyplayernull 3y agoAlso, it's still not possible to just download Firefox and install without getting a "something went wrong, start over" sort of message in Windows 11, forcing you to install from their store, so they can kill it at anytime with their "oopsie" switch. How is Microsoft not being sued for that?
- tapland 3y agoI'm running Firefox on multiple Windows 11 installs (both at home and work), and never installed it from the store. Latest one fresh a few weeks ago using an account that hasn't had Win11 before. Are there other things affected by this?
- tssva 3y agoI have never experienced this installing Firefox. To double check I downloaded Firefox from getfirefox.com and installed it on a Windows 11 machine after reading your comment. It installed without issue.
- deleted 3y ago[deleted]
- akwehr 3y agoI'm not sure that's true, generally. I've set up Win11 several times in the past few months. My first step is always to run Edge and use that to search for and download Firefox, and I've never had problems.
- wnevets 3y agoI've never seen that happen. Are you sure that is a common experience?
- birdman3131 3y agoI will admit that my go to is ninite as my only visit on edge but never had an issue installing Firefox.
- deleted 3y ago[deleted]
- diath 3y agoI hate Windows Defender, every time I roll out an update for our relatively small video game, it often ends up being flagged and removed from our players' computers, we then have to submit the file to Microsoft to get it unflagged. What's funny is that the instructions say to upload an entire package with all the files necessary to run the application, but in my experience I can file for a false positive, upload just the .exe, and get someone to unflag it the next day, it's tiresome.
- remram 3y agoAnd then you have to deal with all the other antivirus vendors... it's so tiresome. See also this helpful list (getting out of date unfortunately): https://github.com/hankhank10/false-positive-malware-reporting https://github.com/hankhank10/false-positive-malware-reporti...
- psyclobe 3y agoCost of doing business in this hell hole of a platform
- no_time 3y agoOr you drop ~800$/yr on an EV codesigning cert to switch your binaries from "malware unless proven otherwise" to "harmless until proven otherwise". It's basically a protection racket.
- efitz 3y agoI used to work on an anti malware team. There were two controversial issues that related to that work that I want to bring up here. First, what is malware? It’s actually very hard to define in such a way that makes everyone happy. The line gets really blurry on the border of nuisance vs malicious, and on security tools, which might do things in the name of privacy that malicious software might do to hide its tracks. The other issue is false positives. We tried really hard to avoid false positives; we ran tests with known good binaries to see if they were inappropriately detected, etc. We feared false positives more than false negatives. I am sure that the MS antimalware team is having a bad day and not acting in bad faith.
- stronglikedan 3y agoI don't believe they're acting in bad faith either, and certainly nothing is being removed it from the system as the clickbait title implies. The user has the option to stop if from being removed, and the team recommends "adding Tor to Microsoft’s protection software exclusion list and restoring “tor.exe” from quarantine if Defender affected Tor’s operation". Seems perfectly reasonable to me.
- jj999 3y agoCan there be legal liability with anti malware? By example, could flagging some software as malware expose you to being sued for libel?
- horsawlarway 3y agoThis is getting down voted and I'm not sure why. Google has flagged some of my personal domains as "deceptive login" (why: I could not fucking tell you... they give no info, and my logs show absolutely nothing going on. My best guess is I used chrome auto fill in them while testing letsencrypt staging certs after switching cert providers) But... they are very clearly publishing info claiming my site is malicious, and it's not. It seems like a super clear case of libel, which I won't pursue because it's personal sites and I'm not losing revenue or anything, but it seems open and shut. It's not even exempt due to general section 230 clauses. It's not user content. It's just them.
- deleted 3y ago[deleted]
- heavyset_go 3y agoNot saying this is the case here, but in the hands of dictatorial regimes, systems like Microsoft Defender, Play Protect, Gatekeeper, etc, can be used to expose and silence critics, dissidents, and persecuted groups. A corporate-enforced inscrutable system that uses cryptography and OCSP to potentially remotely approve and deny what users run on their machines would be coveted by leaders who want to crackdown on their constituents.
- einpoklum 3y agoWell, it is the _Microsoft_ defender after all, not the _user_ defender, isn't it?
- m00dy 3y agoit is surprising to see that people are still into windows.
- soupfordummies 3y agoSomewhat relatedly: About 2 months ago, Microsoft Defender's Enterprise web filter started blocking all requests to the Brave browser domain including their search. I've brought this up in a couple places and I've only gotten vague responses about how Brave supposedly had "malware" a couple years ago. That still does little to explain the recent addition to the blocklist, however.
- JdeBP 3y agoI find this amusingly coincidental the same week that I have been fighting with Microsoft Windows Defender suddenly flagging all installers made by Caphyon's Advanced Installer as trojans.
- distract8901 3y agoHad a lovely experience with this a few months ago. I built a little WPF GUI as an internal tool for my company. Literally all it does is read some data from an XML file and squirt some bytes out of a serial port. I zip up a build and send it over to the production team and windows refuses to open it. It absolutely insists it's a Trojan or something. Fortunately there's an option to ignore Defender and keep doing our jobs. I submitted the build to Microsoft for verification and it reports totally clean. Gee, thanks. We also get Defender warnings for anything that isn't signed. We also get Defender warnings for things that are signed. Apparently we have to pay an extra couple hundred dollars a month for the "real" signing certificate. The one we already pay for apparently isn't secure enough to disable Defender warnings? Sounds like an absolute racket to me
- oldbbsnickname 3y agoThe issue of MDE EP2 is that they roll-out signature-based definitions to all fleets of all customers with what appears to be insufficient testing. This led to a situation where it decided to delete all of the shortcuts to apps, leading end users to believe all of their apps were removed. If there is malware on a machine, it's already compromised and needs to be reimaged rather than selectively, haphazardly repaired through so-called "remediations". There should be no malware on a machine to begin with by disallowing running random software from untrusted sources. Signature-based anti-malware is a last line of defense, reactive security often unable to prevent a machine from being compromised as it already happened. Another issue is that only a fraction of malware ever has signatures for them by either being too new or not widely seen. A final problem is mis-categorizing things as "malware" when they do no harm but do things certain factions of people don't like: remote control, recover passwords, and pirate keygens.