App Review Windows Defender vs Ransomware in 2021

[Kongo]

Content source

https://www.youtube.com/watch?v=ZbYx8V2RTjc

 

[Minimalist]

Thnx for sharing. Somehow expected results.

 

[TheBlueCreeper512]

I'm honestly not surprised....

 

[fabiobr]

At least, turning off the internet connection is more realistic than disabling certain modules.

But you can't trust Microsoft Defender with default settings, especially to have ransomware protection you got to turn on the Protection folder, as it is a complete lock down. A home basic user would never know how to use this.

 

[Kongo]

At least, turning off the internet connection is more realistic than disabling certain modules.

The first thing I thought after watching it

 

[WhiteMouse]

I expect behavior blocking do something but

 

[Gandalf_The_Grey]

Turning off the internet connection lowers the protection of most AV's, because they need their cloud fot optimal protection.
I have not watched the video yet, but it looks like another fail in testing Microsoft Defender from The PC Security Channel...

 

[Kongo]

Turning off the internet connection lowers the protection of most AV's, because they need their cloud fot optimal protection.
I have not watched the video yet, but it looks like another fail in testing Microsoft Defender from The PC Security Channel...

This time I have to defend him. There is actually a chance that you lose connection due to an infection or another issue. He wanted to show how strong the protection is, when no internet connection is available.

 

[Jan Willy]

Rather ironic that this PC Security Channel guy in this video promotes Malwarebytes.

 

[Gandalf_The_Grey]

This time I have to defend him. There is actually a chance that you lose connection due to an infection or another issue. He wanted to show how strong the protection is, when no internet connection is available.

There was an interesting test performed by AV Comparatives about offline protection vs online protection and Microsoft Defender and others did not do well offline:

Malware Protection Test September 2020

The Malware Protection Test September 2020 assesses program’s ability to protect a system against malicious files before, during or after execution.

www.av-comparatives.org

AV-Comparatives - Consumer Malware Protection Test September 2020

We released our Consumer Malware Protection Test. Any samples that have not been detected e.g. on-access are executed on the test system. A false alarm test is also included. While in the Real-World Protection Test the vector is the web, in the Malware Protection Test the vectors can be e.g...

malwaretips.com

 

[Nightwalker]

This time I have to defend him. There is actually a chance that you lose connection due to an infection or another issue. He wanted to show how strong the protection is, when no internet connection is available.

Yeah, but with the connection in place the infection that could cause a lose connection would be stopped in first place

Without a internet connection Microsoft Defender doesnt have access to many more agressive techniques compared to just local machine learning and signatures.

 

[Kongo]

Yeah, but with the connection in place the infection that could cause a lose connection would be stopped in first place

Most likely... We all know that even the best AV misses some malware. I get your point after all and just think same as @fabiobr that it's more realistic than turning off protection modules for fun.

 

[Kongo]

There was an interesting test performed by AV Comparatives about offline protection vs online protection and Microsoft Defender and others did not do well offline:
View attachment 253948

Malware Protection Test September 2020

The Malware Protection Test September 2020 assesses program’s ability to protect a system against malicious files before, during or after execution.

www.av-comparatives.org

AV-Comparatives - Consumer Malware Protection Test September 2020

We released our Consumer Malware Protection Test. Any samples that have not been detected e.g. on-access are executed on the test system. A false alarm test is also included. While in the Real-World Protection Test the vector is the web, in the Malware Protection Test the vectors can be e.g...

malwaretips.com

But that's just the offline detection rate, not the offline protection rate. It's quite obvious that new 0-Day samples are not detected for the most part, as the signatures are updated every couple of hours. It would be interesting to see the offline protection rate too...

 

[Gandalf_The_Grey]

But that's just the offline detection rate, not the offline protection rate. It's quite obvious that new 0-Day samples are not detected for the most part, as the signatures are updated every couple of hours. It would be interesting to see the offline protection rate too...

I agree, but this is the only thing I could find on offline vs online unfortunately.
From the test:

Offline vs. Online Detection Rates

Many of the products in the test make use of cloud technologies, such as reputation services or cloud-based signatures, which are only reachable if there is an active Internet connection. By performing on-demand and on-access scans both offline and online, the test gives an indication of how cloud-dependent each product is, and consequently how well it protects the system when an Internet connection is not available. We would suggest that vendors of highly cloud-dependent products should warn users appropriately in the event that the connectivity to the cloud is lost, as this may considerably affect the protection provided. While in our test we check whether the cloud services of the respective security vendors are reachable, users should be aware that merely being online does not necessarily mean that their product’s cloud service is reachable/working properly.

For readers’ information and due to frequent requests from magazines and analysts, we also indicate how many of the samples were detected by each security program in the offline and online detection scans.

 

[Gandalf_The_Grey]

Turning off the internet connection lowers the protection of most AV's, because they need their cloud fot optimal protection.
I have not watched the video yet, but it looks like another fail in testing Microsoft Defender from The PC Security Channel...

After watching the video I'm impressed by Controlled Folder Access.
Everything protected by that feature was safe from ransomware

 

[ForgottenSeer 89360]

I am not a Defender's defender (or any other AV), but facts are facts. Without internet connection many products won't do well, not just Defender. Only Bitdefender and BD-based products offer same protection online and offline, but these products receive updates every hour, so if you disconnect just for few hours, you are already out of date.
Everyone else makes use of the cloud... some vendors more than others. Panda and Trend Micro are the top-2 most cloud-oriented. In my experience this is absolutely fine and doesn't cause issues.

People who believe they are at risk of being infected due to no connection (for example you travel a lot and use flash drives) should have a look at G Data that packs Bitdefender + proprietary engines.

 

[Windows Defender Shill]

I feel like these test are geared more towards a enterprise environment which Microsoft has a specific product for which is not a normal home users Windows Defender. I mean how many of you guys are clicking executables out of a shared drive on your home network? If you are, you probably shouldn't be using Windows Defender.

I think it's relevant how malware gets on your computer in these test, and he uses a very unusual path most home users would never encounter. Part of a home users security now days is how good browsers are at preventing you from downloading .exe files that are not known to be safe.

But with that being said the video does prove there is still a gap in the capabilities of Windows Defender and 3rd party anti-viruses.

 

[SeriousHoax]

The main thing that I disliked about Windows Defender in this test is, these are all known, popular ransomware. Literally every AV have database about these. So in my opinion every AV should have local signatures for these samples and shouldn't rely on cloud unless the AV is/marketed as 100% cloud based product. This is the thing that disappoint me the most about Windows Defender. It's way too reliant on cloud even for older, known ransomware as you can see in this test. I really can't defend Defender here.

 

[Nagisa]

Without a internet connection Microsoft Defender doesnt have access to many more agressive techniques compared to just local machine learning and signatures.

It doesn't use many of those aggressive techniques either if the file has no MOTW tag. So maybe this is how much the metadata based ML models added to the protection. Anyway, I think this is an accurate test of real-world protection because most of files downloaded from the web comes in an archive.

Spoiler

I wait for the testing of Avast. Unlike Windows Defender it uploads every unknown/suspicious executable to the cloud, so I somewhat expect %100 detection rate.

 

[SomeRandomCat]

There was an interesting test performed by AV Comparatives about offline protection vs online protection and Microsoft Defender and others did not do well offline:

They should make it so offline mode is default-deny unless trusted cert vendor or something, and allow user to override (but recommend not to).