I wonder why Windows Defender has the privilege to alter the system files. Read them for analysis? Sure! Reset (as in, call some windows API to have it replaced with the original), why not? But being able to write sounds like a bad idea.
However, I don't know what I'm talking about so take it with a grain of salt!
AV had traditionally run as SYSTEM on Windows (and, in the past, often had kernel mode drivers too). I've always thought it was a terrible idea. It opens up exciting new attack surfaces. Kaspersky and McAfee both had privilege escalation vulnerabilities that I can recall. There have been a ton in multiple products over the years.
If malware exploits a privilege escalation vuln, what's the AV going to do about it when it's reduced to the software equivalent of a UK police officer? Observe and report? Stop or I'll say "stop" again?
AV requires great power, which requires great responsibility. The second part is what often eludes AV developers.
The OS should do the SYSTEM-level lifting and scanning processes and behavior analysis should run sandboxed as low priv processes. It would require a clearly defined API and I feel like MSFT was always reticent to commit, leaving AV manufacturers to create hacky nightmares.
I remember the times when Microsoft had a lot of problems 20 years ago because of Sasser and other viruses that were taking over Windows. They did not have any contenders. Yet they have stopped any software development for 9 months just to re-work their entire codebase to prevent things like direct memory execution and stuff like that. The result of that was Windows XP Service Pack 2. After that thing windows XP became a legend.
Now, when Linux is slowly creeping on one side, and Mac NEO on another they keep releasing this AI-slop.
By the looks of it they make most of their money from the cloud and other software things nowadays. And Windows has become a sidekick in their processes.
I don't think SP2 made much of a difference in the popularity of XP. It was already dominant, and it's mostly remembered as "legendary" because it had become the target platform for every hardware and software vendor on the planet. Windows 98 was too flaky to engender any serious friction to upgrades, and Windows 2000 was not consumer-friendly enough; XP effectively unified the consumer and professional desktop markets, and became the gold standard.
SP2, if anything, slowed down adoption, since it threw a bunch of spanners in the way of third-party code. It was probably necessary, just to stem the flow of bad press, but no mean a key in XP's overall success.
It was not that bad. I remember when SP fixed a bunch of issues with bluetooth, and windows CD burning program was better than any of the Nero Burning ROMs, cause those became unusable overbloated.
> Windows XP Service Pack 2. After that thing windows XP became a legend.
God that was an era. XP SP2 was a great OS, IE was the best browser, MSN was the most popular messenger, Skype was acquired, HTC's Windows CE devices were shipping real web browsers that worked over 3G.
By the end of the Ballmer era, Microsoft has lost the OS, the browser, the messenger, the meeting service and mobile.
I agree with you on everything except the browser. I'm pretty sure I was using Firefox (or maybe Opera?) on Windows before the release of Vista. I know I was still using IE for some ActiveX web apps for a while. This was the era that I switched over to Linux full-time, but both Windows 2000 and XP were great OSes at this time. Linux was painful to adopt, but I really loved the promise of "full-control" over my computer.
My peeve today is how bad modern chat programs feel compared to the old instant messengers. The modern programs all feel slow and clunky in comparison. I felt that all of the messengers I used (MSN, AIM, ICQ) were more responsive than their modern day equivalents.
Ah, what the times were those. Firefox was just gaining traction.
And I agree. Slack is sitting there, consuming over gig of memory on my computer, and Miranda NG was able to do the same functionality with cool skins and just 30 megs of ram.
I can't seem to find any system files replaced, and the .exe was never executed. I'm running this in a test VM, but from what I can see, Defender signatures have been updated to block this prior to execution.
The exploit, from my reading, needs to be executed in order to do it's thing, but Defender isn't allowing it to be written to the filesystem on download.
What is Defender marking it as? I also wonder if they are just special casing this program and it would work again if the code was shuffled a bit or if it used the AMSI sig [0] instead of EICAR or if they actually fixed the problem.
Tney gave it a sexy name and set up a website about it (a github repo, at any rate), instead of just talking about it in a mailing list and getting a CVE like a proper bearded security researcher.
Only if you’re running daemons as root. Which would be an idiotic move to begin with because that’s not how distros package their services. So you’d have to intentionally make this mistake.
Probably, but is that service deployed as part of the base operating system or a third party package? Can you remove the service if you deem the crazy service behaviour is unnecessary or too risky for your usecase?
However, I don't know what I'm talking about so take it with a grain of salt!
If malware exploits a privilege escalation vuln, what's the AV going to do about it when it's reduced to the software equivalent of a UK police officer? Observe and report? Stop or I'll say "stop" again?
AV requires great power, which requires great responsibility. The second part is what often eludes AV developers.
Technically, Defender can be replaced with 3rd party AV.
There are tons of signed drivers to explore ;-)
Lol
Now, when Linux is slowly creeping on one side, and Mac NEO on another they keep releasing this AI-slop.
By the looks of it they make most of their money from the cloud and other software things nowadays. And Windows has become a sidekick in their processes.
SP2, if anything, slowed down adoption, since it threw a bunch of spanners in the way of third-party code. It was probably necessary, just to stem the flow of bad press, but no mean a key in XP's overall success.
God that was an era. XP SP2 was a great OS, IE was the best browser, MSN was the most popular messenger, Skype was acquired, HTC's Windows CE devices were shipping real web browsers that worked over 3G.
By the end of the Ballmer era, Microsoft has lost the OS, the browser, the messenger, the meeting service and mobile.
My peeve today is how bad modern chat programs feel compared to the old instant messengers. The modern programs all feel slow and clunky in comparison. I felt that all of the messengers I used (MSN, AIM, ICQ) were more responsive than their modern day equivalents.
I remember the times when IE passed ACID test? Do we remember the ACID? http://acid2.acidtests.org/#top
Ah, what the times were those. Firefox was just gaining traction.
And I agree. Slack is sitting there, consuming over gig of memory on my computer, and Miranda NG was able to do the same functionality with cool skins and just 30 megs of ram.
Skins... Skins... We've lost even those...
Yes, I've just checked, even in 2009 you still have IE over 64% of browser usage.
The exploit, from my reading, needs to be executed in order to do it's thing, but Defender isn't allowing it to be written to the filesystem on download.
[0] https://github.com/Roadmvn/C-Full-Offensive-Course/blob/main...
Looks like that's exactly what they did though?
Or maybe they just meant that they don't usually explain how it works?
Doesn't Linux have one of these CVEs...each week?
Ignorance is bliss! Simply use docker in its (old) default setup, instead of podman, apptainer, docker-rootless ... and that world is yours.
Added bonuses are the incredible stupid integration with ufw on Ubuntu, images with laughable uid mapping, ...
How that shit got traction baffles me.
But nobody mentioned Linux. There's no need for whataboutism. They both shouldn't have these vulnerabilities.