Mac OS Big Sur Upgrade - New Avast Security in the Network System Preferences

[MartinX]

Hi,

I just upgraded my Mac to Big Sur. After the upgrade Avast (free version) stopped working. I had to update Avast and I was asked to setup proxy configuration. If I recall, it's similar to what another poster saw:

https://drive.google.com/file/d/1IDojd0X9bzzMA7jK_ziPYA3IaUL_-6Gt/view

I did ALLOW it. Avast is now working.

I now noticed that in my System Preferences > Network pane I see a new entry called "Avast Security". It's on the same spot where "USB 10/100/1000 LAN", "Wi-Fi", "Bluetooth PAN", "Thunderbolt" are.

The "Avast Security" line has the following information:
- Status connected
- Sent / receive
- Connect time hh:mm:ss
- Server Address - System Default
- Account Name - (blank)
- "Disconnect" button
- VPN Application - Avast Security


What is this "Avaast Security" in Network panel? What does it do and is it safe? Is it tracking and scanning the data that goes through my Mac?

I tried Disconnecting, I also tried deleting the line from the left pane. Avast just creates a new (repeating) line.

Thank you.

[ondrej.kolacek]

Hello,

Avast Antivirus does not configure any VPN. With Catalina, Apple has introduced Network Extension framework (https://developer.apple.com/documentation/networkextension?language=objc) for intercepting network traffic (which our Web Shield and Mail Shield need to do) instead of the old way (via Kernel Extension). This framework was AFAIK originally used on MacOS only to implement VPN, however on iOS it has also already contained the network traffic interception. This functionality was ported and expanded to MacOS in Catalina, although in an immature state. With Big Sur, Apple has discontinued kernel extensions, so we had to switch to this new technology.

Unfortunately despite the fact we are not using the VPN part of Network Extension (our system extension which uses Transparent Proxy for our Pro and Free version and additionally Dns Proxy for our Pro version), the Transparent Proxy functionality, used for scanning network connections, shows as VPN in Networks in System Preferences. This is probably because parts of the functionality used for managing Transparent Proxy are also used for managing VPN; we have already reported one other case where "VPN" term was erroneously used in messaging and Apple has renamed it to more appropriate term. We have already reported this naming issue, however due to the fact that this is not only a case of name change, but there are multiple graphical elements shown, it is hard to say when/if this will ever be changed by Apple.

So please rest assured, unless you buy our VPN product, there is no VPN active. However as long as you have Web Shield or Email Shield active, there will be this record in Network (and since manually deleting it stops these shields from working, Avast keeps recreating it).

As an aside, it seems that there is some bug or glitch when Transparent Proxy starts, as the start sometimes causes multiple records (with yellow dot, in Not Connected state) to be created. This has already been reported to Apple and hopefully also be addressed soon.

Please note, that these "issues" do not impact the underlying functionality, despite the fact that they are annoying and confusing. We apologise for any confusion we are causing.

Kind regards,
Ondrej Kolacek

[Saturn1]

Hi Ondrej,

I've also updated to the new Mac OS and have seen the notification from Avast. I have attached the screenshot, it says all network activity on this mac may be filtered or monitored. Does this mean Avast will get to see my data and all my activity. I think this is a big privacy issue and can you confirm if that's what will happen if I turn this on?

Thank you.

[ondrej.kolacek]

Hi Ondrej,

I've also updated to the new Mac OS and have seen the notification from Avast. I have attached the screenshot, it says all network activity on this mac may be filtered or monitored. Does this mean Avast will get to see my data and all my activity. I think this is a big privacy issue and can you confirm if that's what will happen if I turn this on?

Thank you.

Hello,
Web Shield and Mail Shield need to get access to network connections so that they can do their job. Before Big Sur they did the same, however using different mechanism that has been now discontinued.
Kind regards,
Ondrej Kolacek

[Adrian173]

Hi there, I am having the same issue after upgrading to Big Sur.

Multiple VPN instances are spawned by Avast! and I find my Office apps like Outlook, for example, do not connect unless I manually disconnect the Avast! VPN.

Please urgently advise as it is hampering the operation of my Mac.

I have raised 2 support tickets with Avast through my Business account and no response yet.

Adrian.

[bjsvec]

I am relieved to learn this is expected and known behavior, but I have to say I was concerned because it looked really odd and with all the news around hacking and browser extension malware etc. that led me to install Avast I worried I had installed malware inadvertently. 

Avast should really do something to explain this to users during installation because it was not clear and not expected behavior.  A simple banner/popup/warning during installation to explain this VPN profile would be added and its purpose would go a long way.

[ondrej.kolacek]

I am relieved to learn this is expected and known behavior, but I have to say I was concerned because it looked really odd and with all the news around hacking and browser extension malware etc. that led me to install Avast I worried I had installed malware inadvertently. 

Avast should really do something to explain this to users during installation because it was not clear and not expected behavior.  A simple banner/popup/warning during installation to explain this VPN profile would be added and its purpose would go a long way.

Hello,
the whole "multiple records appearing over time" was our bug and should be fixed in the latest version; there should be at most two records in Network Preferences now.
Kind regards,
Ondrej Kolacek

[Adrian173]

I have just updated a second MacBook in my household to Big Sur and I get the same issued with Outlook.

Upon first boot, Outlook (365 - latest version) will not connect (combination of 365 accounts, Hotmail and Exchange accounts)

When I disconnect the Avast! Security VPN then they connect.

Any ideas or anyone else having the same issues?

This is now 2 machines, different models that are exhibiting this behaviour.

Help appreciated.

Adrian.

[Adrian173]

After some investigation it appears to be multiple issues and I am raising another ticket with Avast Support.

You have got to remember both these Macs were working fine on Catalina - I run the Avast Business Cloud Console so all the policies are supposed to be pushed out to the client Macs.

If I turn off the Avast Security VPN, Outlook connects perfectly.  But I believe this is because this VPN now controls the Web Filtering and SSL scanning including emails.

Therefore, I tried keeping the VPN on and disabling the Web and Email shields.

The Exchange and 365 accounts connected with the web shield disabled (they use a https url to connect), GMail and Hotmail connected with the Mail shield disabled (they are IMAPS).

Therefore, I conclude that the Avast Security VPN may not be communicating properly with the Avast Web and Mail shields on Big Sur, since this was working properly on Catalina (no security VPN there) and I also have exceptions in the Cloud Console to skip scanning the SSL/IMAP sites these are going to.

I will report back once I hear from support.

Adrian.

[Adrian173]

OK, I found this post as well so this explains my Outlook issues:

https://forum.avast.com/index.php?topic=239798.0

I will have to wait for Apple to fix this.

No reply as yet from Avast support though I did send my logs in to them only the day before yesterday and we are in strange remote working times so patience is of course necessary.

Adrian.

[beralopau]

Since yesterday my Avast secure browser stopped working. Is the new version backwards compatible? I have not (yet) installed Big Sur.

[Erik65]

Hi Ondrej,

I've also updated to the new Mac OS and have seen the notification from Avast. I have attached the screenshot, it says all network activity on this mac may be filtered or monitored. Does this mean Avast will get to see my data and all my activity. I think this is a big privacy issue and can you confirm if that's what will happen if I turn this on?

Thank you.

Hello,
Web Shield and Mail Shield need to get access to network connections so that they can do their job. Before Big Sur they did the same, however using different mechanism that has been now discontinued.
Kind regards,
Ondrej Kolacek

Hello,

Reading between the lines this means my web traffic is sent to Avast and processed there?

I think this is what the question was and not answering it straight suggests there's something to hide? But maybe I'm just reading too much into it? I interpreted the original question as a huge call to verify what kind of practices AVAST has with regards to integrity and data handling...

But if I really want to know, I guess I can just bring out the GDPR and get every answer I need that way...

Best Regards,

/E