AVG Forcibly Installs Vulnerable Chrome Extension That Exposes Users' Browsing History

[Dan E]

TrenMicro put a browser extension on my internet explorer and chrome. It makes me think if its even worth having on there, considering I also run K-9 web filter, which works better than most a/v filters online. Avast conflicted with it so I actually disabled Avast's web filter just because of the ad blocking capabilities within k-9's filter on you tube. Good info thanks.

 

[LabZero]

The dangers of XSS is directly proportional to cookies privacy.
Many scripts save inside of cookies important data such as password hashes, then you can very well get to find the password of any user.
Even not knowing the value of the hash, you can copy cookies "stolen" within the browser.

 

[omidomi]

Panda install browser extension without any user consent, and its two files had been detected as PUPs with 17/54 on virustotal.com. Also, Dr.Web marked Youtube as adult content/violence.
Scan report for https://www.youtube.com/ at 2015-12-30 07:48:24 UTC - VirusTotal ( Go to the information tab and see what Dr.Web put Youtube in ridiculous category.)

Panda Browser Extensions 2 files.
Antivirus scan for edb633f30955afe8049ef9dd5de64e5f796f000e4b4c95ef552b6ef430e141ae at 2015-12-28 16:03:06 UTC - VirusTotal

Antivirus scan for edb633f30955afe8049ef9dd5de64e5f796f000e4b4c95ef552b6ef430e141ae at 2015-12-28 16:03:06 UTC - VirusTotal

Ha ha ha you are right, I agree i removed Panda and Dr.Web from my suggest

 

[Ink]

this is why i said AVG not good

that is why I have never liked AVG.

What reasons are they?

Any browser extension increases the surface of attack, this includes extensions from Kaspersky, Comodo, Avira, Norton, Avast etc.

 

[Exterminator]

Google finds AVG Chrome extension to bypass malware checks, possibly exposing browsing data
Source: Google finds AVG Chrome extension to bypass malware checks, possibly exposing browsing data

Oh, the irony. Anti-malware provider AVG has been caught hijacking search results by enabling its free Web TuneUp Chrome extension to circumvent the browser’s malware checks. The purpose of this maneuver was apparently to reroute search queries to its own service. According to Google researcher Tavis Ormandy, 9 million users were potentially affected before he forced AVG to fix the issue over several days of back and forth.

According to AVG’s Chrome extension listing, Web TuneUp’s mission is to warn users of “unsafe search results.” It accomplishes this by checking each search query against its database of suspicious sites, then routing the user to its own service called “AVG Secure Search.” According to its website, the default search provider can only be changed inside the extensions for Firefox and Internet Explorer.

Ormandy discovered that Web TuneUp “force-installed” by being designed to get around Chrome’s own security layer for catching malicious plugins. Here’s how he described it:

When a user installs AVG AntiVirus, a Chrome extension called "AVG Web TuneUp" with extension id chfdnecihphmhljaaejmgoiahnihplgn is force-installed. I can see from the webstore statistics it has nearly 9 million active Chrome users.

This extension adds numerous JavaScript API's to chrome, apparently so that they can hijack search settings and the new tab page. The installation process is quite complicated so that they can bypass the chrome malware checks, which specifically tries to stop abuse of the extension API.

Anyway, many of the API's are broken, the attached exploit steals cookies from avg.com. It also exposes browsing history and other personal data to the internet, I wouldn't be surprised if it's possible to turn this into arbitrary code execution.

In addition to the problems Ormandy described above, he also claimed that the first solution offered by AVG still left users vulnerable to so-called "man in the middle attacks." The researcher said, "...a network man in the middle can redirect a user to attack.avg.com, and supply javascript that opens a tab to a secure https origin, and then inject code into it. This means that a man in the middle can attack secure https sites like GMail, Banking, and so on. "

AVG's extension is ostensibly designed to provide a search safety tool, but also capturing revenue from routing search queries to its own pages. The company has a history of augmenting its core business of selling anti-malware solutions; a few months ago, AVG updated its privacy policy to allow the company to sell a user's browsing and search query history to third parties.

Source: Google Security Research via Ars Technica

 

[Ink]

While I'll admit this was all AVG's fault.

I would also have to say, I think AVG is one of the best antiviruses out there, they have got a lot of adware-like tools which makes me a bit hesitant. But as someone who has used their products for a long period and also considers myself very fluent with their software.

I think that is true, otherwise these bugs happen. Because anti virus software should be able to prevent other applications from getting exploited. That's also the hard part, because so many of them use signatures and are already so invested in the system.
I think we will unfortunately, need to have a new security company take over the space.

First of, I agree that AVG's actual Virus Protection is good, but anything non-security related, is developed to exploit their users and sell their data, under the renewed Privacy Policy.

I have just installed AVG Free Antivirus 2016 in VirtualBox, and found this new version to be obtrusive. Even as an experienced user, clicking on all the buttons you'll find your PC eventually with every AVG-pushed notification. As a fact, their non-AV software is similar to Adware. It's very intrusive and can be difficult to remove. Such as that AVG Zen cannot be uninstalled without removing AVG Protection (Antivirus). In an attempt to uninstall AVG Free Antivirus it is shown as removing AVG Internet Security, but perhaps that's a bug(?). Either way, it's confusing.

To stay on topic, here's a screenshot of Web TuneUp by AVG (VProtect). The Decline is barely noticeable.

After personally trying AVG Free under a VM environment and this fiasco, I no longer trust AVG as a reputable Antivirus software.

 

[jamescv7]

Indeed that AVG way of showing notifications are little aggressive compare to Avast and Avira.

Well in that sense they already affected their product due to their tactics.