zlacker

Firefox engineers discover a Windows Defender bug that causes high CPU usage

submitted by mconle+(OP) on 2023-04-05 18:48:25 | 630 points 215 comments
[view article] [source] [go to bottom]

NOTE: showing posts with links only show all posts
3. mconle+h3[view] [source] 2023-04-05 19:04:46
>>mconle+(OP)
TL;DR: Windows Defender had a bug that made certain system calls expensive on CPU cycles when Defender's Real-time Protection feature is enabled. After discovery, Mozilla reported this issue to Microsoft. Microsoft is releasing a patch that should result in lower CPU usage when using Firefox on sites like YouTube (a ~75% CPU usage reduction was noted when browsing YouTube in Firefox with the fixed version of Defender).

It seems like the HN submission form truncated the # from the end of the URL I linked to, which linked to the relevant comment. I'll try that here:

https://bugzilla.mozilla.org/show_bug.cgi?id=1441918#c82

and

https://bugzilla.mozilla.org/show_bug.cgi?id=1441918#c91

◧◩◪
46. ivanmo+rg[view] [source] [discussion] 2023-04-05 20:12:40
>>Cthulh+Gd
> Which is that?

I purchased a license of ESET Internet Security, and full disclosure: back in early 2017, I worked at an ESET-licensed reseller as a Presales and Support Engineer, so I know how to fine-tune it and all the ins and outs.

By nature, it's very lightweight (330 Mb RAM footprint), but you can fine-tune it even more if you want.

> And second, who here has ever had a virus in the past ten years?

We the people at HN are tech-savvy and of course will not get infected, but recently I spotted malware out-in-the-wild via Facebook Ads[0].

Your usual grandma/grandpa using the computer to connect with loved ones and play Candy Crush Saga will get infected, if they are not by now.

Some people tell me: "bUt tHaT'S BeCaUsE ThEy aRe vIsItInG WeIrD SiTeS," well, even if you stick to the common social media sites and usual news sites, you will get infected.

I cannot emphasize this enough, but you're responsible of your own computer so I will not proselytize you into purchasing AV software.

--

[0]: https://twitter.com/IvanMontillaM/status/1604308301579051009

◧◩
50. rascul+fi[view] [source] [discussion] 2023-04-05 20:24:13
>>marcod+b7
I just ran a test at https://browserbench.org/Speedometer2.1/

Firefox scored 89.5 ±1.7

Chromium scored 87.3 ±2.9

I guess that means Firefox did faster for those tests. I don't use Chrome or Chromium based browsers in general so I don't know how they compare in "feel".

I am on Linux.

◧◩
53. thewat+si[view] [source] [discussion] 2023-04-05 20:25:24
>>ravens+Df
There's a misconception that you need to do something "stupid" to get a virus which is simply not the case. 0 days exist, and worms are still a thing (looking at you samba).

A great example is Pytorch just recently had a supply chain attack, and installing the nightly version between December 25th and December 30th, 2022 - would result in your home directory getting uploaded including ssh keys.

Chrome also just had a 0 day 2022 - CVE-2022-3075

Pytorch supply chain attack via Triton 2022/2023 - https://www.bleepingcomputer.com/news/security/pytorch-discl...

EDIT: Also there's a misconception that linux somehow doesn't get viruses - however the Pytorch attack affected linux users. Making a virus for windows gives you far more targets then linux, which is why they're far more common.

◧◩
57. jodrel+Yj[view] [source] [discussion] 2023-04-05 20:33:15
>>mconle+h3
> “Windows Defender had a bug that made certain system calls expensive

It also has a bug(?) which makes method calls 100x slower in PowerShell 7:

https://github.com/PowerShell/PowerShell/issues/19431

◧◩◪
62. sfink+Bl[view] [source] [discussion] 2023-04-05 20:41:00
>>Diggse+Ad
My understanding is that until recently (January), V8 (inside Chrome & Edge) made a similar number of calls. The main use is making it so that JIT-generated code is not writable while it is executing. It's an important security measure. V8 switched to a more recent mechanism (memory protection keys) that have been gradually getting support from the various OSes. But IIUC, they switched off the mprotect/VirtualProtect calls unconditionally, and added in the protection key stuff only where supported, which suggests that they left some configurations without any protection at all. SpiderMonkey (in Firefox) has not yet switched to the cheaper mechanism.

I may have some of the details wrong.

https://source.chromium.org/chromium/_/chromium/v8/v8.git/+/...

◧◩◪
66. zokier+Jm[view] [source] [discussion] 2023-04-05 20:46:50
>>Cthulh+Gd
There are some performance benchmarks for AV products:

https://www.av-comparatives.org/tests/performance-test-octob...

https://www.av-test.org/en/antivirus/home-windows/windows-10... (less useful..)

AV comparatives has some other tests also that might be of interest to HNers:

https://www.av-comparatives.org/tests/uninstallation-test-20...

https://www.av-comparatives.org/tests/false-alarm-test-septe... (reason why you might not want to pick the fastest product..)

◧◩◪◨⬒
103. throit+jz[view] [source] [discussion] 2023-04-05 21:57:01
>>dylan6+df
https://www.youtube.com/watch?v=Uh64nPT7JWk
◧◩
126. bob102+KQ[view] [source] [discussion] 2023-04-05 23:35:50
>>consum+D5
> for energy use reduction

This can be a dangerous objective. There are already changes going into Windows 10+ regarding the OS scheduler [0]. Windows 11 is also noted as having an even more aggressive policy. How much longer before old games stop working correctly and we have to have MS-signed binaries to get 1ms timer resolution?

Obviously, we don't want to poll aggressively whenever we can avoid it, but there are also a lot of practical UX & technological reasons to have this capability.

[0]: https://learn.microsoft.com/en-us/windows/win32/api/timeapi/...

◧◩◪◨⬒⬓
141. jchw+Pa1[view] [source] [discussion] 2023-04-06 02:14:10
>>jbritt+sJ
By default, any application's memory can be read and written to by other processes running as the same user, as far as I know. The way to deal with this is to set process security descriptors, but admin can still bypass this. There are protected processes, and protected processes light, but those are not used by most software (mainly anti-malware afaik.)

https://learn.microsoft.com/en-us/windows/win32/procthread/p...

◧◩◪◨⬒
158. jdthed+Dm1[view] [source] [discussion] 2023-04-06 04:04:32
>>tomrod+op
*8 Billion sir

https://www.worldometers.info/world-population/

◧◩◪◨
172. gcp+rz1[view] [source] [discussion] 2023-04-06 06:13:29
>>psychp+Nc
Did you report this on Bugzilla? Even if it's not Firefox's fault if you don't report it no-one knows about the issue.

Recent versions of Firefox allow you to block some stuff like that: https://support.mozilla.org/en-US/kb/identify-problems-third...

Though it's possible they use different code injection tricks to make blocking impossible. (You can't block Defender from listening to events for example)

◧◩◪◨
181. botani+KL1[view] [source] [discussion] 2023-04-06 07:51:45
>>fsckbo+Wo
It's 200 million people, with 80% on Windows.

https://data.firefox.com/dashboard/user-activity

https://data.firefox.com/dashboard/hardware

◧◩◪◨⬒⬓⬔
184. accoun+gM1[view] [source] [discussion] 2023-04-06 07:56:38
>>codedo+5L
On Linux, ptrace permissions can be restricted [0] and some distributions do this by default.

Whether this provides any meaningful security is questionable unless you pair it with filesystem isolation to prevent malicious programs from modifying config files / bashrc / etc. Meanwhile it does make legit uses of ptrace more annoying.

[0] https://www.kernel.org/doc/Documentation/security/Yama.txt

[go to top]