Leaked documents expose Avast antivirus subsidiary selling web browsing data

https://www.vice.com/en_us/article/qjdkq7/avast-antivirus-sells-user-browsing-data-investigation

by jeremiahlee • 6 years ago

759 192 6 years ago

vice.com

coldcode• 6 years ago

The power of customer data making money is hard to resist.

rkagerer• 6 years ago

The article seems a little sensationalized, but even viewed in a generous light it's still downright creepy.

...clients include Google, Yelp, Microsoft, McKinsey, Pepsi, Sephora, Home Depot, Condé Nast, Intuit, and many others.

It is possible to determine from the collected data what date and time the anonymized user visited YouPorn and PornHub, and in some cases what search term they entered into the porn site and which specific video they watched.

Although the data does not include personal information such as users' names, it still contains a wealth of specific browsing data, and experts say it could be possible to deanonymize certain users.

adossi• 6 years ago

Yeah it's creepy, but I wonder how that data is used? Like, what ads will Google show me depending on the type of porn I watch?

mikejb• 6 years ago

IIUC, porn is used as an example to highlight that these are very personal details that are being sold, and porn preferences are things people often fear more of leaking than - for example - their financial data.

John Oliver, in his work on the NSA scandal had Snowden explain individual NSA programs based on "dick picks", to help people visualize and clarify the consequences of what otherwise is just generically described as "selling/stealing your data".

nexuist• 6 years ago

Dating sites, for one.

_jal3• 6 years ago

Why concentrate on intended use? More interesting is what, er, unanticipated value-add might be there.

Could a malicious actor create a blackmail-bot? It wouldn't even need to be that great - just something a little more believable than the "I took over your computer and videoed you masturbating" spam.

Could more subtle, targeted blackmail operation involve this data? There is a lot of this sort of thing in politics.

We know PIs, bail-bonders and other folks on the fuzzy LE/commercial coercion industry line were heavy users of realtime cellphone tracking. I imagine the more creative ones have considered the value of these data pits, too.

vatueil• 6 years ago

For context, the sentence starts with:

Some past, present, and potential clients include...

Keyword "potential".

nabakin• 6 years ago

Exactly. That word makes me discredit the entire list.

Although, the subtitle does say

Its clients have included Home Depot, Google, Microsoft, Pepsi, and McKinsey.

palant• 6 years ago

The article is actually rather generous, particularly when it says "could be possible to deanonymize certain users." Having done my own research on that [1], I would have formulated this as "allowed to deanonymize most users."

[1] https://palant.de/2020/01/27/avasts-broken-data-anonymizatio...

rmist• 6 years ago

Avast was collecting the browsing data of its customers who had installed the company's browser plugin, which is designed to warn users of suspicious websites.

I have never really felt the need of antivirus plugins. Firefox's built in features (https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...) has always been good enough in my experience.

m-p-3• 6 years ago

And you can also help flagging those pages or malicious files by either submitting a phishing report[1] or uploading a potentially malicious file[2]

[1] https://safebrowsing.google.com/safebrowsing/report_phish/?t...

[2] https://www.virustotal.com/

lucasmullens• 6 years ago

I doubt anyone's installing the Avast chrome extension voluntarily. It's mostly just people forgetting to uncheck a box when installing some software.

roryokane• 6 years ago

No, Chrome and Firefox nowadays don’t allow extensions to be automatically installed and enabled. Any extensions running were specifically enabled by the user at some point.

I know this because I helped someone install McAfee antivirus a few days ago. Both Chrome and Firefox showed a small, non-modal popover on the next launch saying that an extension had tried to install itself. The popover contained two buttons, one for enabling the extension and one for keeping it disabled (Chrome) or uninstalling it (Firefox). If you never clicked inside the popover (as many alert-blind users might do), the extension would stay disabled.

klohto2• 6 years ago

The data is heavily anonymized and aggregated before selling. Avast is a Czech company under GDPR with regulators breathing on it’s neck. “Selling data to Google” is true as much as when my github project is cloned by Google guy and I claim it’s used by Google :)

It’s a free product and it’s written in T&S, why is Vice so sensational?

EDIT: Calm it, I was proven wrong about the EULA

tastroder2• 6 years ago

We regularly call out random browser extensions doing the same thing, it's not sensationalized to call out a top 10 manufacturer in the "security" space on this behaviour. Anonymization of search histories has, time and time again, been shown to be largely ineffective.

https://www.avast.com/eula does not mention Jumpshot and grepping around does not indicate any sensible anonymization and aggregation efforts, just the default legalese whereas the demo video on https://www.jumpshot.com/solutions/industry/retail leads me to believe that while they might not tie histories to a single user, they show statistics like "XX% of users shopping at A, went on to buy at B" which indicates at least some level of unaggregated data / tracking.

If the Vice article is to be believed, that's certainly enough to at least raise an eyebrow. The opt-in the article talks about is likely to be an underspecified mess that's intended to decieve the user, this functionality has simply no place in an AV package. Let's not act like it's hard to get users to press a shiny green button these days. That might be found GDPR compliant in court, it's still not morally right.

speedgoose• 6 years ago

No way this is GDPR compliant.

klohto2• 6 years ago

You’re correct about the EULA, any idea when it was last changed? I’ll look into this and correct myself but since I know few people working there, I heard stories about the process and how regulated it is.

pbhjpbhj• 6 years ago

I can see how the data could be anonymised but when Google get it the access time, coupled with the referer (sic.) info could completely de-anonymise some data for Google, eg you arrived there from a Google search.

stordoff2• 6 years ago

The data obtained by Motherboard and PCMag includes Google searches, lookups of locations and GPS coordinates on Google Maps, people visiting companies' LinkedIn pages, particular YouTube videos, and people visiting porn websites.
"It's very granular, and it's great data for these companies, because it's down to the device level with a timestamp," the source said, referring to the specificity and sensitivity of the data being sold
Jumpshot gave Omnicom access to all click feeds[...] The product includes [...] "the entire URL string"
A set of Jumpshot data obtained by Motherboard and PCMag shows how each visited URL comes with a precise timestamp down to the millisecond, which could allow a company with its own bank of customer data to see one user visiting their own site, and then follow them across other sites in the Jumpshot data.

How can you _possibly_ anonymise that at scale? Maybe someone searches an email address, or searches a unique phrase, such as a nickname, that identifies them. If someone makes multiple searches for directions from/to a particular place, it's probably their home or work. If you are logged in to a company's site, they likely know exactly who you are, and can correlate their logs with the Jumpshot logs (URL+millisecond timestamp could very well be unique) to follow you across other sites. The article notes that some products include "inferred gender" and "inferred age" - what _else_ can you infer from the provided data that may be enough to ID you?

Even if they _aren't_ directly selling it, it's a uncomfortable amount of information for a company to have (at best).

dgaudet• 6 years ago

Some past, present, and potential clients include ...

i'm having a hard time reading past the word "potential". that suggests exaggeration to me.

Mtinie• 6 years ago

It could be exaggeration, or “potential” in this case could include data from people and companies who expressed interest in the product captured during lead generation.

skocznymroczny• 6 years ago

Most antivirus software feels sketchy in general (snake oil).

The only antivirus I run at the moment is Windows Defender. For me the main reason is that Microsoft actually benefits from a virus free system because it improves Windows as a platform. Antivirus software vendors benefit from viruses spreading around because it improves sales of their products.

Also Windows Defender is fairly non-intrusive, it doesn't advertise a sketchy VPN, a sketchy adblock, a sketchy torrent or any other tool that usually anti-virus vendors try to bundle together.

nesky2• 6 years ago

Doubling down on this, I do the same and have had maybe 1 instance where Defender didn't catch something in what seems like the last 10 years I've used it almost exclusively for 'virus' protection.

lawnchair_larry• 6 years ago

How would you know if it didn’t catch something?

bsharitt• 6 years ago

Also Windows Defender is fairly non-intrusive

Microsoft and antivirus vendors have very different goals. Microsoft wants to quietly protect your computer without making a big deal out of viruses, while antivirus vendors always want to let you know that they're hard at work protecting you and that the world is a dangerous place so keep giving them money(or in the case of free versions, keep it installed so they can keep vacuuming that data).

Brave-Steak• 6 years ago

I think one of the worst parts of this kind of stuff is that paying for the product doesn't mean they stop selling all your data. It just means they make even more money off of you.

JohnTHaller• 6 years ago

In the case of free versions, keep updating it so they can sneak Google Chrome onto your system using dark patterns (which Google pays them to do).

blablabla123• 6 years ago

the world is a dangerous place

True, as long as keeping outdated software/practices is facilitated. The attack surface is relatively small if someone installs only apps from an App Store - no matter which one that is - and from well-known vendors.

That said, Microsoft has created a nice breeding ground for viruses by keeping all the software backwards compatible but accepting that users might need to get new hardware for every major update. At least the major updates have become quite cheap...

zojirushibottle• 6 years ago

funny, i said the same thing before but it came off wrong and people didn't get it or something. i only run windows defender too, not because it's efficient -- i don't know, i have never seen it catch anything -- but because it's the less sketchy of the bunch!

cypressious• 6 years ago

Agree with the non-intrusive part. However Defender does slow down programs that do a lot of filesystem IO. I tend to disable it when I update bigger programs or run other IO heavy tasks.

tiernano• 6 years ago

As a dev house, I agree on the io, but our solution is to add our dev folders to the exclusion list. One of our build times went from 10min to start a debug to less than 1min...

duxup• 6 years ago

The non-intrusive factor was huge for me.

I remember when it came out and it would scan away and do it's thing and it was pretty much noticeable. I was "yeah this is it" uninstalled whatever I was using at the time and never looked back.

That was a big plus in a market where as you say everything feels sketchy.

Ansil8493• 6 years ago

For me the main reason is that Microsoft actually benefits from a virus free system because it improves Windows as a platform.

From the article:

Some past, present, and potential clients include Google, Yelp, Microsoft, McKinsey, Pepsi, Sephora, Home Depot, Condé Nast, Intuit, and many others.

Microsoft doesn't need its AV products to do shady data collection because it outsources this to third-party shady AV products, therefore keeping its own reputation clean as your post demonstrates.

CPLX• 6 years ago

The word potential is doing a ton of work in that sentence.

chapium• 6 years ago

Microsoft can collect information through their OS, why bother with doing it in AV.

scott_s• 6 years ago

I think that has been the conclusion for a while. I went poking around for old stories, and the best I could find was a thread from 2016: “AV is my single biggest impediment to shipping a secure browser,” https://news.ycombinator.com/item?id=13079569

And a follow-up, "Avoid Non-Microsoft Antivirus Software", https://news.ycombinator.com/item?id=13489100

I believe there have been academic studies on the non-effectiveness of antivirus software, but I can't find them. (If others can, I'd like to read them.) I find the argument that antivirus software increases attack surface compelling because it's third-party software that tries to get into everything. This is not the '90s anymore; all of the big players care about security. I think that the engineers at Microsoft, Google, Apple and Firefox are more qualified to secure their own software than outside vendors are.

BlueTemplar15• 6 years ago

Well, in the 90' things weren't nearly as bad, since hardly anyone even had an Internet connection...

safog• 6 years ago

I think there's several different underlying causes to Windows feeling more secure (not needing antivirus) these days:

1. Security on desktops has been improved quite a bit. You can no longer simply email someone a .exe file that's the equivalent of `sudo rm -rf /` and have it work, multiple levels of safeguards (from the browser, to the email virus scan to windows defender catch it). OS's also simply won't run unsigned binaries anymore unless you force them to which is (maybe?) a good thing.

2. Piracy has been on a downtick, and people seem to be more open to paying for software since App stores made it somewhat more acceptable. Less likelihood that people download sketchy binaries off the internet and run them on their PCs.

3. More hours spent on mobile OSes which are inherently more secure. casual PC usage at home is declining.

silicon24012• 6 years ago

speaking of this, is there a recommended way to run a windows binary within Ubuntu 18.04? I don't want to dual-boot windows because I read that installing windows after ubuntu isn't recommended, but I don't have experience running a windows environment within Ubuntu either.

ticmasta• 6 years ago

This is the same logic motivating me to (infrequently) buy Windows computers from the Microsoft store. They don't benefit from a brand-new Windows PC that runs like molasses so they don't have any bloatware* or other performance slowing software like a Dell PC or worse, your typical Best buy computer. The prices are on-par despite not getting the kickbacks where most manufacturers generate the majority of their profit.

* except for that which is or comes with Windows. Unfortunately this has grown substantially - Windows 7 seems like something of a high-water mark for performance/polish/lean...

rapind• 6 years ago

Except that M$ was bundling ads and apps in Windows 10 (a paid OS) themselves. It's a sad state where other actors are so terrible that MS starts to look like a savior.

the84724• 6 years ago

One issue with all antivirus on windows, including defender, is the performance impact. It seems to be dreadfully single-threaded, or at least make single-threaded workloads even worse. Monitoring CPU use during updates easily shows this, there are periods where a single core is busy with the defender service and nothing else is happening.

Another issue that while microsoft's incentives may be better aligned it still fundamentally is an antivirus and thus an increase in attacksurface. There have been exploits against it[0] and it turned out that it did things with SYSTEM privileges and no sandboxing.

[0] https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...

BlueTemplar15• 6 years ago

If only one core is busy, then it shouldn't have much of a performance impact?

KumarAseem2• 6 years ago

What is there to prevent Microsoft from not having Defender monitor and report the traffic back to MS once it has gained a big foothold? MS with Win10 forcefully collects a lot of data and adding a little bit of data through Defender will give them a really huge(complete) picture.

BlueTemplar15• 6 years ago

What would using Defender add to what they can already get?

smrtinsert• 6 years ago

This just feeds my conspiracy that all antivirus companies are worse than the viruses themselves.

beart• 6 years ago

I've often felt that antivirus software is like the rock that keeps the tigers away. I haven't used it since the AOL days, and that's also the last time I was actually hit with Malware (something from Kazaa I would guess.)

It's also worth noting that every corporate IT department I've ever seen installs antivirus software on employee machines, so it must be good for something? I'm curious what the actual statistics are for caught viruses.

Spooky234• 6 years ago

For corporate IT, it’s a compliance requirement. It is the equivalent of putting a sign in the bathroom that says to wash your hands, only less effective. AV does almost nothing and costs almost nothing.

The newer products are different and more effective, and come with an appropriate price tag. (The Microsoft solution costs as much as O365!)

52-6F-622• 6 years ago

For corporate IT, it’s a compliance requirement. It is the equivalent of putting a sign in the bathroom that says to wash your hands, only less effective. AV does almost nothing and costs almost nothing.

Corporate IT at my previous employer even allowed and aided us in uninstalling the resource-hogging McAfee installation that comes default with a company machine. That stuff was crippling our machines.

guelo• 6 years ago

Comply with what?

freehunter4• 6 years ago

For those that might not understand the compliance requirement, PCI compliance is a good example. If you process credit card payments, you need to be PCI (Payment Card Industry) compliant. And PCI DSS Requirement 5.1 [1] states

Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers).

So most enterprise companies have to have AV on their workstation and servers (yes Mac and Linux too) in order to keep processing credit card payments.

[1] https://www.pcisecuritystandards.org/documents/PCIDSS_QRGv3_...

magduf• 6 years ago

It's also worth noting that every corporate IT department I've ever seen installs antivirus software on employee machines, so it must be good for something?

Yes, it absolutely is good for something. Antivirus software is excellent for making companies like McAfee highly profitable, and it's also really good for slowing down your computer.

lotsofpulp• 6 years ago

It’s to let the higher ups cover their ass by being able to say they tried to do prevent malware.

saiya-jin• 6 years ago

Owners of the Avast, 2 Czech guys, are ranked among the wealthiest Czechs ever. I mean one has net worth over 1 billion USD, the other at least the same.

I had some respect for them some time ago, but these days their product is shit and worse than having nothing. Plus with Windows defender, who still actually pays for it?

finnh• 6 years ago

It's good for meeting compliance requirements.

avh02• 6 years ago

probably for checking various compliance tickboxes

flir• 6 years ago

Well... do you want to stand up in court some day and explain why you didn't install A/V software? It reduces risk, just maybe not the risk we expect it to.

BlueTemplar15• 6 years ago

Well, after this, it's pretty clear that "anti-virus" software is itself malware, so this should not be an issue ?

johngalt• 6 years ago

Sysadmin here. We install AV to tick the box. It doesn't add much to the security equation, and hasn't for years.

For prevention, limited roles/access and patching does all the heavy lifting.

Detection happens on the server and network side. Otherwise we are expecting a compromised device to know/report itself.

Remediation is a wipe and reload from known sources. When properly automated it is faster than running a full AV scan, and much more reliable.

notyourday4• 6 years ago

Sysadmin here. We install AV to tick the box.

Ding! Ding! Ding!

Does your company need to accept credit cards? Guess what? You must have AV as there are only two choices in a self assessment form:

[ ] Anti-virus and anti-malware software is deployed on all systems used by the company staff.

[ ] Anti-virus and anti-malware software is not deployed on all systems used by the company staff.

Selecting the 2nd makes one fail self-assessment which in turn denies company's ability to accept credit cards.

Security is a charade.

jcranmer• 6 years ago

Antivirus was more necessary back in the days when firewalls and security elevation privileges were rarely enabled on consumer machines. But more modern security software has rather weakened the value proposition for AV, and they've started branching into areas that aren't really helpful at all and sometimes counterproductive (e.g., web browsing protection--your AV does a much, much worse job of validating TLS than browser vendors do).

Given the dirty things that AV does to "work" correctly, you can characterize modern AV as malware that tries to keep other malware out.

tptacek• 6 years ago

I don't think this is true. Generally, I think that privilege levels are a red herring, and that being able to get malware running at the privilege of the user installing it is sufficient; to the extent that this is changing, it's changing only recently.

I'd say that the problem with AV is that it has never worked at all; it's always been a "deck chairs on the Titanic" performative spot clean situation – at best, a smart team that reimages a machine with a confirmed "infection" can say they're using AV as a weak sort of host intrusion detection system.

AV or no AV, for as long as I can remember (back into the 1990s), if your desktop is "infectable", you're screwed. You'd think that the Summer of Worms would have confirmed that for everyone, but AV is an extremely powerful marketing product category, because of its built-in per-seat multiplier.

Sophistifunk3• 6 years ago

Corporate AV is like the guy who makes you throw out your ware bottle at the airport. It's a delicate blend of ass-covering and theatre.

_jal3• 6 years ago

Kind of amusing that this is currently the #2 story, while #1 is "Trust Is at the Core of Software Marketing".

If you had told me five years ago that I would stand up exfil monitors on my home network because commercial and criminal surveillance was so pervasive, I would have said that would be crazy talk. And yet here we are.

dredmorbius3• 6 years ago

What are you using for this, what is blocked / how do you construct blocklists?

_jal3• 6 years ago

This is very much a new work in progress.

Basically, DNS logging forwards to a daemon I wrote that detects Base64/UU/other encodings in DNS requests and asks the network manager[1] to shut off connectivity to the client asking such questions. There is a volume-of-queries timer, and I have some other ideas to add to it.

I'm working on a TLS-inspecting proxy with squid and sslsplit, as I expect there's a lot to look at. I very much want to know if something emits any of various magic numbers - SSN, bank account numbers, address book entries, IMEIs, etc.

As far as more general blocking, I use parts of Pihole, which merges with some other data sources, to defeat DNS resolution for folks I don't want on my internet. And I use Maxmind's geoip data to generate iptables rules to block most of the world on public facing infra - my tiny user base is not in most of it.

[1] I use Unifi gear, this will do you no good if you don't: https://github.com/Art-of-WiFi/UniFi-API-client

ropiwqefjnpoa• 6 years ago

Does this include AVG for Business? I dropped them just over a year ago.

dessant3• 6 years ago

Here's the rejected Firefox blocklist request for Avast extensions: https://bugzilla.mozilla.org/show_bug.cgi?id=1600600

Blocklisting the extensions would disable existing installations and stop ancillary data collection, which is prohibited by Firefox Add-on Policies.

https://extensionworkshop.com/documentation/publish/add-on-p...

Mozilla expects that the add-on limits data collection whenever possible, in keeping with Mozilla's Lean Data Practices and Mozilla's Data Privacy Principles, and uses the data only for the purpose for which it was originally collected.

There are a number of browser extensions maintained by antivirus companies that use security as a disguise to collect and monetize user data. It is time for Google and Mozilla to act on this issue and protect users from these predatory practices.

Benign extensions that are genuinely useful and don't have a company behind them do not get this treatment [1], they are blocked whitout preliminary contact with developers [2].

[1] https://www.jeremiahlee.com/posts/page-translator-is-dead/

[2] https://www.ghacks.net/2019/11/05/mozilla-bans-all-extension...

horsawlarway• 6 years ago

I want to second this sentiment and EXPLICITLY call out Mozilla.

I am the lead dev for a relatively small Firefox extension. We do not do ANY tracking.

We were rejected and removed for simply including the sdk for Microsoft outlook addins as a script in one of our html pages (we share the codebase for an outlook addon as well). This script is well documented and published by Microsoft.

I find the hypocrisy here staggering.

I know that Firefox gets a lot of love, particularly on HN because it feels like Mozilla is still a trustworthy company. I want to clearly express that I no longer believe this. They want addons in the store that they can use for marketing and sales. Period.

minewastaken• 6 years ago

https://digdeeper.neocities.org/ghost/mozilla.html

This article, along with some other sites and my own digging made me leave Firefox for good. It's a good read if you value privacy and think Mozilla is the good guy in a field dominated by evil corporations. At first it might seem biased, but the author makes very good points and backs them up with tons of sources that can't be really argued - most of the article is reviewing privacy policies and terms of service agreements that are available publicly to check.

For now I stuck with Pale Moon, but I'm considering some other browsers like Ungoogled Chromium for my daily private and work use. Pale Moon feels kinda janky and old-school in a not good way. But it's fast and (with some minor tweaking: https://spyware.neocities.org/guides/palemoon.html) respects your privacy 100%.

gnicholas2• 6 years ago

Thanks for posting this. I have had similarly odd experiences recently with the Firefox addon store, which my startup has been in since 2013. All of a sudden we got yanked, among other things because we modify third party libraries. Apparently we would have been fine if we did exactly the same thing but wrote the code ourselves, but since we used a library, and then modified it, we were in violation. To be clear, we provide all our source code in the review process, so it is 100% clear what we are doing. And we don't do anything that is remotely privacy- or security-compromising, which is very clear from the code.

We tried to understand this bizarre no-modifying-third-party-libraries policy and see how we could fix it, but they stopped responding and eventually even deleted our extension from the browsers where our users had previously installed it. (Even Apple doesn't do this when it yanks apps — only rarely if there is proven bad behavior will the pull an already-installed/paid-for app from a device.)

I happen to know a couple very high-up people at Mozilla, and one of them was able to flag our mistreatment, and the reviewers now seem to be walking back the previously-described global ban on modifying third-party libraries, but we're still not back in the addon store (it's been months).

The (alleged?) policy makes no sense to me, and I also don't understand why Mozilla is now blocking users from installing any addon that hasn't been blessed by Mozilla. I understand that they want to vet addons that are listed in their store, but they've assured me that users can't even install off our website unless Mozilla signs off. That seems very un-Mozilla-ish to me. What happened to the open web?

For the record, I used to love Mozilla/Firefox, and have used their browsers for decades. I now use Brave, both because of experiences like this one, and because it's much faster on my Mac.

bagacrap• 6 years ago

isn't this generally true of every extension/app/smart appliance? Everything wants to collect and sling your data on the side. Browser and phone vendors do try to protect users with permissions controls in addition to the store curation that you point out is imperfectly executed. How do you propose they enact a perfect system of vetting for the long tail of benign extensions?

dessant3• 6 years ago

Equally enforcing policies regardless of who's the publisher of an extension would be a good start.

This is how the Avast blocklisting request should have been handled:

- Immediately blocklist [1] the extension because it harvests personal data without user consent, notify Avast

- Offer to reenable the extension for the existing user base when Avast reaches out and stops data collection in an extension update

Because the extension was not blocklisted, but temporarily removed from the store, personal data was siphoned off without the consent of existing users for weeks, with the knowledge and implicit approval of Mozilla, until Avast has released an update.

Users that have configured Firefox to update extensions manually may continue to use an extension version which steals personal data, despite Mozilla being capable of disabling those extension instances, and despite their recent commitment [2] to use blocklisting more proactively when an extension is circumventing user consent or control.

Mozilla did not respect its own policies and has put the interests of Avast before the privacy and safety of its users.

[1] https://blocked.cdn.mozilla.net

[2] https://blog.mozilla.org/addons/2019/05/02/add-on-policy-and...

monadic2• 6 years ago

Well they could start by banning extensions that make the news for sending all of their visited urls to a third party.

Ultimately we need to give the user more control over what software on their system is doing. None of these entities (mozilla, google, apple, microsoft, amazon, facebook) can be trusted to act in our best interest

MrGilbert• 6 years ago

Same. We have a desktop application with ca. 14.000 installs, which requires a companion extension either for Firefox or Chrome.

It has been taken down occasionally, mostly months after the last version got released.

What annoys me most is that this happens out of the blue. There is no „pre-warning“.

The last times this happened, we told our customers to use Chrome instead. Never had a problem with them.

gnud• 6 years ago

Now, this really scares me. Not because it's a false positive. Those are bound to happen.

But if the takedown really happens months after the last update, then that would mean malicious add-ons are left on AMO for months?

chinathrow• 6 years ago

Avira Free just installed Avira VPN while updating a client to Win 10 recently, I assume that they're after data collection too.

That was the last straw - Windows Defender only at this point of time.

js8• 6 years ago

I work in Prague and I know some people who work for Avast. It's an open secret that the company got pretty rich on selling customer data from their antivirus (that was before GDPR, though). I am glad that somebody confirmed the rumor.

lousken2• 6 years ago

Eset and Windows Defender is pretty much the only two antiviruses left that I still kinda trust. The rest has become either bloatware or straight up spyware.

tomaskafka3• 6 years ago

Why would you trust Eset? Once they can monetize the user data (and every AV/browser company can), their shareholders will compel them to do it.

alibert2• 6 years ago

They do only paid AV and, for what it's worth, Google has included the Eset AV engine in Chrome (Win only).

lousken2• 6 years ago

Well e.g. they don't spam you with ads for their other products. They like to say that your PC is slow and show you their nice tools that should fix it (although I know avg does that, not sure if avast too, but they're supposed to be the same thing now). People tend to freak out if they see something like this popping out of taskbar. Eset doesn't do any of this and keeps quiet unless there is a problem.

Also don't add snake oil parts to their products like registry cleaners and install extensions. The most obtrusive thing they do is probably MITM TLS connections which I don't agree with but at least kinda understand.

As for the data monetization, you can compare privacy policy of those two companies https://help.eset.com/eav/12/en-US/privacy_policy.html vs https://www.avast.com/products-policy . They speak for themselves.

inkeddeveloper2• 6 years ago

Is it bad that my first reaction is, "Of course."

zentiggr• 6 years ago

Nope, just confirms you're seeing reality.

sct202• 6 years ago

My dad had me remove Avast (that he paid for) from his laptop over Christmas because he started to get mailers based on his browsing activity. It literally locked up his computer for an hour uninstalling and giving prompts that would try to get you to accidentally cancel the uninstall.

AJ007• 6 years ago

You should send this to the Vice authors.

I emailed some journalists about Jumpshot a few years back. It’s good that everyone now understands what is going on.

BlueTemplar15• 6 years ago

Sigh, and I have been trying to warn mine since the summer, but it's going to take something even worse than that I guess...

jannes• 6 years ago

I don't use Avast myself (for obvious reasons), but how do they get around HTTPS encryption? Do they install a self-signed root certificate into the OS/browser? Wouldn't that be easily detectable?

RL_Quine• 6 years ago

If you’re injecting into the browser you don’t need to worry about SSL- that’s handled for you.

stordoff2• 6 years ago

They can instruct the browser to log/leak HTTPS keys: https://textslashplain.com/2019/08/11/spying-on-https/

NB this article also notes the selling of data - from the article it cites:

Jumpshot is the data arm of Avast[...] This suite of products, in order to function, must collect and analyze every URL visited by every browser of every machine on which its installed. [...] Because Avast has to see and process all these URLs anyway (in order to serve their function of providing web security), they anonymize, aggregate, and remove any personally-identifiable information from the browser URL visits and then provide them to Jumpshot, who then makes estimates about broad web usage behavior. In my opinion, this is both an ethical way to gather crucial data about what’s happening on the web[...]

tomaskafka3• 6 years ago

They aren't "making estimates about broad usage behavior", they just sell the raw clickstream. Amd lie.

nif2ee• 6 years ago

Most B2C privacy/security based companies are either snake oil or outright scams.

s_dev• 6 years ago

Can we discuss how ridiculous PCI compliance is to require anti-virus softare? Particularly in mac OS where anti-virus software is the primary surface area for introducing viruses.

Why hasn't this requirement been updated to somthing more sensible?

reaperducer3• 6 years ago

From your mouth to God's ear.

IT installed freaking Norton on all of my new Macs. Now I feel less safe, and I get the software nagging me all the time.

GordonS• 6 years ago

Keep in mind that PCI requirements only apply to machines within the cardholder environment - everything else is out of scope.

What this means is that as long as you isolate your cardholder environment, you don't need to deploy AV across your whole company - only on those in scope.

I'm not a huge fan of AV, but I do advocate for a layered approach to security, and have to concede that AV may have some value as a "last chance" layer if malware somehow manages to get past your other defences.

ggregoire• 6 years ago

How are the AV companies still alive with Windows Defender installed on every Windows since like Windows 7 or 8?

kijin• 6 years ago

Windows Defender is a little too understated IMO. Most people don't even know that it's a decent antivirus.

I wouldn't mind if better marketing for Windows Defender made a bunch of shady antivirus companies go bankrupt, but Microsoft probably doesn't want to get into another round of antitrust lawsuits.

reaperducer3• 6 years ago

How are the AV companies still alive with Windows Defender installed on every Windows since like Windows 7 or 8?

Apparently by selling your information.

mywittyname4• 6 years ago

Computer salesman have talking points about how WD doesn't catch 95% of virus out there. Of course, they leave out the part about how WD focuses on the 5% of viruses actually found in the wild, as continuously surveyed by Microsoft, not the 30k variants of known viruses that are not relevant to a Windows 10 machine.

My go to is to say, the security lead for Google Chrome once tweeted, "the biggest impediment to implementing a secure browser is AV software."

alibert2• 6 years ago

I saw that quote being posted quite often in HN. I always smile at this because Google Chrome (on Windows only) includes a cleanup tool based on an popular AV engine.

https://www.blog.google/products/chrome/cleaner-safer-web-ch...

https://www.eset.com/int/google-chrome-cleanup/

markosaric• 6 years ago

Avast/Jumpshot data is bought by many marketing companies too and packaged as SEO tools, market research/analysis. They've been really proud to talk about their ability to collect all this data in the past [1]. But recently it became clear that all the data is stolen without user permission.

[1] "Jumpshot Knows What You're Buying, Browsing, Searching" https://www.cmswire.com/digital-marketing/jumpshot-knows-wha...

BlueTemplar15• 6 years ago

Puts the popcorn in the microwave.

_bfhp• 6 years ago

I just tried to uninstall the Avast desktop software, but "avast.hub" and avast "worker" processes remained running even after the "Uninstall Avast" process quit.

Probably just incompetence... Probably!

Sophistifunk3• 6 years ago

Probably just incompetence... Probably

Right. Just like Zoom.

sagunsh• 6 years ago

I don't use any antivirus software now a days. They basically seems to slow down the computer (I am not quite sure about this) but here I got one more reason not to use one. I guess qindows defender is okay and sufficient for most of the cases and you can always switch to Linux.

rafaelvasco• 6 years ago

Yeah, I stopped using AV in Win7. Never looked back;

drewrem11• 6 years ago

PCMag article talks about how Avast's 'de-identification' of the collected browser histories can fail and be used to by third-party companies to link your web clicks to your real identity https://www.pcmag.com/news/the-cost-of-avasts-free-antivirus...

asasidh• 6 years ago

If you are using a product that dials home, paid or otherwise, you have to assume it is collecting and selling your data.

jacquesm• 6 years ago

AV software acts like and treats your computer pretty much the same way that malware does, it should not be surprising the companies do the same.

They're in Prague, would be nice to see the teeth of the GDPR used to put the fear of god into parties in this space. Maximum penalty times the number of clients they had should do the job nicely.

catalogia• 6 years ago

Is there any chance what they're doing might fall under some sort of 'unauthorized access' computer hacking criminal law? Something that could get individuals sent to prison rather than just getting the company fined? There is no way they had meaningful informed consent for any of this.

I don't think shit like this will stop unless executives and the engineers who humor them start getting their lives justifiably destroyed.

BlueTemplar15• 6 years ago

Maybe, if government computers were involved ?

annoyingnoob• 6 years ago

I thought this was well known. I wrote code to ingest Jumpshot data years ago. You have to wonder about the quality of the data though - maybe those using Avast aren't the best measure of all things web related.

jammygit• 6 years ago

Anything named an antivirus should be possibly to sue for this sort of thing, right? It could not possibly be more misleading

It’s like a locksmith company monetizing by sneaking people into your home when you’re asleep

bradknowles3• 6 years ago

That would be William Brodie. See https://en.wikipedia.org/wiki/William_Brodie

Edit: I only know this because I recently heard about this guy on the British TV show "QI".

partiallypro• 6 years ago

Until Windows 10 (which just has a great built in virus detection system,) I would always push people to Avast. I am shamefully disappointed that they've fallen this far.

BlueTemplar15• 6 years ago

Sadly, I wouldn't be certain about Windows 10 itself not spying on users and exfiltrating this information... (Today or in the future.)

ThePhysicist• 6 years ago

Funny, just today I looked at their analyst presentation, which mentions that 17 % of their revenue comes from user data monetization: https://investors.avast.com/Document-Download/Analyst%20Teac...

d-c• 6 years ago

They entice us with free products, meanwhile they're biting...

tomc1985• 6 years ago

I wish there was a way to punish all the people participating in these data sharing things. Because it is endemic, a gold rush even, with every single individual involved lacking scruples as they sell their fellow man out

1000units• 6 years ago

Many people who post here are involved.

tomaskafka3• 6 years ago

It's amusing to watch how slowly is this becoming a common knowledge - company I worked for at the time has been buying complete Jumpshot url logs 4 years ago, and everyone knew where the data is coming from.

Joeri• 6 years ago

I'm not surprised. The antivirus sector seems to prey on people as much as the virus makers. I had my PC infected accidentally by norton antivirus a few years ago. They snuck it onto my system by hiding themselves in an oracle java update. They didn't install right away, waited a bit so I couldn't immediately link it back to what caused it. The uninstall function in programs and settings was a misdirection and threw an obscure error. The uninstaller downloadable from their website would pretend to uninstall, require a reboot, and after the reboot the malware would reseat itself on my system. Eventually I had to start up in safe mode and painstakingly go through my system file by file, and registry key by registry key, to root it out. They know all the techniques the viruses use, and they use most of them.

That was when I decided to stop using Oracle Java on all my personal systems and minimize my use of Oracle products on a professional basis. Learning they were a malware distributor was the drop that tipped the bucket.

mschuetz• 6 years ago

Glad I'm not the only one. I was a Java dev for many years and also used it for private projects. When they started shipping unwanted malware together with Java was when I decided to remove Java from my toolset.

bArray• 6 years ago

When they started shipping unwanted malware together with
Java was when I decided to remove Java from my toolset.

Would just like to say, OpenJDK is quite a solid step-in replacement for Oracle's Java: https://openjdk.java.net/

I've used it in production, I've built apps that I then _had to_ use Oracle's Java (without problem), using older and newer versions have been very stable - would very much recommend. I had one issue 8 years ago between versions, but nothing since.

barbarbar• 6 years ago

I have never heard of this. Do you know which versions that include that kind of malwa reference.

LargoLasskhyfv• 6 years ago

Die gelbe Pest, The yellow plague! The wasps' nest, ARRGH!

Grimm665• 6 years ago

If this happens to you (or anyone else) again, I've found the go-to solution from my previous job as a repair technician. There are antivirus removal tools that basically do automatically what you did manually, purge the system of the antivirus files and registry keys. I've found them to work very well, even on later AV versions.

For McAfee it's called the McAfee Removal Tool, and for any Symantec product, there is CleanWipe as well as the Norton Removal Tool.

I am not sure of the legality of posting these tools publicly, but they are probably easy to find via search engine or torrent. May not help you if you're working with corporate machines, but I use them all the time for any machine I inherit or when helping out friends and family.

acvny• 6 years ago

Haha, you wanted free antivirus?

whatsmyusername• 6 years ago

Avast also portscans your local network. I kept getting alarms on my Symantec laptop and couldn't figure out why. Took running TCPNetView on the two avast machines full time and waiting for the alarm to fire to figure it out.

Animats• 6 years ago

Look at in Avast's privacy policy: "Enable use of your personal data to create a de-identified data set that is provided to Jumpshot to build trend analytics products and services."[1]

Where does the "consent" mentioned there occur? They claim to be GPDR compliant; it has to be explicit and separate from other agreements.

[1] https://www.avast.com/privacy-policy

Sophistifunk3• 6 years ago

I'm glad Vice is writing about this, but how many mb of browser-tracking crap do you think Jane Sixpack gets alongside that article if she doesn't have a (real) adblocker and noscript?

jameslin• 6 years ago

If you are not being sold a product, you are being sold as a product.

ansmithz42• 6 years ago

My question on avast is: How do we know it has completely uninstalled from our devices? Given the reputability of this company whose to say they don't leave something behind after we uninstall. It would be great if someone with the means could do a before and after test to verify this.

dancemethis1• 6 years ago

Another day, another leak of proprietary software collecting and selling sensitive user data.

Hopefully Discord's day is coming soon.

Leaked documents expose Avast antivirus subsidiary selling web browsing data

Related Stories