Microsoft Defender ATP Detecting Chrome Update as Backdoor

[upnorth]

Content source

https://www.zdnet.com/article/microsoft-defender-atp-is-detecting-yesterdays-chrome-update-as-a-backdoor/

Microsoft Defender Advanced Threat Protection (ATP), the commercial version of the ubiquitous Defender antivirus and Microsoft's top enterprise security solution, is currently having a bad day and labeling yesterday's Google Chrome browser update as a backdoor trojan. The detections, as can be seen in a screenshot above shared with ZDNet by one of our readers, are for Google Chrome 88.0.4324.146, the latest version of the Chrome browser, which Google released last night.

The alerts have caused quite a stir in enterprise environments in light of recent multiple software supply chain attacks that have hit companies across the world over the past few months. System administrators are currently awaiting a formal statement from Microsoft to confirm that the detection is a "false possitive" and not an actual threat.

Microsoft Defender ATP is detecting yesterday's Chrome update as a backdoor

Microsoft commercial antivirus product is labeling Chrome's latest update as being infected with the Funvalget backdoor.

www.zdnet.com

 

[Gandalf_The_Grey]

It's a Google provided backdoor
However no issues on my work laptop with that update.

 

[Local Host]

It's a Google provided backdoor
However no issues on my work laptop with that update.

True, the detection is not entirely wrong.

There no lack of legit Software that behaves like Malware, which Anti-Virus developers are forced to ignore and white-list.

 

[MacDefender]

True, the detection is not entirely wrong.

There no lack of legit Software that behaves like Malware, which Anti-Virus developers are forced to ignore and white-list.

It seems like it thinks one of the .pak archives delivered as part of the update is a PHP malware. This to me feels like it’s probably a poorly written signature matching on random compressed data. I do agree it’s more forgivable if it detected the behavior of Chrome’s background updater as suspicious but there’s no way Chrome contains PHP scripts or viruses in those, right?

 

[upnorth]