News for hackers. Stuff that matters.

A comment on Deceiving Windows Defender: The Big Stack Bypass.

Re:Deceiving Windows Defender: The Big Stack Bypass by 323 on Saturday December 31, 2022 @07:38AM (#34195918)
Sometimes I get prompts from Windows Defender that it would like to upload some files to Microsoft for further analysis. The weird thing is that they are well known binaries from official sources, for example node.exe (Node JS). Just to be sure a couple times I checked the digital signatures and all that.

Doesn't Microsoft download important applications to analyze or whitelist itself?

[ Parent | on HN ]
Re:Deceiving Windows Defender: The Big Stack Bypass by enkid on Saturday December 31, 2022 @07:52AM (#34196016)
Maybe Microsoft is trying to hunt down a piece of malware that has an authentic digital signature? Stuxnet had it.
[ Parent | on HN ]
Re:Deceiving Windows Defender: The Big Stack Bypass by flatiron on Saturday December 31, 2022 @09:16AM (#34196593)
I get the same thing with notepad++ updates. Only time I use windows is work and the apps that usually update are vscode (which I assume they preanalyze) and notepad++. Other than that I live in WSL for …work
[ Parent | on HN ]