Hacker News Reader

Comment by grishka | Hacker News Reader

At this point I'm convinced that the entire antivirus industry is a scam scheme for the most part. They make everyone suffer for their own profit.

Users are scared into installing this crap and paying recurring payments for it, and then the performance of their computer goes to shit. Developers are given nightmares by having their software misdetected as a virus or broken by the antivirus changing the OS behavior in unexpected ways.

View on HN

A while ago I caved in and purchased and installed Bitdefender, which I knew was all right.

It wasn't. I didn't renew the license and uninstalled it.

FFWD a couple years and my best friend upgrades his PC. Threadripper Zen 2, 128GB RAM, 2x NVME RAID 0 for the system, another NVME for stuff and HDDs for backups. System was incredibly sluggish and unresponsive and his extra NVME was sometimes dropping from the list of drives shown by explorer. Uninstalled his Bitdefender and all the issues disappeared.

It's just complete robbery at this point. Malwarebytes is a good product for example and Windows Defender is enough. But the best stuff is disabling all of these and just use script blockers and safe browsing practices and you get to keep all the processing power you paid for.

BitDefender is one of the bigger scams out there. I wholly believe that they operate based on a "blacklist everything first" policy, because that lets them tout their 99,99% detection rate.

I run a big open source project and the amount of people that complain to us about BitDefender deleting our software is staggering.

Bitdefender has a good false positive rate though according to av comparatives, in contrast to norton which has the most

https://www.av-comparatives.org/tests/real-world-protection-...

Well, let's take it from a different angle: We don't need malwares but AV vendors do. If there were no malwares, there would be no AV vendors too.

Ransomware is a real problem. I despise malware disguised as mainstream antivirus solutions, but we need to protect users from ransomware and that’s a tough problem. I am working in that space.

Ransomware is still malware IMO. Put the conflict of interest aside, if current approach to detect malware does not change, no matter how hard we try, we will still be one step behind.

If we can keep the system up to date, configure the user privileges to lowest possible and grant access only when necessary, take backups as frequently as possible, segregate sensitive networks and most importantly educate the users not to run programs from suspicious sources, most if not all ransomware incident will not happen at all.

The approach I am taking is background sync of all user-created data into git with automatic one-way replication not accessible through SMB. Git has plenty of tools to manage that and I simply automate all this without exposing the user to the commit process. That way I can just reimage the machine and replicate undamaged data back onto it. The problem is detecting data exfiltration and I don't have a solution for that yet.

Wont you hit a git repository size limit?

How would you prune data, say older than 1yr from the repo in-order to limit repo size?

Not sure this is true. Just the fear should be enough to get people to buy. Look at organised religion.

You were probably right. But I got that from my interactions with one of the AV vendors over a decade ago. Since then, the only AV on my machine is Windows Defender. It's not because I need it or trust it, but rather it cannot be easily removed. I always disable it but it will become active might be after a major update, which was quite annoying.

You can disable with local group policy, in gpedit.msc which is the policy editor. Search for the exact path, it's just 5 clicks away, doesn't come back up.

Please link to 'script blockers'.

At this point windows defender is the principal threat to the normal functioning of my computer. It takes 100% CPU frequently, blocks my own programs based on some obscure ML rules, it re-enables itself when you disable it. It is indistinguishable from a virus.

I have had the opposite experience. I've found windows defender to be basically the only AV you really need. I had a single occurrence where it flagged software I was writing as potentially malicious, but I was able to add an exception for my project and not think about it again. I've never noticed it clocking my CPU at any noticeable levels. For comparison, my work computer requires McAfee and at least once a day it clocks my CPU at 65% or more.

Windows Defender is the only antivirus I have used on my personal machines since it first launch and I have never had an issue, though I suspect most of my good fortune is good internet habits.

I wonder how much modern windows really requires an anti-virus. During the Windows XP days it felt vital, but since then it has felt more like something everyone just does out of caution.

>> I've found windows defender to be basically the only AV you really need.

Microsoft has no reason to load crapware along with Defender, they just ship that stuff with Windows itself.

A few months ago, I was playing with msfvenom and wanted to experiment with making a payload designed to bypass the antivirus of both Windows Defender and an antivirus that my work uses(with my boss's permission). I worked on it all day, but I could not get around internet-connected Windows Defender. Any time a port was bound or web connection was attempted, it shut me down.

It made way more impressed with Defender. I was always told it's inferior, but its sandboxing and heuristics scanning are quite good.

I've been relying exclusively on Windows Defender since before it was called Windows Defender. I view third-party antivirus software as pointless at best, and actively harmful at worst.

Same here. Love the thing.

By “love it” I mean I never have to think about it or acknowledge it’s existence.

Which is the exact opposite of how the word “love” is generally used.

But I still love it.

> By "love it" I mean <insert highest possible praise software can receive here>

Seems like a normal thing to say to me. :)

Not infrequently I have a client bring in a system without aftermarket antivirus that got hacked. It is ten times rarer that I get a hacked system with an aftermarket antivirus. I still recommend people use an aftermarket antivirus.

Regarding you being required to use McAfee, I've found it no better than Windows Defender, so I don't know why people pay for it. It doesn't even rate well in detection tests like av-test or av-comparatives.

I'm not making excuses for it, just trying to help. Try and infer what it's scanning. If you're coding, then that directory. If you're doing video editing, then that program. Set up exclusions for things that your PC should be doing.

Heuristics could be used to infer that stuff, so it's not ideal that we have to do it manually.

Oh I know what it is doing. My deployment mechanism on my home computers is that when it launches one of my apps, it checks first if there isn’t a new version stored on a private cloud repository, and if there is, downloads it, and runs it. The apps aren’t signed. And I am pretty sure that triggers defender’s malware downloading binaries from c&c network logic, so it randomly deletes the executable.

Also when I want to scan all the video files in a folder I run ffprobe hundreds of times pretty much in parallel and defender will want to inspect each instance of the same ffprobe exe independently, resulting in a 100% cpu usage and slow scan.

I solved the issue by defining folders exclusions but I don’t believe it can be scripted and it is a pain in the ass. All of the above is unwanted behaviour of an antivirus working against me.

Move most of the things(programs, data) on other drive and exclude whole drive.

EDIT: I have 4 drives on my C machine: Every disk but C is excluded.

  - C - as little stuff as possible, does not exclude
  - D - programming and misc utilities (everything from browsers to total commander, editors, programming languges is here)
  - E - Gaming
  - F - network share - media

That said my primary workstation is linux, htat just backup/gaming/windows programming one

The way I have dealt with it is that, I just keep my main os on C:

and install almost everything else on other drive , that I put in excluded folders in settings.

It is especially important if you are programming in rust or golang, that produce fat binaries, because its scans and uploads them.

What happens if you delete its main executable?

I don't think there is a concept of "main executable". There may be an executable that shows a GUI for the user, but most of the antivirus is probably implemented in the kernel, file system filter drivers, etc.

MsMpEng.exe is the core component, not sure if you can just delete it. There's group policy setting for disabling it (and corresponding registry key, HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware), but I think it only sticks in Enterprise versions.

Even then, I doubt it's statically linked into the kernel or any other core component. It still must be some kind of separate loadable module that would most probably be stored as a separate file.

> At this point I'm convinced that the entire antivirus industry is a scam scheme for the most part.

I was always under the impression that Microsoft does not fix or is extremely slow at fixing particular virus-allowing bugs due to their business model of licensing access to system features, you have to access to be able to build an antivirus software.

I don't know Windows internals but I imagine that your usual game or text editor does not have and cannot gain access to kernel, bootloader etc, that AVs have.

I don't know much about more modern Windows, but I'm fairly certain that on XP and earlier anything that ran on behalf of the administrator (the only user on most home installations) could trivially load arbitrary code into the kernel. I'm not sure how UAC affects this on Vista and newer.

These days you need to have your kernel driver signed by Microsoft or edit your boot config options to put the machine in an insecure state mostly useful for testing. To get it signed you need to pass a basic test suite which MS provides (and can be gamed). https://docs.microsoft.com/en-us/windows-hardware/drivers/in...

> These days you need to have your kernel driver signed by Microsoft

However, this is required only for a “proper” kernel driver specifically; kernel code execution can still be accomplished without any signing at all using /dev/kmem-like mechanisms, which Microsoft explicitly does not consider a bug[1].

> or edit your boot config options to put the machine in an insecure state mostly useful for testing.

Or fiddle with undocumented registry settings (used, among other things, to support upgrades from Windows 7 installations with unsigned drivers) and suppress signing checks for your driver even outside of testing mode[2].

> To get it signed you need to pass a basic test suite which MS provides [...].

You also need to register a business entity and cough up upwards of 300 USD/yr for a Microsoft-approved EV code signing cert[3] before that, which is the biggest hurdle for me at least.

I have to say, even if this new Microsoft is not the same as old Microsoft, it sure looks very similar from some angles.

[1] https://github.com/ionescu007/r0ak#is-this-a-bugvulnerabilit...

[2] https://geoffchappell.com/notes/security/whqlsettings/index....

[3] https://docs.microsoft.com/en-us/windows-hardware/drivers/da...

The new Microsoft is limited to their cloud offerings. The Windows division, when looking from the outside, is still the same.

Microsoft isn't slower at fixing security vulnerabilities than other OS vendors. It turns out identifying and fixing issues in a piece of software as large as an OS is hard. Access to system features is not restricted by licensing, although I believe there is some source code which is licensed to AV vendors. Independent companies do write their own AVs without interacting with MS much at all besides some fairly basic driver signing processes which anyone who writes a kernel driver these days has to go through. MS does not have unique business reasons for shipping insecure code, and ships an OS which is as secure as they come these days in the form of the xbox. I used to work for an AV vendor and then the MS security team but now work for another OS vendor.

> I was always under the impression that Microsoft does not fix or is extremely slow at fixing particular virus-allowing bugs due to their business model of licensing access to system features, you have to access to be able to build an antivirus software.

That's bollocks. Unlike Apple which requires Apple's blessing ("entitlement") to access "sensitive" APIs or to load kernel-mode drivers (and is known to randomly grant or deny them), all you need for distribution of a Windows driver is an EV Code sign certificate (from Vista and above) and additionally from Windows 10 onwards to submit the binary to Microsoft for attestation (which likely means they'll run static analysis to check for malware and that's it).

It should not take an experienced programmer more than a couple of weeks to develop the kernel-mode interface of a basic anti-virus/firewall solution that monitors process, registry, file and network access and passes the data to an user-mode analyzer (the latter are the easiest, all you need there is a simple filter driver)... the stuff where it gets tricky is when AV vendors access internal kernel APIs and data structures to check for malware modifications to hide itself. Malware doesn't care much if Microsoft updates something it needs, but AV software should not break down after a kernel upgrade, which is why the stakes for AV vendors are so much higher.

What Microsoft does sell is access to the source code via the Shared Source program [2] - while there is no official program aimed at AV vendors, you can bet that there is a separate program available for the half-dozen major AV vendors there are.

As for "MS is so slow at fixing bugs": the one thing Microsoft cares and what guarantees it the money it makes is backwards compatibility and operating stability. You can take virtually all major Windows 95-era software and it will run unmodified on a modern Windows 10 machine, well over 25 years after its publication - a promise that the Linux kernel upholds but the userland (distributions) does not give a fuck about, and Apple doesn't care much about software written for obsolete platforms at all (see e.g. dropping Rosetta and 32-bit support after the last hardware based on them went obsolete). And unlike Apple, Microsoft has to check all updates in kernel and user land against a literal shitton of hardware combinations and software to make sure no bugs are introduced.

[1]: https://docs.microsoft.com/en-us/windows-hardware/drivers/da...

[2]: https://www.microsoft.com/en-us/sharedsource/

As a user, you can load a third-party kext on macOS without Apple's blessing, even on the M1, but you have to jump through a lot of hoops to do that. I'm not even sure the thing needs to be signed with a developer ID certificate, but that would probably reduce the number of warnings to click through.

Though Apple is now moving towards more of a microkernel architecture, where entire classes of what used to be kernel extensions are now userspace processes. VPN services, network filters/firewalls, some but not all device drivers, etc.

> As a user, you can load a third-party kext on macOS without Apple's blessing, even on the M1, but you have to jump through a lot of hoops to do that.

Agreed, but that's not a reasonable way to distribute any piece of software to an audience that's not a bunch of hardcore hackers. The easiest way for "old" Intel Macs is to install OpenCore which can inject kexts before the kernel even gets execution, but for M1 I'm completely lost.

> for "old" Intel Macs is to install OpenCore

So, like, hackintosh an actual mac? Hmmmm.

Yep. There is an extremely well detailed guide on MacRumors that has got everything you will need: https://forums.macrumors.com/threads/opencore-on-the-mac-pro...

Personally, I use OpenCore because I run a RX 5500 XT which isn't supported by Apple's EFI (making the bootpicker impossible to use).

How do you feel about Apple Silicon? After all, it means the days of the Hackintosh are counted.

Maybe they're doing it wrong?

It has been this way since the 90s, sadly. As a bonus you don't even need to be scared into installing it because it was already there when you bought your prebuilt PC. Instead you'll be scared into not removing it.

I really thought antivirus software was helpful and was naively reporting samples of malwares I found on my machine to one of the vendor I trusted. Things like that went on for years until one day I found something suspicious on my machine again: self-extracted other binaries, stealthily registered auto-start on boot, listening on some port, contacting some servers etc.. The most important thing was that I did not install it not it was a part of anything I accidentally installed. So I reported again and well to my surprise, they told me nah, it's not malicious. Huh? Their response raised a bigger question mark in my head as I already spent hours trying and managed to disable it from my system and I was pretty sure it actually was malicious. I wasn't sure what was going on then, so I replied that I was not comfortable with the sample, could you test again etc. without providing evidences I found deliberately. And the feedback from them was: we've tested it and it was not malicious. Okay, so I was convinced that: either they were lousy enough and unable to figure out what was going on or it was created by them. The behaviors were so obvious and thus it's very unlikely the could not find it out, I was inclined to believe they were the one created it.

So I immediately uninstalled their products from all my machines and now the very first thing I do when I receive a new machine is to remove pre-installed antivirus software and disable the damn Windows Defender. M$ now makes it really hard to disable Windows Defender completely...

I have a priceless screenshot from TrendMicro acting like malware. https://imgur.com/a/ZgLIRLF

The “error” message tells the user the machine is being protected by Windows Defender…

I agree it largely is a scam but I still find a few avs to be better than Windows Defender. Perhaps if more people did some real research, instead of asking their friend who has no better idea than they have, before purchasing, it would knock some of the bad apples off the tree and boost the better ones, hopefully encouraging them to get better.

Of course, the concept of av is flawed because it takes them a few days to get new signatures out. I'd like to see more avs implement whitelists.

At this point an AV with real-time scanning is only useful to a computer user who doesn't know or care about operational security and plugs in random flash drives (or) clicks on everything they see; And since they form the average customer profile of these AV makers they continue to thrive.

For the rest, AV software results in diminishing returns.

> and plugs in random flash drives

Is this still a problem? I thought OSs don't execute stuff from flash drives automatically any more.

That could be a valid question, But I haven't used Windows for over a decade as the main OS but I presume there could be many who would click 'MakeMoneyFromCrypto.exe' on their flash drive without thinking where it came from twice.

Yet incidents of viruses/ransomware infecting PCs after clicking attachments/links exist so we need at least a purely functional (file/link in - risk guess out) antiviruses. I generally use VirusTotal but I it doesn't seem reasonable to use it for checking potentially confidential files.

Except when something says "please disable your antivirus before opening this", many people would gladly do so. IMO at this point, it's a social problem, not a technical one. People need to be taught about this stuff.

> Except when something says "please disable your antivirus before opening this", many people would gladly do so.

Unless you plug it right into your company e-mail server or just hide it well enough to keep vulnerably-unadvanced users away - e.g. my elderly mother would hardly disable her antivirus if that required editing the registry or entering a long terminal command.

Actually its an advertised feature and you keep most of the ETH you mined: https://community.norton.com/en/blogs/product-service-announ...

> Norton Crypto is included as part of Norton 360 subscriptions. However, there are coin mining fees as well as transaction costs to transfer Ethereum. The coin mining fee is currently 15% of the crypto allocated to the miner.

So I have to pay money to subscribe to mine Norton Crypto and then pay a mining fee on top of that? That's amazing. Are they going to partner with QuickBooks so that I can subscribe to that as well and for a low 15% transaction fee they'll handling filing the taxes for me?

If it's installed without warning, I'm sure you'll also get a lovely surprise on your electricity bill when it turns out your laptop has been mining crypto when you thought it was sleeping.

They're basically turning their installed user base into a botnet and charging customers money for the pleasure. I hope they get taken to court over it.

Your electricity bill is $10.00 higher this month. But don't worry! You earned $8.50 in your Norton Crypto wallet.

Congratulations! This month you have earned 8 "dollars" and 50 "cents" in NortCoin(tm).

That you now have to pay $5 in fees to extract from said wallet.

It is installed but not activated without warning AFAIK. According to https://support.norton.com/sp/en/us/home/current/solutions/v... the user must first agree to a Norton Crypto License and Services Agreement and then explicitly activate the miner before anything will happen.

> > The coin mining fee is currently 15% of the crypto allocated to the miner.

Hold up. Does the term "miner" refer to the pool here? Is "allocation" mining?

This can be read as the pool getting 85% of what miner mined, and allocating 15% fee to the miner.

You don't have to do anything. Maybe this product isn't for you.

Its certainly a legal way to spy on many users and businesses to extract secrets thats for sure!

It could be used for that obviously, though do we have any evidence? Who would the AV vendors sell the secrets to, and how? (I guess it's not a surprise I wouldn't be in those meetings, but you'd think there be a whistleblower somewhere?)

The feature that automatically submits samples for further analysis has been known to catch proprietary executable code, send it to the AV manufacturer's sandbox where it was promptly executed and leaked data from inside that infrastructure (MS), or give away some complex hacking campaign before the attackers have the chance to use the tools (Kaspersky).

There was that Kaspersky incident.

TL;DR Kaspersky inadvertently acquired confidential NSA hacking tools from an NSA employee home computer with their AV product installed in it.

So Kaspersky flagged the hacking tools as a virus and sent it to Kaspersky for investigation? Nice!

Reply on news.ycombinator.com