Microsoft Defender ATP is detecting yesterday's Chrome update as a backdoor
Microsoft commercial antivirus product is labeling Chrome's latest update as being infected with the Funvalget backdoor.
Microsoft Defender Advanced Threat Protection (ATP), the commercial version of the ubiquitous Defender antivirus and Microsoft's top enterprise security solution, is currently having a bad day and labeling yesterday's Google Chrome browser update as a backdoor trojan.
ZDNet Recommends
Best VPN services
Best security keys
Best antivirus software
The fastest VPNs
The detections, as can be seen in a screenshot above shared with ZDNet by one of our readers, are for Google Chrome 88.0.4324.146, the latest version of the Chrome browser, which Google released last night.
As per the screenshot above, but also based on reports shared on Twitter by other dismayed system administrators, Defender ATP is currently detecting multiple files part of the Chrome v88.0.4324.146 update package as containing a generic backdoor trojan named "PHP/Funvalget.A."
The alerts have caused quite a stir in enterprise environments in light of recent multiple software supply chain attacks that have hit companies across the world over the past few months.
System administrators are currently awaiting a formal statement from Microsoft to confirm that the detection is a "false possitive" and not an actual threat.
ATP is triggering on C:\Program Files (x86)\Google\Chrome\Application\88.0.4324.146\Locales\sk.pak
— Dark Defender (@ShadyDefender) February 3, 2021
Hey @msftsecresponse - Seeing lots of Defender ATP alerts this morning on C:\Program Files (x86)\Google\Chrome\Application\88.0.4324.104\Locales\sl.pak detected as PHP/Funvalget.A. Can you confirm this is a false positive? SHA256 in reply.
— W. David Winslow (@wdwinslow) February 3, 2021
Defender detected sl.pak as 'Backdoor:PHP/Funvalget.A'
C:\Program Files\Google\Chrome\Application\88.0.4324.146\Locales\sl.pak
Defender detected chrome.7z as 'Backdoor:PHP/Funvalget.A'
C:\Program Files\Google\Chrome\Application\88.0.4324.146\Installer\chrome.7z
— itquartz (@itquartz) February 3, 2021
ZDNet has contacted a Microsoft spokesperson before this article publication, seeking a formal statement on the ATP detections.
Chances are that this is indeed an erroneous detection, but until a formal announcement, administrators are advised to wait before taking other actions.
The free version of the Microsoft Defender antivirus, the one that ships with all recent Windows versions, has not detected the recent Chrome update as malicious, according to multiple ZDNet tests.
https://www.zdnet.com/article/microsoft-defender-atp-is-detecting-yesterdays-chrome-update-as-a-backdoor/?ftag=TRE-03-10aaa6b&bhid=21735961543072688253262375158449&mid=13255506&cid=717936240