Deceiving Windows Defender: The Big Stack Bypass

Re:Deceiving Windows Defender: The Big Stack Bypass by devwastaken on Saturday December 31, 2022 @01:34PM (#34199252)

You don't even need that. AV does not know what "malware" is. It only knows heuristics from known bad ware. If I make a program in visual studio that does some bad stuff, and give it to you, defender won't do a thing about it because it's doing the same stuff good ware could also be doing.

This is why AV's are low on the list of security. Prevention is far better than detection.

[ Parent | on HN ]

Re:Deceiving Windows Defender: The Big Stack Bypass by sebazzz on Saturday December 31, 2022 @03:04PM (#34200184)

Does that also apply to things like Symantec Endpoint Protection, which has many additional modules like SONAR - is that mostly marketing and loud yelling?

[ Parent | on HN ]

Re:Deceiving Windows Defender: The Big Stack Bypass by zdragnar on Saturday December 31, 2022 @03:34PM (#34200446)

Most endpoint protection systems typically use a combination of looking at known hashes or bad things and active process monitoring to identify new bad things. They're not perfect, and have varying levels of success. It is better than nothing.

I can't speak to Symantec, but I've worked for companies that provide endpoint protection and watched a live demo of novel "malware" getting caught escalating privileges.

[ Parent | on HN ]