6 ms·
The most invasive but effective way I've found to disable Defender is to boot into a live Linux USB, rename "C:\ProgramData\Microsoft\Windows Defender", and cre
by nyanpasu64 1y ago
The most invasive but effective way I've found to disable Defender is to boot into a live Linux USB, rename "C:\ProgramData\Microsoft\Windows Defender", and create an empty file in its place.
- keepamovin 1y agoIt's weird that windows wouldn't have a signed manifest that would detect that
- vachina 1y agoYou can also disable Windows Update entirely by taking ownership of wuaueng.dll and .exe. It’s the only effective method on Windows Home.
- subscribed 1y agoBut disabling updates on the system connected to the Internet is a terrible idea. How do you update that afterwards?
- vachina 1y agoBy reinstating the ownership of those files.
- londons_explore 1y agoSince the rest of the world updates their PC's, malware authors rarely focus on exploiting older versions. Both Chrome and Windows are now in that position. Basically, unless you are of interest to state level attackers, in 2025 even unpatched Chrome/Windows wont get drive by exploited.
- eru 1y agoThat seems like pretty sketchy reasoning. Like leaving your door unlocked, because you live in such a sketchy neighbourhood that everyone else always locks their doors.
- hansbo 1y agoMore like, continue living in a sketchy neighbourhood because all the thieves go to the newer, more polished neighbourhoods anyway.
- TeMPOraL 1y agoIt would make sense if the cost/danger for the thieves to check every door would be prohibitive. Unfortunately, with networked computers, checking the doors is usually both riskless and effectively free.
- eru 1y agoAnd turning off your old door checker, just because someone fixed the vulnerability in the latest version, is probably more hassle than it's worth.
- LoganDark 1y agoActually riddle me this: what if you want to exploit exactly the type of person to disable updates? They are potentially more lucrative targets if nobody else targets them. Just a thought. It's sort of how "delete me" services profit off paranoia, they're a lucrative market because of the paranoia.
- perching_aix 1y agoWould suck if an exploit was present for years, sometimes decades. Would especially suck if people piled up old exploits and fell back on them as needed.
- nsteel 1y agoImagine if this was all automated, even scripted, so even kiddies could do it, or others with almost zero security knowledge. I'd really, really like to think most of us don't follow this terrible security practice based on a bad premise.
- shakna 1y agoThere are still active attacks against DOS and Win98. Automated driveby attacks, just looking to increase the size of a bot farm. There are still new exploits being released against rather old systems.
- Sesse__ 1y agoNow I'm curious, how do you attack DOS? I mean, it comes without networking support, and if you have local access, you're already privileged.
- leeter 1y agoYou attack the networking stacks for it, those are still actively developed (mTCP was last updated Jan 2025) as businesses use networked DOS for quite a few things. A DOS networking stack consists of a packet driver, a NIC driver, and a protocol library. All of those have attack surface. NIC drivers in particular often haven't really had updates since they were first released. Because for hardware manufacturers of the time the goal was on getting people to use the hardware, not on supporting them. There are newer DOS NIC drivers than you'd think too. Realtek last I checked still makes and supports an ISA NIC.
- Sesse__ 1y agoSo you are not talking about attacking old code at all, but networking stacks that are indeed actively developed? That feels like a very different ball game from attacking Win98, even if the platform they are running on top of is old.
- leeter 1y agoIt's a complicated space. There are attacks on both maintained and unmaintained stacks. There are definitely attacks against windows 95/98 too because people have things like mills or other industrial automation that are powered by those OSes still connected to the internet. There is a lot of SCADA[1] too that fits that bill. It's easy to think "but why wasn't this replaced!" and the answer is almost always "cost or process certification". If the operator is lucky and has good networking folks all of this is in a very very well firewalled VLAN. But, never underestimate the amount of people that are not that savvy and just have it plugged into the internet. For anyone saying these aren't targets, no they are probably already hacked. These are the things that keep the national security folks up at night knowing an adversary has them already backdoored and set up for take down. Moreover if they execute on that they would go for maximum damage first to either create chaos, or prevent the system from being repaired easily. [1]https://en.wikipedia.org/wiki/SCADA#Security https://en.wikipedia.org/wiki/SCADA#Security
- ZiiS 1y agoEverything was a zero-day at one point in time. The effort is indeed usually put in whilst it is the current version. But retying all old malware isn't effort; it is more or less the definition of script-kiddy (though state level attackers will do it too).
- p_ing 1y agoPath traversal attacks against IIS (or any web server) are still routine yet those were fixed back in the Win 2K days. Your thought process is not correct.
- kjs3 1y agoThose of us who actually do this stuff for a living still routinely see probes for Slammer, Zotob, Blaster and more from when we booted our computers by rubbing two sticks together.
- stuffoverflow 1y agoI have yet to see concrete evidence that disabling Windows update and windows defender would elevate risk of having the system compromised in any meaningful way. I installed Windows 10 2016 ltsc on a VM at the end of last year out of curiosity to test that. Disabled wupdate and defender before letting it access the internet so that it was basically 8 years behind on any updates. I tried browsing all kinds of sketchy sites with Firefox and chrome, clicking ads etc. but wasn't able to get the system infected. I would guess that keeping your browser updated is more important.
- keepamovin 1y agoCorrect! The browser is now the key vector because it's the most promiscuous and lascivious-for-code-and-data software on most devices. Browser-zero days are why I factored out a way to distribute "web RPA agent creation" on any device, with no download - into its own product layer for browser-isolation. It's a legitimate defense layer but main barriers to adoption are operating friction, even tho it makes the task of hackers who want to compromise your network with browser 0-days much harder. Because of that the RBI aspect is not as popular as ways its being used where you need a really locked down browser, with policies for preventing upload/download, even copy and paste, etc - for DLP (data loss prevention), for regulated enterprises. Even so I think the potential applications of this tech layer are just starting.
- amne 1y agoJust the other day I went to a website to flash a new firmware on a zigbee dongle. Straight from a chrome tab. wild! Then it hit me: the only thing keeping a rogue website from sweeping your entire life is a browser's permissions popup.
- keepamovin 1y agoCrazy right? On the whole I think it’s great and wonderful that the web platform has grown into the gorgeous monster that it is. I mean what better than a unified technology to serve us all the worlds information from any device in a basically sandboxed environment. I’m even all for the beautiful way The platform has developed rapidly added capabilities on how the language JavaScript HTMLNCSS has evolved. I think all that is wonderful. And I really enjoyed the ride. But all of that growth and integration comes with these vulnerabilities, and so the cyber and DLP control aspect of web browsers is a very important one. If this resonates with you, i invite you to check out my company’s project BrowserBox on GitHub
- da_chicken 1y agoIt does have that. Windows uses code signing and either DISM or SFC to do that. But this isn't about the binaries. It's where definitions and configuration are stored. It's C:\ProgramData, not C:\Program Files. The system also can't object too severely. Third party endpoint protection exists.
- nyanpasu64 1y agoThis is about the binaries. I first tried renaming the folder in Program Files, but Defender still kept eating RAM and CPU resources which were scarce on a 12-year-old laptop.
- arghwhat 1y ago> Third party endpoint protection exists. much to everyone's dismay. :/
- keepamovin 1y agoMy bad. You correctly understood my mistake here. I assumed it was clobbering a binary
- 71bw 1y agoGroup policies still work so effectively that I've set up a local domain using a controller in my homelab that does nothing but change the defender policies automatically for all users.
- devwastaken 1y agogroup policy no longer works on win11. updates will reverse it. additionally defender detects turning off realtime monitoring as malware.
- 71bw 1y agoAnd yet I have none of these issues on 11 LTSC 24H2? Sounds like you forgot to disable Tamper Protection
- OsrsNeedsf2P 1y agoAs someone who moved to Linux 10 years ago, this comment chain shows Windows became the real hacker distro
- animuchan 1y agoIn a sense, it has been for a long time. With Linux, there's often a good clean way to do a thing, and then there are weird hacks. On Windows, it often starts with weird hacks, as Microsoft is further enclosing its ecosystem. (I use Windows mostly for gaming and VR, and still have to constantly fiddle with the system to keep it working on a basic level, sad face emoji. Who would've thunk that merely playing a 8K European documentary in VR would require configuring DirectShow filters found on GitHub.)
- SSLy 1y ago> Who would've thunk that merely playing a 8K European documentary in VR would require configuring DirectShow filters found on GitHub. Dios Mio, get mpv, enable gpu-hq
- ForOldHack 1y agoThat is basically how a popular product does it,while taking down about 25% of the entire internet...
- stuckkeys 1y agoI see what you did there.
- noisem4ker 1y agoAre you talking about the recent CrowdStrike screwup?