App Review Windows Defender vs Ransomware! (Shocking Results?)

[monkeylove]

You don't have to be a tweaker to avoid bad habits. Common sense is enough.
You don't have to be a doctor to live a healthy life. But sometimes a doctor can give helpful tips.

Use common sense to visit only websites that are safe, and yet we have reports of safe websites that have been infected, and in some cases the discovery made when it's too late.

 

[roger_m]

My experience over many years has been that, if I keep Windows and vulnerable apps updated, and am not click happy, that it's very hard to get infected. As a result I've never felt that I need to use a layered setup, or put much effort into protecting my computers. In my case, I don't care about having 100% protection. Knowing that it's very hard to get infected is enough. This isn't the case for everyone, but it is for me. Aside from one time when I got infected simply by visiting a compromised website (and that computer had outdated versions of Flash and Java), the only other times I've been infected is when I've opened an infected file. This is despite never making any effort to visit only trusted websites.

 

[monkeylove]

I don't see the point in "I haven't been infected" arguments because one can't provide proof of that. Meanwhile, one thread in the forum talked about I think a 5-percent chance of infection.

 

[TairikuOkami]

In my case, I don't care about having 100% protection. Knowing that it's very hard to get infected is enough.

Exactly, in the end, No AV can protect PC from the user. Even something as simple as smart app control can protect PC alone, since there is still only a handful of digitally signed malware.

 

[roger_m]

I don't see the point in "I haven't been infected" arguments because one can't provide proof of that. Meanwhile, one thread in the forum talked about I think a 5-percent chance of infection.

While I can't provide actual proof, I do know for certain that aside from the one instance that I mentioned, the only times I've ever been infected is when I've manually opened infected files. The 5% percent chance of infection is meaningless without some context.

 

[Practical Response]

Burden of proof lies both ways. @monkeylove can you prove your method/products you suggest will save a user from themselves if they simply "don't have time" to be cautious and careful while using a computer on the Internet. Can you prove without a doubt that if a user installs and uses layered security that the user will understand it and not misconfigure it causing vulnerability, expanding the attack surface.

 

[Trident]

Can you prove without a doubt that if a user installs and uses layered security that the user will understand it and not misconfigure it causing vulnerability, expanding the attack surface.

Or that certain layers to an extent will not be duplicates (few guys doing the same) and an attack won’t go through all of them…
Whilst security offerings and precautions are not to be undermined at all, good habits go long way in preventing mishaps.
For example, you can have an extremely layered security setup on a business environment but it won’t help you much if employees access is not controlled properly and a rogue employee snatches your crown jewels.
Or I may have 3 second opinion scanners, but it won’t help if my Microsoft account password (and OneDrive) is the same one I use on 70 other websites and I got no 2FA.

So it’s not just black and white or a matter of software and doohickeys. It is important to plan a security setup properly (as minimal as possible), follow best practices, and always observe, think and suspect.

Majority of attacks are against the user, not against the machine and require human lack of attention. When user lacks attention to details, security software can help but can’t be a full substitute at all times.

 

[oldschool]

Exactly, in the end, No AV can protect PC from the user. Even something as simple as smart app control can protect PC alone, since there is still only a handful of digitally signed malware.

And some, like Wilders' @mrkvonic, use only Windows Defender Exploit Protection for security aside from brain.exe.

 

[monkeylove]

While I can't provide actual proof, I do know for certain that aside from the one instance that I mentioned, the only times I've ever been infected is when I've manually opened infected files. The 5% percent chance of infection is meaningless without some context.

I think it's possible for malware to reside on systems without the user knowing it. As for the 5-percent chance, I think it was mentioned in another thread in this forum after reports from several years were studied. That, for me, is verifiable and more logical than personal anecdotes.

 

[Trident]

I think it's possible for malware to reside on systems without the user knowing it.

It will always be residing without user knowing it, if the user knows it, they will remove it and it will no longer be residing.

 

[monkeylove]

Burden of proof lies both ways. @monkeylove can you prove your method/products you suggest will save a user from themselves if they simply "don't have time" to be cautious and careful while using a computer on the Internet. Can you prove without a doubt that if a user installs and uses layered security that the user will understand it and not misconfigure it causing vulnerability, expanding the attack surface.

You didn't understand my point: what I'm saying is that "common sense" or "good habits" or whatever they're called and even defined isn't enough. That's why even Microsoft had to come up with Defender, and for the company even that's not enough.

What about users misconfiguring security apps, etc., (includes tweaking Defender!) and not just expanding attack surfaces but even leading to slow down, BSODs, etc? That can happen, which is why many features in the system are usually turned off by default. That reminds me of one article from the Microsoft advising gamers who turned on core isolation to turn it off first when gaming and then remember to turn it back on after gaming.

 

[monkeylove]

Or that certain layers to an extent will not be duplicates (few guys doing the same) and an attack won’t go through all of them…
Whilst security offerings and precautions are not to be undermined at all, good habits go long way in preventing mishaps.
For example, you can have an extremely layered security setup on a business environment but it won’t help you much if employees access is not controlled properly and a rogue employee snatches your crown jewels.
Or I may have 3 second opinion scanners, but it won’t help if my Microsoft account password (and OneDrive) is the same one I use on 70 other websites and I got no 2FA.

So it’s not just black and white or a matter of software and doohickeys. It is important to plan a security setup properly (as minimal as possible), follow best practices, and always observe, think and suspect.

Majority of attacks are against the user, not against the machine and require human lack of attention. When user lacks attention to details, security software can help but can’t be a full substitute at all times.

Security software developers also need to live in the real world. Many users are not techies who have a lot of time for attention to details, in the same way that many techies don't have time for things for which many of those users are experts (like doctors, lawyers, accountants, engineers, scientists, and so on).

That's why some businesses resort to restrictions; meanwhile, the same employees are required to be more productive, to learn and use new features, etc., which in turn involves a decrease in restrictions.

 

[monkeylove]

It will always be residing without user knowing it, if the user knows it, they will remove it and it will no longer be residing.

What I mean is that it will be there but the user won't notice because he doesn't see a slowdown, etc. Techies can deal with that by monitoring, etc. How many people worldwide are techies?

 

[Trident]

What I mean is that it will be there but the user won't notice because he doesn't see a slowdown, etc. Techies can deal with that by monitoring, etc. How many people worldwide are techies?

Majority of malware will cause no slowdown (specially true for RATs and infostealers). Malware that causes slowdown, by the time user feels it, it would have already done its job.
Security setups, even when overcomplicated, fail too.

Good habits, such as avoiding torrents, cracks, keygens and other pirated content, not believing everything seen in emails as well as on ad banners, knowing that if something is too good to be true then it probably is, all that goes a long way and is less prone to failure (like everything else, not 100%).
For these habits, you don’t need to obtain masters in cybersecurity. Of course, it is naive to believe that everyone will have them, hence different security apps exist.

Even on business environments, employees are expected to be trained. When they are not, layered security setups fail and it is a recipe for disaster.
Highly technical and sophisticated attacks rarely happen, majority of times there will be some very obvious tell-tale signs.
For example, that email from GM will be coming from protonmail.com, not from the company domain.
Attackers pray for and prey upon the attacked user not to pay attention and to take shortcuts.
Remember that Linus Tech Tips account takeover, had he noticed that the “contract” pdf is 700MB (highly impossible for a legit pdf to be this size) he wouldn’t have been hacked. His security failed.

So it’s important for people to:
1.) pay their dues
2.) pay attention
3.) refuse to do what they are told in email and over the phone, rather log-in to their online account
The layered security setup is then optional but not unnecessary.
A lot of security apps blindly trust signed, reputable executables, so supply chain attacks will go right through in any case.
Supply chain attacks however are extremely rare, much more frequently, DJVU/Stop ransom and Agent Tesla are infecting systems because someone wanted a cracked game.
This is why, when investigating botnets, frequently it’s discovered that vast majority of the infrastructure is in third-world countries, where users are much more likely to rely on piracy.
On Android, majority of issues lie in apps that I got no clue why anyone over the age of 12 will want to install, table below provided by Bitdefender.

Spoiler: Table

Qasim.Llc	Steelrbasic@gmail.com	https://personalitycharginshow[.]xyz
ALCANTARA.Lab	TipAprilb@gmail.com	https://smartqrscanner1[.]xyz
Baig.Corp	Ississppifinest2@gmail.com	https://animatesstickermaster[.]xyz
Hamid.Apps	jemarchag@gmail.com	https://gps1ocationfinder[.]xyz
Emmanuel.Llc	Quintonjxus@gmail.com	https://mygps123123[.]xyz
Jamie.Lab	jjamiemunoz417@gmail.com	https://artgirlswallpaperhd[.]xyz
Bennington.Llc	kkarlbennington@gmail.com	https://catsimulator1[.]xyz
Josh.Lnc	huhua.luc@gmail.com	http://smartwifii123[.]xyz
Vern.Apps	Vernl3138@gmail.com	https://imagewarpcamera[.]xyz
VILORIA.Corp	Jamelpmac@gmail.com	https://smartqrcreator1[.]xyz
Abid.Studio	ita.mita594@gmail.com	https://colorizeoldphoto[.]xyz
Adeel.Studio	ikvznj@gmail.com	https://smartaps1ocation[.]xyz
Haq.Corp	Wycliffedennis07@gmail.com	https://secrethoroscope1[.]xyz
Nadeem.Apps	KnowMonty@gmail.com	https://volumecontroll[.]xyz
Cedrick.Corp	Cedrickoayz@gmail.com	https://gps1ocationmaps[.]xyz
RICHARD.Lnc	Flossiezxe@gmail.com	https://girlsartwallpaper[.]xyz
Sushil.Dev	tacie.bush@gmail.com	https://mediavolumeslider[.]xyz
Haider.Studio	Eduardoaunx@gmail.com	https://sleepsoundss[.]xyz
Kumar.Apps	Randytzjp@gmail.com	https://qrcreatorr12[.]xyz
Waseem.Llc	MarquisDunlap35@gmail.com	https://secretastrology[.]xyz/
Butt.Corp	eterbrellocvx@gmail.com	https://colorizephotos[.]xyz/
Vledern Studio	deernivle67@gmail.com	-

Even to properly layer your security, knowledge is still required. Nowadays there are loads of resources users can absorb, if they are lazy, it’s on them. That OEM McAfee won’t help them much.

TLDR: between a trained user that knows what they are doing and a user who installs an arsenal of security tools, the latter is more prone to getting an infection. One can always be both.

 

[roger_m]

I think it's possible for malware to reside on systems without the user knowing it. As for the 5-percent chance, I think it was mentioned in another thread in this forum after reports from several years were studied. That, for me, is verifiable and more logical than personal anecdotes.

Yes it definitely is possible to be infected and not know it, because no antivirus provides 100% protection. However this has not happened to me. Sure, it could happen at some point. But since I know the chances of my PC getting infected are very small, I'm not concerned about it. Once again, the 5% chance means absolutely nothing without some context. Is it that users in general have a 5% change of getting infected, or is it a different scenario?

 

[WhiteMouse]

I think Monkey had a point here, you must know that the truth is no matter how much you know in cybersecurity, there's always someone who better than you can compromise your pc without you knowing it, how you choose to deal with it is another problem. I think most people including me ignore it because there's nothing I can do if I don't know that my pc get infected.

 

[Practical Response]

What I mean is that it will be there but the user won't notice because he doesn't see a slowdown, etc. Techies can deal with that by monitoring, etc. How many people worldwide are techies?

What's the route of infection here. How did it get there, it doesn't just magically crawl in your system.

Is it in a 3rd party app or document you downloaded or an email or social media link you clicked, or from surfing to an infected website, or some silly extension you had to have that you didn't bother to get or verify since you didn't have time.

Oh yeah, that's right, it still hinges on the users habits.

 

[Practical Response]

You didn't understand my point: what I'm saying is that "common sense" or "good habits" or whatever they're called and even defined isn't enough. That's why even Microsoft had to come up with Defender, and for the company even that's not enough.

What about users misconfiguring security apps, etc., (includes tweaking Defender!) and not just expanding attack surfaces but even leading to slow down, BSODs, etc? That can happen, which is why many features in the system are usually turned off by default. That reminds me of one article from the Microsoft advising gamers who turned on core isolation to turn it off first when gaming and then remember to turn it back on after gaming.

Oh I understand completely. You are confused.

Habits are everything when it comes to security. You just demonstrated it without realizing with your article.

Gamers having to disable security to play games that are riddled with vulnerability and highly targeted and can't figure out why they just got nailed, hmm . Might as well state that users need to disable those security's too for cracks and keygens to work so they can play for free and still not figure out why they are getting nailed.

Adding 3rd party vulnerability to the system expanding the attack surface, and disabling security to do so, sounds very much like habits to me, bad ones.

 

[LennyFox]

and one can always be both.

well said

That is why Bill called his OS Windows, so both malware and security enthousiasts could brick it

 

[Trident]

well said

That is why Bill called his OS Windows, so both malware and security enthousiasts could brick it

Problem is some people are security OverInthusiasts
You know that saying, even pudding is not great when it’s over-egged…