You’d be surprised how many “virus scanners” are implemented with poorly coded C parsers running as privileged user with no sandboxing… just saying, kind of asking for trouble.
Unfortunately, add on that no customer makes a profit off their IT security org. Which disincentivizes excellence and incentivizes feature check-boxing at the lowest price point.
Which ultimately produces a highly privileged piece of software developed on budget salaries.
One reason MS security was a game changer (once the company got off its butt and admitted security was an existential threat to their OS sales) -- they could afford to burn great magnitudes of money to deliver.
(No offense intended to any of the amazingly brilliant non-MS Windows AV folks out there)
In my social circle, the kids Gaming PCs getting infected is very common.
Recently one of my boxes got hacked via a QBitTorrent exploit, and I didnt have Malware detection running, other than the built in W11 system.
I installed Malwarebytes and it detected and correctly removed the malware crypto miner.
FYI they exploited QBT via the web interface, which had default settings, but wasn't exposed via port forwarding to the web. It might have been via UPNP, which was enabled. No idea - but it's a common exploit used to DL a torrent then run a post DL script .bat file to DL and run a crypto miner.
I'd literally had QBT running on Windows for a couple of weeks, having switched from a dockerized setup on a Mac Mini. How Windows allows the running of a .bat file to DL an .exe that can run a crypto miner is just a bonkers lack of security!
Naturally I had to nuke the box from space anyway :-)
Is it any different from Linux allowing the running of a .sh file to DL an ELF executable that can run a crypto miner?
It's either that or iOS-type walled garden, which one you prefer?
By the way, Windows even has the lock-down switch, it's just off by (a sane) default.
Also, blaming OS for not protecting from random app exploits isn't fair.
Who or what triggers the execution of that script? If it is QBT, it almost sounds like malicious intent from the side of its developers.
> In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed.
(you speak with a fluidity I did in my gaming heyday - but I am over the global heap at this point.)