500M Avira antivirus users introduced to cryptomining

https://krebsonsecurity.com/2022/01/500m-avira-antivirus-users-introduced-to-cryptomining/

by todsacerdoti • 5 years ago

185 95 5 years ago

iszomer7• 5 years ago

“Norton should be DETECTING and killing off crypto mining hijacking, not installing their own,” reads a Dec. 28 thread on Norton’s forum titled “Absolutely furious.”

That is fucking infuriating. Imagine if the "my body, my choice" redirected to a "my computer, my choice" idea.

LaunchAway1• 5 years ago

I was going to say that you can choose to not install the antivirus but unfortunately this crap and similar come installed on so many laptops. If the HW is compatible I suggest to format the whole thing and install Linux.

iszomer7• 5 years ago

I do use Linux. Even so, if you were required to install (or compile) a package that is a dependency on something you don't explicitly use but do for others, where do you draw the line on their acceptable tradeoffs?

mensetmanusman• 5 years ago

If it is opt in, it is a choice.

Would be interesting if you could throttle based on home temperature. I would much rather heat with useful computation than with electric heaters.

kieloo• 5 years ago

The problem is that a lot of users will activate it without really knowing what it is. Lots of elderly people use Norton and Avira, for example.

rosndo• 5 years ago

I would much rather heat with useful computation than with electric heaters.

But why? An electric heat pump will be vastly more efficient.

anonymousab• 5 years ago

If it is opt in, it is a choice

But you know that it will be enabled by default by the packages they give to OEMs, or "accidentally" in every update or system restart, and will trick less informed or less technical users into enabling it and all sorts of shenanigans like that because that's how these av software companies have been operating for over a decade, at least in the home consumer space.

The only right away to treat these companies is to assume the worst about everything they say and do. Unfortunately they seem to always find a way to do worse than those assumptions. When "they will make a lot of money and/or screw over a lot of users" is the outcome of their statement being a lie, then you should assume their statement is a lie.

mlyle• 5 years ago

Computation and resistive heat are pretty much the same in efficiency.

Heat pumps, which will pump outside heat inside, are a lot more efficient.

So, "computation for heat" is only useful to the point that it's replacing a space heater or other resistive heat, or is focused in a place resulting other heat use by a lot. So, my computer could be a cost-effective way to keep my feet cozy.

This also presumes that cryptomining is "useful computation".

scrps• 5 years ago

You really think the average non-technical user who leaves an AV preinstalled when they get a new system or are frightened into installing an AV is making a choice when a cryptominer is bundled with their AV even if it is opt-in to activate it?

The imperitive word that person on the forum post you quoted used is "hijacking" not intentionally and knowingly installing mining software.

klyrs• 5 years ago

Imagine if the "my body, my choice" redirected to a "my computer, my choice" idea.

No need to imagine; that's the central tenet of RMS's ethos and he's been shouting it from the rooftops for decades.

iszomer7• 5 years ago

What or who is `RMS`? My first assumption is "risk management standard".

mindslight4• 5 years ago

A corollary to the Gibson quote is "The past is still here - it's just not evenly distributed". I can't help but think of this any time I see talk of "antivirus software" in 2022 (among other things).

If you're reading this article and thinking that antivirus software is a sensible thing to be running and thus wondering how they could betray users, you need to seriously revamp your computing environment. For most tasks that you need a trustable environment for, you want a modern OS that isn't based around agglomerating random binaries from arbitrary sources, whether that's something Free or just proprietary+curated+isolated (eg Apple/Android). And sure you can still keep MS Windows around for whatever purposes, but since it's no longer handling your sensitive activities you don't have to be hyperactive about the Sisyphean task of "securing" it.

pjmlp3• 5 years ago

Indeed every Linux user does a code review before pressing return on curl xpto | sh, or mypkg install.

mindslight4• 5 years ago

Yes of course you can transplant bad ideas over to Linux or anywhere else (another example: flashing your phone with rando "ROMs" from xda-developers). If you're doing these type of things then what I said applies to you as well, and you should obtain another device where you don't do such things for your trustable environment. But even if you are doing such things, you still won't be liable to add to your problems with "antivirus" software. That's a particular idea arising out of the longstanding binary potluck culture of DOS/Windows.

nix233• 5 years ago

No problem every Antivirus software makes that code review anyway...just install windows defender on you *nix machine...problem solved.

unionpivo• 5 years ago

I personally would not and I do not put any sensitive information on my phone.

I know that many people disagree, and live their entire life on there, but for the same reason most hackers and governments and various "scurity" companies are gathering and hoarding exploits for them.

Sticking to good old desktop almost makes you invisible now days.

badrabbit4• 5 years ago

Defender is adequate anyways.

dvh• 5 years ago

It clearly doesn't mark Avira as virus so it is not adequate.

badrabbit4• 5 years ago

At best Avira is a PuP and only after long term legitimacy

technion2• 5 years ago

Defender allowed a person to easily fix for that for Norton and I'm about to have it fixed for Avira:

https://imgur.com/a/kPGUF44

userbinator• 5 years ago

I wonder when MS is going to join in, given all the other user-hostile stuff they've been doing.

badrabbit4• 5 years ago

They charge for defender ATP and they will lose magnitudes more money than what they can gain from mining. Like, I expect the CEO to resign and stock drop of >15% if they did that

twofornone• 5 years ago

Is antivirus software really still necessary on windows for technical users? Do you really need it if you're not downloading questionable torrents or visiting shady websites?

KptMarchewa• 5 years ago

No, it isn't.

netizen-9368243• 5 years ago

Its probably not necessary for nontechnical users either, I keep hearing about how great windows defender works.

koolba• 5 years ago

Many corporate boiler plate for consulting gigs requires some antivirus be installed.

netizen-9368243• 5 years ago

Ah yes, attorneys. Always the technical experts in the room.

And yes, I know there are some exceptions but lawyers are notorious for being tech illiterate

nikanj• 5 years ago

No, but it is mandatory for a wide variety of security certifications. Regulatory capture rules

65• 5 years ago

I'm not sure what non-technical users are downloading but I suspect Adblock is going to be far better at preventing non-technical users from downloading a virus than antivirus software.

MauranKilom4• 5 years ago

So did I read correctly that Avira, Norton and Avast have been/will be bought by the same company (Symantec, but rebranded), with the sole intention of getting their existing userbases to mine crypto for Symantec?

This is absolutely bonkers. Most users are unlikely to even make back their electricity cost (arguments for space heating can be made, but not in summer), and paying out the minuscule sums is impossible due to transaction fees.

Hoping that somebody will sue this endeavor into oblivion.

waffle_maniac• 5 years ago

If the home is powered by nuclear power and heated by gas then the extra heat generated from the computer could decrease the usage of gas. It would be a small net positive.

low_tech_love• 5 years ago

You mean the computer would work as an auxiliary heater? Is it reasonable to expect that to work? How much would the processor have to heat for that to be feasible, how fast would it go to the trash bin after that, and where should one even locate the pc for that to work?

selfhoster11• 5 years ago

That's two if's right there. I don't even know if I could switch to a provider that uses nuclear energy even if I wanted to.

Terry_Roll• 5 years ago

I think its an excellent idea, because some of their products are free so this is a way for them to get paid for their free products and the user doesn't have to have privacy intrusive profiled advertising thrust in their face when using a free product.

Crypto is also a hedge against local currencies as various country's, even the greatest nations can become unstable govt's very quickly.

Edit. It makes me wonder as the above has been downvoted, if this is why US cpu/gpu manufacturers are now disabling things that make mining crypto harder like Intel's AVX-512 and nVidia's changes to prevent GPU crypto mining, whilst using global warming as a straw puppet.

f6v2• 5 years ago

I guess it’s downvoted because same as with data collection, average user doesn’t understand what costs are associated with the mining.

mywacaday• 5 years ago

If this is what a antivirus giant like Symantec has to do increase profits it sounds like a good time to start thinking shorting some stock. Being facetious but not by much, it sounds like some kind of bad joke.

justgrepit• 5 years ago

Outrage nonsense alert.

What you wrote, who bought who and why, is 100% incorrect. Even company relationships are wrong.

Sole intention part...this is simply made up, conspiracy style. Where do you keep pulling this from?

Get facts first, opinions second, or based on your logic, ideally never.

junon2• 5 years ago

Okay, so what's the truth, then? Since you seem to be much better informed.

commoner2• 5 years ago

NortonLifeLock (the name of what used to be Symantec's consumer security divison) acquired Avira in December 2020.[1]

NortonLifeLock merged with Avast PLC in August 2021, with the combined company retaining the NortonLifeLock name.[2]

The Verge tried out Norton Crypto and found its 15% fee to be much higher than the 1-2% fee typically taken by mining pool operators. The tester broke even after (off-peak) electricity expenses, with NortonLifeLock capturing all of the profits.[3]

[1] https://investor.nortonlifelock.com/About/Investors/press-re...

[2] https://www.zdnet.com/article/nortonlifelock-and-avast-plc-t...

[3] https://www.theverge.com/2022/1/7/22869528/norton-crypto-min...

mrjin2• 5 years ago

Why bother suing them? Simply uninstall and reboot, problem solved once for all and you will have a much more responsive system as a bonus.

I stopped using AV software over a decade ago, haven't really encounter a malware so far.

moreira• 5 years ago

Saying you haven't encountered malware seems like a weak argument; a tech-savvy person (which you are, since you're here) will know not to download dodgy stuff and not to click dodgy links on emails or porn websites.

A less technically-inclined person won't know, and will definitely end up exposed to malware. That's just reality for Windows users.

The key argument is that Windows's built-in antivirus is quite solid now. I don't know if (and I don't think that) a modern antivirus provides any -significant- additional protection over what comes with Windows by default.

NHQ• 5 years ago

Get ahead of your ransom payments today.

bendiksolheim• 5 years ago

This is almost beyond funny. I googled "Avira antivirus cryptomining" to see if I could find any other sources, and quite a few results [0][1][2] are from Aviras own blog warning about crypto mining viruses. One of the solutions mentioned are actually to install Avira. Yes, these are written a few years ago, but the irony is just incredible.

[0] https://www.avira.com/en/blog/illicit-mining-software-beware... [1] - https://www.avira.com/en/blog/crypto-miners-coinhive-malware... [2] - https://www.avira.com/en/blog/yes-your-device-can-be-hit-wit...

jamal-kumar• 5 years ago

Super funny was my first thought but also pretty alarming that they thought they could get away with this. The amount of government contracts they have is probably enormous. Here's something to add to the jokes: A fun example I just found of one of their contracts with the US Secret Service, who they presumably just hijacked the computers of to cryptomine. [1] Hahaha isn't this like how you get a congressional hearing?

[1] https://www.instantmarkets.com/view/ID3116232555101294163817...

vmception• 5 years ago

Avira is probably aware of it because of all the false positives

But now its likely an antitrust violation so that could be fun

dinosor• 5 years ago

True - but since the tool is strictly opt-in only, are we a bit too critical of the tool? Personally I don't use any such av tools or have any stakes in cryptocurrencies. But in a way they are providing an option for less tech savvy people to mine cryptocurrency right? Would've been better if the crypto component was not installed by default, but still. As many mentioned, there's also the question of the education component to the users - how much good a job the tool does in providing proper awareness to people who go opt-in to the tool, on what they're getting into. Personally if I were to use such a tool, I'd prefer that.

prmoustache• 5 years ago

I think what is wrong is telling people they will earn cash while the electricity bill will make so that only Norton will get money instead. All this while increasing global warming and energy waste.

It may be opt-in but there is just nothing good in it.

theropost• 5 years ago

this seems like a regulatory overstep - something a technically inclined government would intervene in. Too bad ours is far from that.

dandanua• 5 years ago

Maybe they are "technically inclined" and already invested in the crypto pyramid.

junon2• 5 years ago

Lol. I'm more inclined to believe they're just incompetent. We're talking thousands upon thousands of people who would have to be simultaneously covering this up. It just wouldn't happen.

qeternity• 5 years ago

So basically now thousands of system administrators across the world can embezzle from their employers by arbitraging free electricity for crypto at 1% efficiency (less NortonLifeLock fees).

jvsg_• 5 years ago

exactly. This was my first thought too. Perhaps they envisoned it that way to sell more copies of their product.

technion2• 5 years ago

These are all consumer products. The issue isn't sysadmins, it's mum and dad that saw the advertisements currently running on Facebook and clicked "buy".

JumpCrisscross• 5 years ago

there are hefty fees involved in moving any ETH mined by Norton or Avira Crypto to an account that the user can cash out

Is NortonLifelock whatever charging a fee? Or does this refer to gas?

Looking forward to the follow-on story in a couple years about the IRS sending everyone who mined 10¢ a letter.

frollo• 5 years ago

Is NortonLifelock whatever charging a fee? Or does this refer to gas?

It seems that NortonLifeLock takes about 15% of whatever gets mined. In addition to that, you'd probably have to use and external service to sell your ETH (an other article I saw mentioned Coinbase as the only place where you can move your ETH from Norton) which Will charge its own fees and then there is the gas fee.

short12• 5 years ago

Antivirus companies are universally scummy anyways. But this trend is going to continue for regular software

tgsovlerkhgsel3• 5 years ago

Is it enabled by default? If yes, criminal charges should be on the table.

kjs34• 5 years ago

What criminal charge, exactly? As long as it's in the fine print, hard to see how it's criminal. Shitty, possibly (hopefully) civilly actionable, but criminal seems like a stretch, at least in the US. Not that I don't think that people who think this sort of thing is an acceptable business practice shouldn't be frogmarched out back and strung up in the nearest tree...

LegitShady• 5 years ago

Probably the choice principle of unjust enrichment.

tgsovlerkhgsel3• 5 years ago

The same charge that would apply for other malware mining operations.

In the US, CFAA? I'm pretty sure that if I put in the fine print "I get to encrypt your files and hold them for ransom" I'd be going to jail too if I did it, fine print or not.

In Germany, I'd consider "theft of electrical energy" and § 263a "computer fraud".

cabirum• 5 years ago

Now wait for Intel to install a miner directly into their on-chip Intel Management Engine.

lostmsu• 5 years ago

They would, if CPUs were still capable of generating any useful amount.

mikotodomo• 5 years ago

The reason to use antivirus in the first place is to get rid of this kind of crap!

belter• 5 years ago

The most likely way to make you computer insecure is by installing AntiVirus Software.

Most antivirus software itself has serious vulnerabilities. Adding cryptomining is the ice on the cake.

"Is Your Antivirus Software Spying on You?" https://restoreprivacy.com/antivirus-privacy/

"How to Compromise the Enterprise Endpoint" https://googleprojectzero.blogspot.com/2016/06/how-to-compro...

"Avast antivirus hole patched after public Project Zero slap" https://www.theregister.com/2015/10/06/google_zero_hacker_re...

"Still paying for antivirus software? Experts say you probably don't need it" https://www.nbcnews.com/tech/security/still-paying-antivirus...

mrjin2• 5 years ago

Cannot agree more. We don't need the malware but AV venders do: if there were no malwares, AV software would be useless. So why should we install something from someone with conflict interest in the first place?

hulitu• 5 years ago

And most antivirus software is useless for most malware on the internet.

500M Avira antivirus users introduced to cryptomining

Related Stories