Microsoft Defender ATP for Linux is now generally available

https://techcommunity.microsoft.com/t5/microsoft-defender-atp/microsoft-defender-atp-for-linux-is-now-generally-available/ba-p/1482344

by doener • 6 years ago

113 105 6 years ago

techcommunity.microsoft.com

ecf• 6 years ago

Previous startup I was at had deployed the MacOS version of this and the entire Eng department had to petition to get it removed.

It randomly picks files to send to MS for analysis and hijacks 50%+ of the CPU to do it.

I legitimately don’t understand what it’s trying to accomplish other than another being a telemetry vacuum for MS.

mrath• 6 years ago

Very nature of this kind of software. Over years I have never seen a proper antivirus software work without coming on my way. Of course I have not used all of them but only the most popular ones. Locking files, 100 percent cpu usage, false positives are some known issues. In the last 5-6 years I have never seen it correctly report a threat, but that is just for me. I am sure it is working fine for some.

lukevp• 6 years ago

We use BitDefender, and it once deleted the main .exe of an internal website (after several months of no issues with the same exe) mid-day. It also flagged that exe and made it nearly impossible to restore, even with the quarantine feature.

oweiler• 6 years ago

Very nature of this kind of software. Over years I have never seen a proper antivirus software work without coming on my way. Of course I have not used all of them but only the most popular ones. Locking files, 100 percent cpu usage, false positives are some known issues. In the last 5-6 years I have never seen it correctly report a threat, but that is just for me. I am sure it is working fine for some.

We use https://www.crowdstrike.com/ and never had any issues so far. Very low CPU usage, no false positives. Not sure if it actually does anything ;).

nix236• 6 years ago

Trend Micro is really good, we had to use it and i was quite impressed on Linux and Windows (for a Antivirus), for the MS-Antivirus, just disable 'Automatic sample submission'

EDIT: But to be honest, Antivirus is just Old-school protection, it never detected anything outside 'already known viruses', Snort/Suricata on the other hand detected quite often that something is going on.

EDIT2: With "quite impressed" i mean, the performance was not much worse

mc32• 6 years ago

They pretty much all do that if you want the full functionality. They’ll tell you if you disable that that you’re little better than having no product at all.

m0xte• 6 years ago

It deleted my freshly code signed MSI the other day as well.

This is irritating but as mentioned a not unusual side effect. A good thing is they have sample submission that was fast and efficient.

nix236• 6 years ago

A good thing is they have sample submission

Wait...you think that is something good, they criticized Kaspersky exactly for that.

cordite• 6 years ago

This requires a “Microsoft Defender ATP for Servers” license. But it isn’t clear on how to obtain that

unsignedint• 6 years ago

As far as I know, it's a corporate tier of the Defender only available to corporate volume license customers.

I guess it's similar to the way many vendors have a "EDR" version of the malware protection as opposed to the consumer version, which often reserve Linux protection for the former.

mrits4• 6 years ago

Yes, AT in itself is going to be shelf-ware soon. The data collected from Defender is much more useful in some of their other offerings such as in their newer SIEM.

trollied• 6 years ago

I swear Microsoft are slowly putting all of the pieces in place for Windows LX, which will be a Linux distribution.

tw042• 6 years ago

If they truly wanted to go that route I think they’d just acquire canonical.

jedieaston2• 6 years ago

Why do you have to jinx it?

mikece3• 6 years ago

Why acquire Canonical when they can just create a Redmond Linux distro and cherry-pick the best aspects of RHEL, Debian, or Gentoo -- or just plain fork something out there now and add the option of Microsoft corporate support for any manager wanting to buy a throat to choke in case there's a production hiccup?

Or better yet: a Windows-like or Windows-compatible desktop that can run on any number of systems (and maybe corporate support is available for Debian, CentOS)? Let's not forget that the co-founder of Gnome has been working for Microsoft since 2016.

mikece3• 6 years ago

I can see only one scenario where it makes sense for Microsoft to buy Canonical: to prevent Amazon or Google from acquiring them and doing something anti-competitive (or as much as can be done legally in that respect) and making life difficult for customers using Ubuntu on Azure.

The comparison of relevance is Github. Microsoft was using Github so much already that the prospect of someone else buying them was an issue (not to mention the joke that buying Github was cheaper than paying for Microsoft's growing use of the platform). In practice, has Microsoft done anything to Github that has limited them in any way? The biggest change is that Github has a super-rich benefactor and they can offer free accounts to everyone now... and their budget for hiring/retaining top talent has been boosted as well.

Microsoft has more than enough money to do the same with Canonical and if they do I think it will largely be a matter of making sure Canonical doesn't need to worry about finances anymore and can hire whomever they need to build and deliver features. And yes, it's possible that Azure Linux applications might be available on Ubuntu first but extending and extinguishing Ubuntu would be massively opposed to making money on Azure -- I don't see Microsoft doing that.

Talinx• 6 years ago

Windows LX?

What about just the last letter: Windows X

Of course Windows 10 is the last major version of Windows, so you got to have that in the name: Windows 10X

Krasnol• 6 years ago

You may be right there

https://devblogs.microsoft.com/directx/directx-heart-linux/

loeg2• 6 years ago

That's just a passthrough for WSL VMs on Windows hosts.

mmm_grayons2• 6 years ago

I'd be pretty happy were I able to run office on linux (apart from 2010 version in wine).

loeg2• 6 years ago

Office365 works as well as it does anywhere.

mikece3• 6 years ago

You misspelled "WinX" and it was "leaked" fifteen years ago in Wired magazine.

https://www.wired.com/2005/02/microsoft-5/

ancarda3• 6 years ago

Is it open source? I can't find a GitHub link so I'm guessing it's not

aewens• 6 years ago

An open source antivirus program is a bit oxymoronic. Sure, people can contribute new means of stopping more attacks, but it also shows attackers exactly how to evade it. So you'd be losing more than you'd gain in that situation.

vuln• 6 years ago

Dang. I guess they better shutdown clamav.

https://www.clamav.net/

RMPR• 6 years ago

Security through obscurity (or security by obscurity) is the reliance in security engineering on design or implementation secrecy as the main method of providing security to a system or component. Security experts have rejected this view as far back as 1851, and advise that obscurity should never be the only security mechanism.

https://en.wikipedia.org/wiki/Security_through_obscurity

Edit: Link

skinney6• 6 years ago

I'm at a loss trying to capture the absurdity of this, but I'll try.. Smith finally escaped Oceania and made a nice home for himself in a free land with free peoples. One day agents from Oceania show up at his door. "No hard feelings bud. In fact we brought a gift. We think it will help you. We want to install these little black boxes all throughout your home." Smith is all ... "ok".

detaro3• 6 years ago

It's probably more "Our customers have policies/certifications requiring they have antivirus software everywhere, even if that's stupid. We could tell those customers that we can't offer a solution and they'll go somewhere else. Or we could make the thing they 'need' and get their business". Not very absurd at all.

ancarda3• 6 years ago

Can those customers not install ClamAV? Does that not count as anti-virus?

QuesnayJr• 6 years ago

I've experienced this at one workplace, and I had to install some anti-virus software on my Linux workstation. But it already existed. (It may have even been open source.) I'm not sure how it helps Microsoft to also introduce a product for this.

annoyingnoob• 6 years ago

Google Cybersecurity Maturity Model Certification

You may not want a product like this on Linux. But if you do business in the DoD supply chain, even way down the chain, then you will be required to do so.

de_watcher• 6 years ago

You've just defined an absurd and then said that it's not absurd...

AMerrit• 6 years ago

I work at a similar cybersecurity company and I can almost guarantee this is the case. Company policy will be to put an AV on everything, and the CSO/procurement always prefer a one size fits all solution so they only have to deal with one vendor. How well it works on Linux is secondary to the fact that it makes it easy for them to hit all the checkboxes in compliance reports.

unixhero• 6 years ago

This is absolutely the reality. Spot on mate. I am one of those people ensuring compliance. Even though it doesn't matter, I guess it's a compliance thing. For some businesses GRC matters!

fomine3• 6 years ago

In my experience, Trend Micro's antivirus is bullshit not only on Windows but also on Linux. I'm happy if MS Defender for Linux is available and corp adopted it.

ancarda3• 6 years ago

I think it depends if it's free (GPL/MIT/etc) software or not. Then it's truly a gift, rather than a black box

Though I have a hunch this won't be free software and will have all kinds of telemetry you can't disable.

jedieaston2• 6 years ago

I mean, it's designed to capture telemetry and push it into Azure for IT to figure out whats going on in the enterprise. It isn't aimed at consumers.

paulie_a2• 6 years ago

If this does what it designed for that is great.

The Linux ecoystem has consistently p it their fingers in their ears and stop informing the very real and long outstanding problems of malware and apts

ubercow132• 6 years ago

What about the very real and long outstanding problems of antivirus software?

badrabbit2• 6 years ago

Had to double check if we were reading the same post. This isn't meant for home users. It costs a lot of money and is targeting enterprise users. Defender ATP is like Carbonblack or Crowdstrike falcon which support windows and Linux. MS finally supports Linux to compete better. It's a great product but you need E5 license for it.

ghostpepper• 6 years ago

So it's not the same windows defender product given to consumers? What additional features does Defender ATP have?

jksmith2• 6 years ago

If MSFT figures out how to make this uninstallable on Linux, I will stop using computers.

smcl• 6 years ago

You mean non-uninstallable?

mrits4• 6 years ago

No, he's a HUGE Microsoft fan :)

msla• 6 years ago

Do people think Microsoft owns Linux now?

jksmith2• 6 years ago

Not own, but assimilate. Own the attention. GPL will have new perspectives after this is over with. For those of you who don't use Windows, try to uninstall the AV on windows 10. MSFT AV uses about 400 mb of ram on my Lenovo Flex 11 running windows 10. A bit of memory can be saved if you open admin powershell and run "Set-MpPreference -DisableRealtimeMonitoring 1"

art4ur• 6 years ago

Maybe, just don't install it?

nix236• 6 years ago

Nice that a proprietary software firm can stop you from using Computers...that is the wet dream of Apple ;)

cik• 6 years ago

Whilst I've never been a Microsoft user, it's refreshing to see these moves. For decades they've been an opponent of anything being OSS, let alone running on OSS. While the move isn't for everyone (heck, not me) it's still a very positive step, pretty much in line with Nadella's underlying strategy vis-a-vis Microsoft's newfound growth.

Security mandates such as PCI mandate running anti-virus and friends on a per host basis. They demand a 24-hour event review, FIM, etc. If tools like this come to Linux, it'll make it significantly easier for many organizations to start complying with these mandates. To be clear - these organizations already take security at best as a suggestion - these tools help reduce the barrier to entry so that at least the basics can be addressed.

I'd imagine that well over 95% of Linux users would never run Microsoft tools on Linux. At the same time, for those Windows shops that are experimenting with Linux, or need to support a few workloads, can't afford the dedicated expertise (yet) this is definitely a step forward to help them.

TheRealDunkirk2• 6 years ago

If tools like this come to Linux, it'll make it significantly easier for many organizations to start complying with these mandates.

You said a lot more than you probably intended. Microsoft created the Microsoft-loving, Linux-hating trade press in the 90's. Consultancies fell into line, and started pushing the theory to uncritical IT management that if you had a computer connected to the corporate network, it had to run a virus scanner. Period; full stop. Regardless of operating system.

I've never met anyone in corporate IT who actually does the math, and determines whether a particular threat vector is worth the cost of the preventative measure. The philosophy in the 3 Fortune 250's I've worked for has been: if it exists, it must be purchased/used/applied. In the 90's, yes, every WINDOWS computer connected to the corporate network needed the corporate AV running on it. Linux? Mac? Not so much. Even if they managed to get compromised, the chance that they would infect a neighboring computer were very small. These odds didn't justify the expense or the hassle of needing them to slaved into the corporate AV solution, no matter how much Microsoft diverted attention away from the very special problem that Windows has always posed from a security standpoint, how much they paid the trade press to paper over it, and how much they partnered with consultancies to push that line. They didn't care about the mainframe, did they? They didn't care about the Unix workstations, either. But Linux? It was the devil.

We have come full circle. Microsoft is trying their hardest to astroturf the message that WSL enables a lot of development workflows for which Windows has been a poor choice of late, and this requires them to "love Linux." So now Microsoft MUST release their Defender product for Linux, in order to be taken seriously BY THE VERY CULTURE THEY CREATED. As a guy who run Linux on the desktop for 19 years, and got my corporate IT (in the 90's) to consider Linux all the way to the point of them looking into a virus scanner for it (finding that Symantec didn't support it, and dropping the idea), the irony here is both delicious and sickening at the same time.

As I keep saying, I'll believe Microsoft "loves" Linux they day they create Office and an AD client for it.

jjice• 6 years ago

I wonder how much work would have to go into porting Office to Linux. My first thought is that since they've had it on MacOS for years now, it (hopefully) uses some portable UNIX libraries, but who knows. Linux still has a pretty small desktop market, and those who are on Linux are already used to (Libre|Open)Office or GoogleDocs. I'd like if Office came to Linux for the purposes of getting more people to potentially switch, but I don't know if it would be worth while for them financially.

Adobe too. Man would it be fantastic to see Adobe add support. Same thought pops in my head: they're already running on UNIX, how much would be required to port to Linux? Probably more than I expect.

zdragnar• 6 years ago

Endpoint protection- aka enterprise antivirus / hacking- has become a very big market over the past few years, And linux is a massive player in the server and cloud space. They would be fools to ignore it, no other conspiracy needed.

raghava• 6 years ago

As I keep saying, I'll believe Microsoft "loves" Linux they day they create Office and an AD client for it.

Exactly. Everything else is just a marketing gimmick. They don't even support interoperability between OOXML, thus crippling every other "enterprisey" user who might want to have usable content/data between their co-workers who might be using Windows

MS-Uservoice has ~500 comments on this topic since 2018, and no word from MS till now. [ https://office365.uservoice.com/forums/264636-general/sugges... ]

Guess they figured out WSL is an easy ticket to

- paint the picture that "MS <3 linux! Techbros, dont'cha see! Yeah!" - thus counter the "Hard for Ubuntu/Fedora/Linux users to use MS Apps!" argument by going "Know what, Ubuntu is within Windoze! No need to dual boot now! Wow! Such advancement!" and find a way to safeguard and maximize license/OS-aaS revenue

- no need to ever invest in interoperability for OOXML and such defined standards (this is a great lesson they have learnt from the LDAP-MSAD story)

- no need to bother much the "situation" of dual-boot - now there's a better way, by saying, "you could run Linux within, with full native suppirt, and no need to go out-of-band from your corporate security and compliance baselines! So much win, ya'see!"

Look beyond the gimmicks, and one could see it's just the same objective - just a different approach now.

Not just "Windows on every desktop" but rather, "all data-processings units in the world to directly be leading in one way or other to cause some kida revenue flow for MS"

ohthehugemanate• 6 years ago

I mean, they are in the middle of rewriting Office to use react native, specifically for cross platform compatibility. And Teams already has a linux client.

Regarding AD clients, what are you looking for that's not well covered by LDAP clients and all the AAD connection capabilities built into Azure? AKS runs RBAC based on bindings to AAD. Certainly for any server workloads, AD integrations are well covered.

Perhaps the clarification Yu out need is, microsoft loves Linux on the server. They don't particularly care about linux on the desktop.

ogre_codes2• 6 years ago

As I keep saying, I'll believe Microsoft "loves" Linux they day they create Office and an AD client for it.

Microsoft is a company, suggesting a company "Loves" anything is a misnomer. I say this because I sort of disagree here, but only kind-of.

Microsoft embraces ("Loves") the parts of Linux which are compatible with Microsoft's strategy. Linux on Azure is getting quite huge, it's the difference between Azure existing as a profitable business for Microsoft and Azure being a cost center. Microsoft does a fair amount to embrace Linux on the server, they support Docker, they do a lot of work with Node, and have a fair number of people onboard doing Linux specific stuff.

Linux AD & Office are only really important to desktop deployments and Microsoft has zero strategic interest in the Linux Desktop. If Microsoft were to port Office & AD to Linux Desktop, it would be an act of charity. If Microsoft is doing charity work, there are a lot of projects I'd like to see them invest in before AD and Office on Linux.

mrits4• 6 years ago

MS is leaving a lot of deals on the table without offering a Linux Agent. They've been using other companies to fill the gap. It's not a good look when the sales guy has to recommend a tiny startup to cover your other platforms for ATP.

It's also worth noting that they encouraged startups to offer ATP support and then within a couple of years killed them by offering their own.

greedo6• 6 years ago

Most PCI audits don't require A/V on Linux/nix types systems. The majority of assessors don't ding you if you don't deploy, and the DSS standard is pretty clear:

5.1 Deploy anti-virus software on all systems commonly affected* by malicious software (particularly personal computers and servers).

Since the majority of *nix servers aren't commonly affected, there's no reason/requirement to deploy A/V. Now this doesn't mean your boss won't require it, "just to be sure."

Beached• 6 years ago

you're a fool if you think Linux systems are not commonly affected. most compliance requirements do require you to have av on Linux too.

as someone in the security industry, my experience is that Linux servers are clearly more frequently affected than osx, and there are very few people left who would say osx doesn't have malware still.

just because a large compiled library of code doesn't exist and isn't commonly passed around doesn't mean it's malware free or even malware light.

compiled sttaic malware isn't common because it doesn't have to. rce is done on Linux systems an overwhelming majority of the time using native applications in the way they are meant to be used, just by the wrong people. (the attacker). the lack of quality security tool for the Linux environment is THE biggest concern mature security teams struggle with.

Linux is the most common internet facing os platform, and I'm here to tell you, if it's internet facing, it have threat actors targeting AND affecting it. the only reason Linux hasn't surpassed windows in how frequently is it the victim of malware/attacks is because of workstations.

29athrowaway• 6 years ago

Microsoft is investing in cloud, and this is meant to help their cloud business. In essence, this initiative is about that, not happy people singing kumbaya.

I would not install this since it talks to Microsoft servers. I don't want "telemetry" sent to them.

nix236• 6 years ago

Trying to bring the performance from Windows to Linux...love it ;)

EDIT: For the down-voter that was ironic, try copy lots of files from one Disk to another (in Windows) and during the copy-progress disable Defender...huge "performance" gain

fmakunbound• 6 years ago

Well, I downloaded the .deb file for MDATP, and right off the bat in the installation scripts, it's posting telemetry (literally, LogTelemetry in the scripts) to https://x.cp.wd.microsoft.com/api/report Then poking around in the giant .so and executable front end, you find a ton more.

What's it sending? Fucked if I know. I figured they couldn't help themselves, though.

deadso2• 6 years ago

I don't think people ITT understand what Defender ATP is supposed to be. It's not just an AV, but rather also has the ability to do threat protection across all your assets in the company.

It can analyze an attackers moves within your network, figuring out what files they accessed, ways they pivoted, and other stuff. So not only would it detect that you got compromised, but the display will show you likely paths, names of users that are also compromised, mitigation steps, deployed persistence measures, etc.

So for Defender ATP to work optimally in a deployment that leverages linux nodes, or has users using linux as their daily driver, you need to support linux.

mistrial9• 6 years ago

fixed it -- the product claims say "It can analyze an attackers moves within your network, figuring out what files they accessed, ways they pivoted, and other stuff."

mrits4• 6 years ago

Your statement would have been valid a few years ago. But now all AV providers also offer what you are talking about. AV+EDR with advanced threat hunting UI. So when you say AV today you should really think the other stuff as well.

deadso2• 6 years ago

Thanks for the info. Yeah, I'm not up to speed on the latest in the defense world. Good to know. I just felt like I had to bring it up because (at the time of posting) people were exclusively discussing the merits of an AV on linux (which is debatable) vs the value of EDR in a corporate environment.

TA43• 6 years ago

They provide it but often not in the same product capacity, a common structure would be Sophos & CarbonBlack - two separate products by different companies. Additionally they'd need a third product to cover the *nix estate.

Defender, in its current state, rolls all of the above into one at a relatively competitive price point. Additionally, it receives new detections built off all the telemetry they get as a result of Windows Defender existing on almost every Win10 OS on the planet.

This leveraging of data on such a scale is letting Microsoft quickly become the market leader for threat detection & response.

1MachineElf• 6 years ago

Seems like offsetting the potential for one kind of spyware in exchange for another.

microcolonel• 6 years ago

What does this actually do? The marketing material is decidedly vague.

mike503• 6 years ago

Feels ironic for Microsoft to announce security tools for Linux. Have always thought MS should turn Windows back into a window manager, not a fully-fledged OS, and use Linux as the base under the hood.

MintelIE• 6 years ago

What is this even? Like Snort? I haven't been knowledgeable about the Windows ecosystem since the Web 1.0 days.

Microsoft Defender ATP for Linux is now generally available

Related Stories