[Viotto01]

I remember about 2 years ago there was a story about how AV makers got caught uploading samples even with submission disabled. I for the life of me cannot find this story anymore, but I specifically recall it.

Yes, I proved that myself with ESET, specifically.
ESET steals your files, even with all the privacy settings properly set.

[YAK_CODER]

Thanks you for your codes but I already know it. I was asking if wd will re-enable itself after restart pc or not. I wi love if you test it on your win10 vmware.

whith reading your registry i know it will enable itself again
as you forget disable the service itself from group policy
add this line and it will not enable itself on restart

Code

reg  add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t "REG_DWORD" /d "4" /f
reg  add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t "REG_DWORD" /d "4" /f
reg  add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t "REG_DWORD" /d "4" /f

[NYANxCAT]

whith reading your registry i know it will enable itself again
as you forget disable the service itself from group policy
add this line and it will not enable itself on restart

Code

reg  add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t "REG_DWORD" /d "4" /f
reg  add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t "REG_DWORD" /d "4" /f
reg  add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t "REG_DWORD" /d "4" /f

Why are you changing the subject over and over again? I'm just asking you to run my code to check if wd will re-enable itself or not.

[CyberStrike]

Yes, I proved that myself with ESET, specifically.
ESET steals your files, even with all the privacy settings properly set.

Did you write an article or publish the research? I honestly specifically remember reading that a few of them were caught doing it. But anything about it is gone just gone from twitter/blogs everywhere gone. Link me the thread or article please. Thank you.

[Viotto01]

Did you write an article or publish the research? I honestly specifically remember reading that a few of them were caught doing it. But anything about it is gone just gone from twitter/blogs everywhere gone. Link me the thread or article please. Thank you.

No, I did not publish it.
I discovered it by accident.
I had ESET installed on one of my development machines (with sample submission disabled and so on).
I deployed there a new version of # and a few other files, for some penetration testing activity which should have remained internal to my lab.
Those files were all undetected by ESET.
After a couple of days, all those files where signed by ESET with very specific signatures (Win32/Backdoor.# etc.)
There is only one possible explanation about this: they stole all my files.
They steal users files, to provide an unfair advantage to their business, completely betraying users privacy.
I wrote them about this: got no reply.
I guess they were too busy trying to hide their dirt under the carpet.
:-)

[CyberStrike]

No, I did not publish it.
I discovered it by accident.
I had ESET installed on one of my development machines (with sample submission disabled and so on).
I deployed there a new version of # and a few other files, for some penetration testing activity which should have remained internal to my lab.
Those files were all undetected by ESET.
After a couple of days, all those files where signed by ESET with very specific signatures (Win32/Backdoor.# etc.)
There is only one possible explanation about this: they stole all my files.
They steal users files, to provide an unfair advantage to their business, completely betraying users privacy.
I wrote them about this: got no reply.
I guess they were too busy trying to hide their dirt under the carpet.
:-)

hmm do you run wireshark/tshark or snort (or an IDS/NIDS) If so the pcaps would prove it perhaps my next weekend I will try to do some testing.

[Viotto01]

hmm do you run wireshark/tshark or snort (or an IDS/NIDS) If so the pcaps would prove it perhaps my next weekend I will try to do some testing.

I didn't, I don't know if their traffic is encrypted, it probably is.
Would be interesting to have a deeper look though ;)

[Nosfir]

Windows defender did re-enable itself (as a matter of fact it didn’t even turn off..(

[NYANxCAT]

Windows defender did re-enable itself (as a matter of fact it didn’t even turn off..(

Did you run it as administrator?

[Nosfir]

Did you run it as administrator?

No... as you said originally it wouldn’t be needed.

[NYANxCAT]

No... as you said originally it wouldn’t be needed.

Lol ok.

[QU⚡CKSILVER]

hmm do you run wireshark/tshark or snort (or an IDS/NIDS) If so the pcaps would prove it perhaps my next weekend I will try to do some testing.

I guess the connection to antivirus servers is indeed encryptd, but you don't need to analyze packets to determine if your computer is sending data to them.
Just monitor the amount of bytes sent by all the processes related to ESET while having sample submission off. If you see a considerable amount of data being sent, then they are clearly submitting stuff without you even knowing it.

It can be done with Procmon or process hacker, or even TCP View.

[CyberStrike]

I guess the connection to antivirus servers is indeed encryptd, but you don't need to analyze packets to determine if your computer is sending data to them.
Just monitor the amount of bytes sent by all the processes related to ESET while having sample submission off. If you see a considerable amount of data being sent, then they are clearly submitting stuff without you even knowing it.

It can be done with Procmon or process hacker, or even TCP View.

I think that my next weekend I will do some testing, I am pretty familiar with sysinternals

[Psychedelic.]

Damn. Looking through your posts, everything you’ve shared is super high quality. Keep up the great work.

[QU⚡CKSILVER]

So, I just got my hands on Windows 10 1903 Redstone 6, and found out that disabling Windows Defender using

Code

Set-MpPreference -DisableRealtimeMonitoring $true

No longer works if "Tamper Protection" Feature is enabled. I manually turned off Tamper Protection to verify, and Powershell was then able to successfully switch Real Time Protection OFF, and showed notification. Windows Defender re-enables itself after reboot, though. The registry solution does not work either. However, the rest of the components could be disabled with Tamper Protection ON, all silently without any issues.

TL;DR Tamper Protection was introduced in Redstone 6, which will prevent third party programs from touching the settings.

The following Registry key determines whether the feature is enabled or disabled:

Code

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features
0: Tamper Protection is disabled.
1: Tamper Protection is enabled.

Source : https://www.ghacks.net/2018/12/19/window...n-feature/