Microsoft Defender silently uploaded 217 of a developer's unreleased builds
I caught Microsoft Defender uploading my unreleased software without asking
A developer built Hodometer, a Windows tray tool that tracks traffic by process, and discovered Defender's MpCmdRun.exe had sent 224 MB to Azure in a day. Event log 2050 showed 217 sample submissions over three months, mostly fresh builds of a Go test program. After disabling sample submission, the setting reverted within two hours. The logs also held full command lines with project paths.
I object to uploading my unreleased builds under that default. The absence of personal information doesn't tell Microsoft whether I'm willing to share the program.
- AngryData
Not surprised. Just the other day I found Defender using a significant portion of my CPU, which was curious because I have Defender disabled. Did a virus and malware scan thinking it was some other program calling itself Defender, nothing. Double checked windows antivirus settings, claims it is disabled. So off to google which leads me to more ways to hard disable Defender, and it worked confirming Defender was used as a screen by Microsoft for a more nefarious process. There is nothing legitimate defender could have been doing to be using so much CPU and memory when the antivirus capabilities were disabled.
So basically, paranoia confirmed.
- ryanjshaw
> I object to uploading my unreleased builds under that default.
How is Defender supposed to know the origin of an exe on disk?
- MiroslavPokorny
Please kill the background "green rain" animation after 10 seconds or something.