For one, because they come preinstalled. I bought a normal Windows laptop for a relative recently, it came with a 30 day trial of McAfee (I think) pre-installed. Once you install any anti-virus, the MS one is automatically disabled, so new users are given the impression that they need to fork out for a subscription once the 30 days is up, or lose virus protection.
Even more, Microsoft and the OEMs don't really go out of their way to explain this choice to customers. I work with a senior software engineer who recently came to me for help with his new PC after having purchased the full version of the included anti-virus software. He seemed surprised when I asked why he wouldn't just stick with the built in software from Microsoft. So I sent him a link from Microsoft's site explaining about Windows Firewall and Defender. He later told me he felt stupid for having been convinced that he had to purchase the full version of what came on the system or else he would be unprotected. I think it is Microsoft who is stupid for not pushing this message harder, especially in light of the recent developments such as this one. In some of these cases, we're seeing that by installing a third-party anti-virus suite, you're actually reducing the security of your system. I think Microsoft should be concerned that these companies are actually hurting their reputation further.
Microsoft certainly seems to be trying to combat the OEMs on this front, in so much as they can without angering their third-party partners or bulldozing the PC desktop/laptop markets.
Those of us with technical inclination need to be sure to point our family and friends with less technical inclinations to the Microsoft Stores and "Signature Edition" [1] PCs, Microsoft's latest marketing term for unbloated Windows installs out of the box. Some of our friends and families may feel they have a special relationship with an existing OEM, so give them the "Signature Edition" website and have them at least bug their OEM to ship them one.
I assume Microsoft couldn't push their own solution because of the anti-trust restrictions. Now that those have expired, perhaps they could unless they're afraid they'll get lawsuits against them again.
Is the PC & OS market still as MS-centric as it was back then? I know they still own the majority of the desktop, but with OS X out there, and more fragmentation to mobile, it feels like it would be much much harder to build an anti-trust case against Microsoft.
Globally, yes. I think parent was talking about the US market where OS X is slightly more prominent and according to StatatsCounter surpasses the market share of Windows XP and Windows 10 combined. Microsoft still controls 3/4 of the desktop market according to these stats, but that would probably not qualify as monopoly anymore.
That's really good advice but also hard to do because most OEMs stopped providing a reinstall option which doesn't reinstall their bundled software as well.
Here's the ArsTechnica guide for doing a clean install of Windows 8.1 – imagine walking the average home user through this process, even before you factor in discouragements such as the likelihood of tech support blaming any problem more subtle than catching fire on your reinstall:
This, in a nutshell, is a major source of Apple selling so many iOS devices – I regularly hear people say that it's easier to have a good, secure computing experience that way and they're not wrong.
OEMs figured out that they could build a custom recovery image with the bloatware included (including on Windows 8). Windows 10 supposedly lets you delete the package that includes the bloatware, but I haven't tried it.
Windows 8 and 10 also have a lovely feature called the Windows Platform Binary Table. This allows OEMs to write an application into the UEFI, and Windows will automatically deploy to memory and run it with admin privileges each time it boots. The intended use was for installing drivers and anti-theft agents, but of course it was immediately used to drop bloatware/malware. This vector works even on entirely fresh installs, and there is no mitigation except obtaining a clean, signed UEFI image.
Microsoft has strategic reason not to suffocate the other AVs completely. It's better to have multiple companies attack viruses on multiple fronts. If McAfee and ilk went away completely the onus would lie entirely on Microsoft.
Laptop manufacturers are also to blame because product bundling and bloatware are nothing new.
Microsoft on their part could make it so that Defender worked alongside McAfee but that might encourage users to buy McAfee even more, arguably (double the protection or not knowing they are already protected).
Lenovo are particularly egregious. They collect data from Conduit via their toolbar add on (Conduit is one of the worst malware makers out there - they are owned by Perion/CodeFuel). Lenovo refuse to disclose they do this, in fact I have support emails denying they do.
>Why not just use the Microsoft ones that are free?
reply
For one thing, last time I checked benchmarks they showed that Microsoft's anti-virus not only has worse detection results but also worse performance than some of the free alternatives.
On my two machines (with SSDs) I regularly find that copying lots of small files is severely slowed down by Windows Defender. It utilizes one core to the max and when disabling it, the copy operation gets a lot faster.
I don't know about other antivirus software though.
I can mirror this experience too. Properly working Intel SSD fwiw. Mine impacts not only file copys but also all small file I/O like listing directories (explorer would hang for 1 second entering a new directory) and the like.
I've had a couple users complain that my program started running really slowly while they were using Microsoft Security Essentials. It turns out that if a file contains a "suspicious" pattern of bytes (which in these two cases were two different user-drawn bitmaps), SE will do some time consuming heuristics every time you open the file. So opening, reading, closing a file 10 times in a row is really bad.
Yes. Microsoft, alone among AV vendors, shares any signatures it finds with every other major AV vendor, so everyone is going to find everything Microsoft does, plus what their own research turns up. That said, I don't think it matters enough to bother with the problems for-pay anti-virus vendors bring.
Did you read the document? The Microsoft product is quite good, but many of the paid ones are better. I don't know what problems you are talking about (I don't have any) - but that's a personal anecdote, we are discussing a proper comparison.
> I don't know what problems you are talking about (I don't have any)
the glaring security holes opened by them month after month? The HN link you're posting a comment to is about the 5th bad exploit in third-party AV this year alone.
So far nothing seems to have been found in the MS built-in one.
Installing third-party AV means that you expose yourself to targeted attacks and, if this goes on like it currently does, to drive-by attacks too as by now malware authors must have gotten the hint that searching for vulnerabilities in those various AV products is a very worthwile effort.
In general, AV products provide a HUGE attack surface: They don't just need to support natively many more file formats than any other piece of software, they also have to harden their support against exploit code purposefully written to be malicious.
And compared to many exploitable user-space applications, these AV products normally run in kernel-space, so an attacker doesn't just gain remote code execution, they gain remote code execution with admin privileges.
I skimmed it, I didn't see anything I haven't seen before. Notably they aren't grading on stuff like "number of popups that I have to click through to get it to quit nagging me." There's also been privilege elevation exploits using antivirus software.
EDIT: And there's anti-virus software that's messing with your system's root certificates so it can MitM all your HTTPS traffic to scan it:
Why is "worse" not OK but "better" is? Neither can be perfect and both will be far better than nothing. Just making up some numbers, but if the Windows AV can detect 80% of viruses and Norton can detect 90%, then you're still vulnerable to that last 10% whatever you do. You're also still protected from the majority of viruses whatever you do too.
I'll give you an interesting example. I was one day coding a keylogger for testing purposes. 100% original C++ code written by me based on Win32 API docs.
Compiled and ran the code and immediately Bitdefender blocked the program and put up a "Keylogger detected" message.
Microsoft built in antivirus doesn't have this kind of behavioral detection protections.
It does raise the bar significantly. There are 3-4 ways for system level keyboard monitoring, and all were detected. So a malware writer has to either disable the AV first, or hook individual applications one at a time instead of the whole system (and this exposes it to injection detection heuristics).
> Compiled and ran the code and immediately Bitdefender blocked the program and put up a "Keylogger detected" message.
Which is quite problematic because it was a false positive. You knew and wanted that program to log key presses.
That's the trouble with aggressive heuristics. Users are going to have a program that translates keyboard layouts by hooking the key presses. Or software that comes with some fancy input device.
Then the antivirus says it's a keylogger even though they know it isn't and the user is taught to expect good rather than bad things when they press "allow" against a something-is-wrong prompt.
I wouldn't call it a false positive, since it was definitely logging keys. I view it more like a sudo prompt.
From my experience there are very few legit reasons for intercepting keys, and the use cases you mentioned are better solved by implementing a device driver (which would be signed by MS).
Allowing non-elevated code to install system hooks also enlarges the attack surface, since now a malware piece can just infect your keyboard layout translator for getting keyboard access.
Me, I would like an Intent/Permission mechanism on Windows, where certain actions like keylogging or accessing other processes memory require explicit white-listing (like on Android/iOS). Currently some actions do require a certain privilege, but that privilege is granted per-user, not per-app, so it doesn't help that much.
> From my experience there are very few legit reasons for intercepting keys, and the use cases you mentioned are better solved by implementing a device driver (which would be signed by MS).
That's assuming you have control over what third parties who write the software have done, and needing to go through the expensive bureaucratic process to get a driver signed is a major reason why they wouldn't do it that way if there was any alternative.
> Allowing non-elevated code to install system hooks also enlarges the attack surface, since now a malware piece can just infect your keyboard layout translator for getting keyboard access.
But now you're not talking about antivirus anymore. Installing things is expected to require privileges. There is a huge difference between a password prompt that says "authenticate if you want to install" and a red alert that says "malware detected and blocked, override may cause fire and mayhem."
Which is especially problematic when it's done by third party antivirus because it means the vendor of whatever software is being misdetected as malware probably didn't encounter that in their testing.
> Me, I would like an Intent/Permission mechanism on Windows, where certain actions like keylogging or accessing other processes memory require explicit white-listing (like on Android/iOS). Currently some actions do require a certain privilege, but that privilege is granted per-user, not per-app, so it doesn't help that much.
Fundamentally non-technical people don't understand what they're authorizing. It doesn't matter how granular the choices you provide are if the person in front of the button doesn't understand the implications.
You have to be able to trust the software you run, which implies trusting the people who made it. And people keep trying to solve that problem centrally when it isn't a central problem. Microsoft can't tell you if you can trust your brother, or the girl you met at the computer club. They can't tell you if you can trust Lenovo or Sourceforge. Microsoft certainly can't tell you if you can trust Microsoft. You have to decide, or decide who to trust to decide for you. And if you aren't going to decide for yourself then the person you trust to decide can't be Apple or Microsoft, it needs to be someone you personally actually trust, because central gatekeepers can't be trusted not to act against your interest when it's in theirs.
That's not problematic at all. If I want the thing to run, I'll whitelist it and move on. Constant false positives would probably be a bad thing, sure, but any user advanced enough to be installing a keylogger deliberately is probably advanced enough to know the difference.
The alternative is that we don't see when a keylogger is being installed non-deliberately, and that would be worse IMO.
From what people I've talked to have told me - they don't trust Microsoft to secure the OS.
Plus, e.g. Comodo gives you a firewall. While I know that Windows has a perfectly good firewall, it doesn't come with a systray icon with a button labeled "protection from active network probes: active" or whatever.
Personally, I just have a router between me and the big bad internet and use Security Essentials plus Common Sense 2012.
It closes some too. Anti-virus software does not have to be perfectly secure (not to be confused with providing perfect detection!). To have a net positive impact on computer security, all anti-virus software has to be is quite literally better than nothing. That's by no means a given, but neither is the opposite: that using anti-virus is by definition worse than not using it.
They can't be bothered to do things that are actually effective, like reading installation dialogs fully, installing an ad-blocker, and avoiding the downloads from the sketchiest of porn and torrent sites.
It isn't (just) laziness. A friend of mine downloaded Google Chrome because they knew it was a secure browser to use... except that the search result page provided them with a poisoned installed full of malware.
If you're not technically inclined there are minefields everywhere.
I bought my father-in-law a new laptop, wiped it and installed it with just what said he needed.
Only to watch him say "I want to get vlc," type vlc into Google, skip over the VideoLAN - downloads link, and click some virus-infested link further down because the title of the link was "Get vlc."
VideoLAN - Official page for VLC media player, the Open ...
The other results are all either directly or almost directly associated with VLC. I get no scam sites in the top 10 results. Have the search results improved? Is this the effect of search personalization? What gives?
That was the top result for him, but the problem was it didn't say "VLC" right up front. I believe he grabbed what looks to be the 12th link when I use a private browser, but who knows what search personalization he'd picked up along the way, since he had logged into Google. I know it was at least half-way down.
Never underestimate the laziness of the human mind scanning for something. Now, I do think the text back then (1.5 years ago) might have said "VideoLAN - downloads" and that was all -- which is worse -- but I recall seeing "VLC" obviously in the description under the link, and it could have been in the link title.
Oh, well, then I understand. I wouldn't expect someone to actually read the description. Even I wouldn't underestimate laziness by that much :) I'm glad the VLC folks learned their lesson.
Another scary one: search for “Flash update”, “Java update”, etc. If you use Yahoo, Bing, etc. you'll have to screen past dozens of adware-or-worse links before finding the official sites – perfect for the next time a security exploit hits the news and viewers are told to upgrade ASAP.
People have reported this to various slackers for years but companies like Yahoo are loathe to turn down ad revenue and they still have millions of users.
Agreed, but it's still a lot of people in aggregate and I suspect it has a notably higher percentage of the inexperienced users who would be most vulnerable to this and probably aren't like to switch to Google / DDG any time soon.
MS Security Essentials detection rates are pretty poor, historically. Considering excellent products like Avast are free for the home user, I don't see why we'd recommend the MS one.
To be fair, MS has recognized this and has been steadily improving detection rates. It has only recently been able to outdo Avast or AVG. Hopefully, this trend will continue. I imagine MS is under a lot of pressure to contain the Cryptolocker-type infections and the bad press of the past couple years is probably a motivator.
Isn't this claim somewhat refuted by the very article you are posting against? There are other comments in this thread that explain why this doesn't make any sense eg pilif's above[1]
They both have detection rates in the high 90s, which is considered excellent, in general, and certainly so for a no-cost product. MSE only just edged out Avast.
The comment you listed cites nothing, not sure why its so authoritative to you. All software has vulnerabilities, but where's the big attack on AV? What CVEs are we seeing in the wild, if any?
