Author Topic: Avast and AVG Browser Extensions Spying On Chrome and Firefox Users  (Read 8638 times)

0 Members and 1 Guest are viewing this topic.

Offline Computer Solutions

  • Newbie
  • *
  • Posts: 3
This article came across my newsfeed on Facebook.

https://thehackernews.com/2019/12/avast-and-avg-browser-plugins.html

If your Firefox or Chrome browser has any of the below-listed four extensions offered by Avast and its subsidiary AVG installed, you should disable or remove them as soon as possible.

Avast Online Security
AVG Online Security
Avast SafePrice
AVG SafePrice

Why? Because these four widely installed browser extensions have been caught collecting a lot more data on its millions of users than they are intended to, including your detailed browsing history.

Most of you might not even remember downloading and installing these extensions on your web browser, and that's likely because when users install Avast or AVG antivirus on their PCs, the software automatically installs their respective add-ons on the users' browsers.

Both online security extensions have been designed to warn users when they visit a malicious or phishing website; whereas, SafePrice extensions help online shoppers learn about best offers, price comparisons, travel deals, and discount coupons from various sites.

The malicious behaviour of Avast and AVG extensions was discovered almost a month ago by Wladimir Palant, who detailed how the extensions are sending a large amount of data about users' browsing habits, listed below, to the company's servers — "far beyond what's necessary for the extension to function."

What users' data is being sent to Avast?

Full URL of the page you are on, including query part and anchor data,
A unique user identifier (UID) generated by the extension for tracking,
Page title,
Referrer URL,
How you landed on a page, e.g., by entering the address directly, using a bookmark or clicking a link,
A value that tells whether you visited a page before,
Your country code
Browser name and its exact version number,
Your operating system and its exact version number

"Tracking tab and window identifiers as well as your actions allows Avast to create a nearly precise reconstruction of your browsing behavior: how many tabs do you have open, what websites do you visit and when, how much time do you spend reading/watching the contents, what do you click there and when do you switch to another tab. All that is connected to a number of attributes allowing Avast to recognize you reliably, even a unique user identifier," Palant said.

Over this weekend, Palant reported his findings to both the browser makers, Mozilla, and Google, of which Mozilla took immediate action by temporarily removing the extensions from its Firefox Add-on store within 24 hours until Avast resolves the issue.

"This add-on violates Mozilla's add-on policy by collecting data without user disclosure or consent," Mozilla said.

Since Mozilla didn't blacklist the extensions altogether or automatically removed them from users' browsers, it should be noted that these extensions would remain active for existing users and continue spying on them.

On the other hand, all the four extensions are still available on the Google Chrome Web Store, but Palant believes they will be removed by the tech giant after "considerable news coverage."
« Last Edit: December 04, 2019, 09:15:17 AM by Computer Solutions »

Offline quillmondo

  • Newbie
  • *
  • Posts: 2
Re: Avast and AVG Browser Extensions Spying On Chrome and Firefox Users
« Reply #1 on: December 04, 2019, 09:48:18 AM »
Read about this too on ghacks.net.
If true, I would be very disappointed in Avast.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 83913
  • No support PMs thanks
Re: Avast and AVG Browser Extensions Spying On Chrome and Firefox Users
« Reply #2 on: December 04, 2019, 10:28:23 AM »
You could have read about it in the Avast forums, had you checked ;)

Mozilla decided to remove Avast and AVG add-ons from their firefox browser add-on store add-on list.
Read: https://palant.de/2019/12/03/mozilla-removes-avast-extensions-from-their-add-on-store-what-will-google-do/

Avast has to ask users permiddion to grab data about surfing habits.
Existing add-ons will still function.
Mozilla seemingly is discussing the matter with avast's.

polonus

There are other topics also.
https://forum.avast.com/index.php?topic=230901.0
Windows 10 Home 2004 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 20.8.2432 (build 20.8.5684.602) UI-1.0.564/ WinPatrol+/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline inactive-user

  • Beta Tester
  • Newbie
  • *
  • Posts: 16
Re: Avast and AVG Browser Extensions Spying On Chrome and Firefox Users
« Reply #3 on: December 04, 2019, 03:21:59 PM »
There are other glaring problems on which they promised a fix that they (not yet / never) delivered:
https://forum.avast.com/index.php?topic=229164.0

I am talking about HTTPS-MiTM-Inspection of TLS connections. Even if you DON'T have the modules installed that use this feature.
A memory hook alters Firefox settings in RAM at launch. Please bring this to attention again that we can also sort this issue out once and for all.

EDIT:
Please leave this in the thread, as this is also about browsing history and Firefox and no less of an issue.

« Last Edit: December 04, 2019, 04:03:22 PM by radames »
they don't care to fix issues, nothing but false promises and delay tactics

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 83913
  • No support PMs thanks
Re: Avast and AVG Browser Extensions Spying On Chrome and Firefox Users
« Reply #4 on: December 04, 2019, 03:41:17 PM »
There are other glaring problems on which they promised a fix that they (not yet / never) delivered:
https://forum.avast.com/index.php?topic=229164.msg1517736

I am talking about HTTPS-MiTM-Inspection of TLS connections. Even if you DON'T have the modules installed that use this feature.
A memory hook alters Firefox settings in RAM at launch. Please bring this to attention again that we can also sort this issue out once and for all.


This has actually nothing to do with the Avast Browser Add-ons (the subject of this topic), but the Web Shield.  You have received your answer in the topic you mentioned and we/you will have to await a response from Igor or see when 19.9 is released, which is still technically in Beta.
Windows 10 Home 2004 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 20.8.2432 (build 20.8.5684.602) UI-1.0.564/ WinPatrol+/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline inactive-user

  • Beta Tester
  • Newbie
  • *
  • Posts: 16
Re: Avast and AVG Browser Extensions Spying On Chrome and Firefox Users
« Reply #5 on: December 04, 2019, 03:53:36 PM »

This has actually nothing to do with the Avast Browser Add-ons (the subject of this topic), but the Web Shield.

Correct, but decrypting the entire encrypted TLS/SSL traffic of a Browser due to using EnterpriseRootsSettings and the Avast WebShield is no less boosting my trust.
Especially when said module is UN-installed and the memory hook still latches onto my browser.


You have received your answer in the topic you mentioned and we/you will have to await a response from Igor or see when 19.9 is released, which is still technically in Beta.

No problem, you saw I was told the fix did not make it into 19.8 but I am inclined to politely remind the AVAST Team of this being important.
I thank igor and you for the work, but I still hold him to his word that this won't be overlooked for 19.9 ;)

(I don't have webshield installed and still Firefox is being hooked. Use a process explorer to see the Avast modules changing settings as proved in my thread.)


EDIT:
I remade my post in the other thread with explanation why this still is an issue about both Firefox and Browsing history.
TLS inspection gives access to the full browsing history and data.
« Last Edit: December 04, 2019, 04:02:38 PM by radames »
they don't care to fix issues, nothing but false promises and delay tactics

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 83913
  • No support PMs thanks
Re: Avast and AVG Browser Extensions Spying On Chrome and Firefox Users
« Reply #6 on: December 04, 2019, 04:52:25 PM »
As I said this really is off-topic for this thread, so continuing just draws it further off-topic.

You should continue in that thread as you have mentioned.
Windows 10 Home 2004 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 20.8.2432 (build 20.8.5684.602) UI-1.0.564/ WinPatrol+/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline inactive-user

  • Beta Tester
  • Newbie
  • *
  • Posts: 16
Re: Avast and AVG Browser Extensions Spying On Chrome and Firefox Users
« Reply #7 on: December 04, 2019, 05:04:50 PM »
Wow.. okay I will obey.. good thing tech blogs and the internet archive exist.

I will simply stop posting.

Edit:

No need to stop posting, just keep it on topic.

Gaining access to browsing history by means of a browser addon or by means of webshield and TLS inspection are TWO SIDES OF THE SAME COIN.
The topic is privacy in Firefox, and firefox and browsing data is inspected in both cases.
I was on topic, but I was silenced.

No, I chose to become inactive out of my own free will. Silenced in my country, silenced here.
Two sides of another coin.

Enjoy ruling
« Last Edit: December 04, 2019, 05:13:03 PM by radames »
they don't care to fix issues, nothing but false promises and delay tactics

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 83913
  • No support PMs thanks
Re: Avast and AVG Browser Extensions Spying On Chrome and Firefox Users
« Reply #8 on: December 04, 2019, 05:09:42 PM »
Wow.. okay I will obey.. good thing tech blogs and the internet archive exist.

I will simply stop posting.

No need to stop posting, just keep it on topic.
Windows 10 Home 2004 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 20.8.2432 (build 20.8.5684.602) UI-1.0.564/ WinPatrol+/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 67305
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Avast and AVG Browser Extensions Spying On Chrome and Firefox Users
« Reply #9 on: December 05, 2019, 08:12:28 AM »
Avast-Statement: We have offered our Avast Online Security and SafePrice browser extensions for many years through the Mozilla store. Mozilla has recently updated its store policy and we are liaising with them in order to make the necessary adjustments to our extensions to align with new requirements. The Avast Online Security extension is a security tool that protects users online, including from infected websites and phishing attacks. It is necessary for this service to collect the URL history to deliver its expected functionality. Avast does this without collecting or storing a user's identification.

We have already implemented some of Mozilla's new requirements and will release further updated versions that are fully compliant and transparent per the new requirements. These will be available as usual in the Mozilla store in the near future.
Win 8.1 [x64] - Avast PremSec 20.9.2433.Beta1 [UI.569] - CC 5.72 - EEK - FF ESR 78.4 [NS/AOS/uBO/PB] - TB 78.3.3 - SB/CP/SL/DU.B
Deutschsprachiger Bereich -> Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline mageeanthony36

  • Newbie
  • *
  • Posts: 1
Re: Avast and AVG Browser Extensions Spying On Chrome and Firefox Users
« Reply #10 on: December 20, 2019, 12:44:45 PM »
So is Avast Antitrack Premium affected? ty

Offline voyager.100

  • Jr. Member
  • **
  • Posts: 43
Re: Avast and AVG Browser Extensions Spying On Chrome and Firefox Users
« Reply #11 on: December 20, 2019, 06:07:46 PM »
Avast-Statement: We have offered our Avast Online Security and SafePrice browser extensions for many years through the Mozilla store. Mozilla has recently updated its store policy and we are liaising with them in order to make the necessary adjustments to our extensions to align with new requirements. The Avast Online Security extension is a security tool that protects users online, including from infected websites and phishing attacks. It is necessary for this service to collect the URL history to deliver its expected functionality. Avast does this without collecting or storing a user's identification.

We have already implemented some of Mozilla's new requirements and will release further updated versions that are fully compliant and transparent per the new requirements. These will be available as usual in the Mozilla store in the near future.


Hello
I have been following this case since December 4, 2019.
I find this attack on Avast completely unfair!
When you know what Google is doing with our info.
I posted on a European computer forum (a reference) to defend the quality of Avast which I have used free for 9 years without any worries.
Now it's Chrome that is blocking my extension and I don't see how to reinstall it permanently?
https://forum.pcastuces.com/avast-f25s81464.htm
https://forum.pcastuces.com/chrome_supprime_avast_online_security-f6s77177.htm
https://forum.pcastuces.com/a_propos_de_firefox_-f6s63031.htm?page=249&#6094283

Offline chrisjaroc

  • Newbie
  • *
  • Posts: 7
Re: Avast and AVG Browser Extensions Spying On Chrome and Firefox Users
« Reply #12 on: December 20, 2019, 07:01:47 PM »
Why Google is removing these useful extensions from Chrome Webstore?

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9347
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re: Avast and AVG Browser Extensions Spying On Chrome and Firefox Users
« Reply #13 on: December 20, 2019, 07:26:10 PM »
Why Google is removing these useful extensions from Chrome Webstore?

Coz "tracking" of users is bad apparently. Oh teh irony coming from Google lol
Visit my webpage Angry Sheep Blog

Offline Nodar

  • Jr. Member
  • **
  • Posts: 74
Re: Avast and AVG Browser Extensions Spying On Chrome and Firefox Users
« Reply #14 on: December 20, 2019, 07:42:07 PM »
They are removed from Google Chrome? I don't think so, or maybe they were removed then they restored them again.....I don't know but I see a button says "Available on Chrome"