Hacker News Reader

Comment by annoyingnoob | Hacker News Reader

I have personally watched Windows Defender fail to notice a real virus infection from a USB flash drive. The USB flash drive was plugged in and instantly Windows was infected - Windows Defender did nothing. You could then manually run a Windows Defender scan and it would find the infection but it would not prevent the infection.

I think one's need for a security product should match one's exposure to issues - it depends on your org. For a very long time I was not a fan of anti-virus, in 2022 I'm back to liking anti-virus (more like EDR these days).

View on HN

What mechanism would a flash drive use to infect a modern version of Windows by only being plugged in?

MS Defender used to automatically scan USB devices when plugged in but that's not the default anymore (and AFAIK hasn't been for a few years since one of the major updates); you now have to enable it somewhere non-intuitive (like the Policy Editor?).

That's a really bizarre choice of default setting.

Not really, when you consider that there are tens of thousands of USB devices that work with Windows, many of which can operate like a flash drive even though they aren't (like cameras). I can imagine MS disabling this feature by default due to the headaches involved.

Notably, autolaunching USB drives is also no longer the default option for USB devices. The user has to specifically choose what action happens when the device is first plugged in (and by default, that choice only applies to the current instance; the user must manually choose to have the choice apply the next time the device is plugged in).

My point is that people thinking that Windows 10 comes with Windows Defender, and that Windows Defender will protect them by default, are in for a surprise. Defender probably is not doing anything you might think it should, by default.

Would one of the commercial antivirus products have caught it, though? Did you check?

Yes. It was not a current virus, came from an old UEB flash drive that had been lying around for years. GravityZone noticed it and prevented it, which is why I knew to go look at the Win10 box the flash drive was last plugged into. Windows Defender's silence would have left us with the virus installed because it was not periodically scanning on its own.

dont confuse BitDefender with Windows Defender, not the same thing

I did not confuse them. Yes, I mentioned GravityZone in a follow - which is a BitDefender product, and is the product that found the issue when Windows Defender did not.

Reply on news.ycombinator.com