Comment by Wowfunhappy | Hacker News Reader

Comment by Wowfunhappy | Hacker News Reader

Want to Jailbreak your iPhone with unc0ver? You're probably going to go to unc0ver.dev and download unc0ver.ipa for sideloading. However, if you're on Windows 10, you may find that the the ipa file suddenly disappears from your PC as soon as it has finished downloading.

Surprise! Windows Defender detected the Jailbreak and helpfully removed the file to keep you safe! This is not a false positive, Windows Defender literally lists "Jailbreak" as the reason the file is dangerous. Never mind that it's a user-initiated jailbreak for an entirely different, non-Microsoft Operating System!

Repeat the same process on macOS—y'know, the OS from a company that actually has an interest in stopping this stuff. Does unc0ver.ipa get deleted by XProtect? Nope! Apple understands that these systems should only ever be used for actual viruses. To do anything else is a severe betrayal of user trust.

IMO, Windows Defender has jumped the shark, and sadly, I've now resorted to disabling it on all personal Windows machines.

I downloaded the unc0ver IPA just now. Still there. Ran a scan on my downloads folder to see if it gets picked up. Still there. Don't know what the heck is going on with your system shrug

Huh, well I last did this around a year ago, so it may be that an update to either Windows Defender or unc0ver fixed/avoided the problem.

The fact that it happened at all, however, seriously doesn't sit right with me.

> The fact that it happened at all, however, seriously doesn't sit right with me.

It probably detected some of the techniques they used in the file as things used in exploits (since there's little difference in a jailbreak/security exploit from a technical perspective). The fact that it catches is in that case a good thing. That it doesn't catch it anymore might point towards them getting a report that it's a false positive of their automated binary matching, and making an exception to allow it. Apple not catching it could then indicate that either Apple already allowed it, or Apple's exploit detection is less sophisticated and wasn't able to see the problem.

I don't know if that situation is correct, but it seems just as plausible to me, and in that case, Defender is doing exactly what I would want, responded to a report exactly as I would want and expect, and has multiple mechanisms to bypass the initial problem (add folder that's not scanned, disable entirely, etc), and your experience with Apple points towards them either being a little quicker with the exception or just worse at doing what I would want.

If it was a mistake due to overall techniques, why did Windows Defender mark it as a "Jailbreak" as opposed to a trojan or some such? That was the thing that made me really upset, once I saw it.

Possibly because windows offers sandbox capabilities as well, and breaking out of that would be classified as a jailbreak.

Even if someone at Microsoft got overzealous (or a third party reported it), the software is literally designed to find and quarantine exploits (which a jailbreak is), and there are ways to bypass it even if it wasn't apparently reversed later. The item detected is an exploit, just for a different system. It's exactly the sort of false positive I would expect, and the fact that you can work around it without major issues (whether through a special download folder you create and mark as not scanned immediately or temporarily disabling it) is exactly what I would expect.

It's sort of like if you owned a furniture store, and have a security guard to watch it. One night after hours, some guys in street clothes show up in a truck and loiter for a bit before going in the back and starting to take some furniture to the truck. Sure, these guys are your cousins, and are doing stuff on your behalf, but does the guard know that? Did you tell the guard? Would you rather the security guard go stop everything immediately and call you to confirm what's going on, or just shrug and say "eh, it's probably fine"? You're paying them to stop bad stuff, you should expect them to stop bad stuff, and when they find false positives that look like the real thing, that should be reassuring that they're doing their job, not grounds for dismissal.

Apologies for the double reply, but I was curious as to what was going on, so I fired up a VM. It's running Windows 10 Enterprise 1809, because that's what I happened to have lying around.

Downloading the latest version of unc0ver (v5.3.1) does indeed not receive any trouble from Windows Defender.

Then I decided to try an older version of unc0ver, specifically v3.6.3, because it was released around the time I remembered running into this. Sure enough, Windows Defender deleted it for being a "Jailbreak".

(It wasn't even quarantined, just deleted outright, leaving me with no way to restore the file!)

https://i.ibb.co/DMCNHCs/Screen-Shot-2020-08-04-at-2-41-22-P...

So, the problem was fixed, but not on Microsoft's end. And it was not a false positive, because Windows 10 labeled the "threat" accurately.

Reply on news.ycombinator.com