Microsoft Defender ATP Detecting Chrome Update as Backdoor

upnorth

Moderator
Verified
Staff member
Malware Hunter
Jul 27, 2015
4,441
Microsoft Defender Advanced Threat Protection (ATP), the commercial version of the ubiquitous Defender antivirus and Microsoft's top enterprise security solution, is currently having a bad day and labeling yesterday's Google Chrome browser update as a backdoor trojan. The detections, as can be seen in a screenshot above shared with ZDNet by one of our readers, are for Google Chrome 88.0.4324.146, the latest version of the Chrome browser, which Google released last night.
The alerts have caused quite a stir in enterprise environments in light of recent multiple software supply chain attacks that have hit companies across the world over the past few months. System administrators are currently awaiting a formal statement from Microsoft to confirm that the detection is a "false possitive" and not an actual threat.
 

MacDefender

Level 14
Verified
Oct 13, 2019
694
True, the detection is not entirely wrong.

There no lack of legit Software that behaves like Malware, which Anti-Virus developers are forced to ignore and white-list.
It seems like it thinks one of the .pak archives delivered as part of the update is a PHP malware. This to me feels like it’s probably a poorly written signature matching on random compressed data. I do agree it’s more forgivable if it detected the behavior of Chrome’s background updater as suspicious but there’s no way Chrome contains PHP scripts or viruses in those, right?
 
Top