Hacker News Reader

Comment by cj | Hacker News Reader

Alternative source: https://www.hackread.com/microsoft-defender-tor-browser-win3...

> Microsoft Defender is detecting the latest version of Tor Browser as malware because it is using a new heuristic detection method that is designed to identify Trojans that use Tor to hide their activity. However, the heuristic method is too broad and also flags the Tor Browser itself as malware.

TLDR: Microsoft Defender is identifying any app trying to connect over Tor. The idea is malware sometimes uses Tor network to phone home, so detecting that would be a signal of potential malware.

Obviously a false positive for the Tor Browser itself.

View on HN

We use Delphi at work, and virus/malware scanners flagging every Delphi exe as a threat is something that has plagued Delphi for over 20 years.

Yes malware was written in Delphi for much the same reasons regular programs were[1], but had low enough exposure that none of the major scanner developers bothered including reference exe's to avoid flagging harmless run-time library code.

[1]: https://en.wikipedia.org/wiki/Rapid_application_development

In short, "antivirus doing what antivirus has always done". Always set your AV to quarantine rather than blindly deleting data with potential infections, and review what it does, when it does it, so you can say "no, you will put this back" and you report the false positive (if your AV solution doesn't auto-submit that because it can, and it should)

It's been a while since I had to deal with Defender but IIRC the "put this back" option doesn't really work. It would regularly forget exceptions and quarantine binaries again.

That's the problem with Windows Defender - Microsoft has basically removed the ability for a normal user to configure it to quarantine instead of auto-remediate (delete).

After I caught Windows Defender uploading my places.sqlite in my FF profile "for analysis", I permanently disabled automatic sample submission, auto-remediation, etc via group policies.

I still won't use any other AV though because they are generally even worse about making decisions without user input and don't respect group policies at all unless you are an actual enterprise customer.

Yeah, exactly. This almost certainly isn't malicious, simply incompetence.

I used to be work on a remote IT administration product. To be completely fair it is a foreign systems component that updated over the Internet with a goofy looking binary if you're expecting MSVC to build everything since that code was written in Go.

On the other hand, it was signed properly, and the AV vendors couldn't give two shits about not flagging it despite their customers loudly complaining. It was really rough because when AV would flag this component, IT in a lot of cases couldn't get back in to mend the pieces left.

this is what happens when Microsoft's detections team is under pressure to constantly deliver new detections: they will just ship whatever without careful evaluation of FP/TP and broader impact

This is what's happened over and over and over, for decades, every time an AV company switched to a new heuristic engine. It has nothing to do with Microsoft being under pressure, this is literally what to expect from AV solutions on the regular. More folks knew this back when AV wasn't tightly integrated into Windows and we all ran at least two different AV applications all the time, but the "a new version is going to flag things it shouldn't" behaviour has been a given for coming up to 50 years now =)

(Which is why you set your AV to quarantine, not delete items, so you can overrule it immediately, make it put the data it flagged back where it belongs, and send a false positive report so the next update, which can be as soon as the next day, won't repeat the mistake)

Reply on news.ycombinator.com