12 ms·
AVG: “Web TuneUP” extension multiple critical vulnerabilities
- nephyrin 11y agoSo: - Anyone with this extension installed could be trivially owned by any website. - AVG's initial fix was to incorrectly whitelist their own domains without requiring SSL. - The follow up fix (after more harsh words from google) whitelists the AVG domain with SSL. Google engineer points out a obvious XSS on the domain that would again allow any chrome user to get owned. This is a security extension from a security vendor. No words.
- ocdtrekkie 11y agoIt's almost hard for me to accept them as a "security vendor" at this point. I've requested information from them on a virus definition that was flagged on a PC, as an enterprise customer with a service contract, and they were unable to tell me ANYTHING about the virus definition in question. Not even when they added it to their detection library. I have yet to cease to be amazed by AVG's lack of knowledge about their own product.
- VonGuard 11y agoThey are basically malware. They take over your browser and search bar, obviously diverting all search queries to them first, so they can have a nice little index to sell.
- sneak 11y agoGoogle is being far too lenient with them. The extension should be blacklisted.
- cesarb 11y agoSince "the installation process is quite complicated so that they can bypass the chrome malware checks" (second paragraph), it probably can bypass blacklisting checks too.
- arawde 11y agoThe fact that the blacklist checks can be bypassed is troubling in and of itself; the fact that a security company would knowingly do so is even more troublesome. I just finished removing AVG from my mother's laptop yesterday, it's not very often you get a choice validated so quickly.
- cesarb 11y agoAs Raymond Chen would say, the code is on the same side of the "airtight hatchway". There's nothing Chrome can do to protect itself against processes at the same privilege level, much less against processes at higher privilege levels. Any blacklist check Chrome does can be nothing more than a speed bump.
- arawde 11y agoThat makes sense, thank you for the explanation. That said, I suppose I'm still disappointed that a security vendor would manipulate extension installation to bypass checks on a platform, but I'm not particularly surprised that it's the kind of thing AVG would do.
- Karunamon 11y agoAlso, you probably don't want them to. I've got a huge problem with software that goes out of its way to prevent the user from doing something they explicitly want to do.
- x0x0 11y agoit's not evident there's a lot of user intent here; almost certainly the user doesn't intend to break web security.
- ikeboy 11y agoChrome already blocks extensions not from the webstore on Windows, unless you use a developer branch. See http://chrome.blogspot.com/2014/05/protecting-chrome-users-from-malicious.html http://chrome.blogspot.com/2014/05/protecting-chrome-users-f...
- xorcist 11y agoIt seems like whenever someone checks antivirus software for exploits (Black Hat in 2008, Google Project Zero 2015), they find them in droves. Which isn't surprising, since most of the big vendors have very old code bases on which are piled many new parsers every year for documents, archives, whatever can contain code these days. The .doc parser in your antivirus isn't better than, say, the one in Libreoffice. You should assume that your antivirus scanner is trivially exploitable. When you need to scan incoming files sandbox that scan as tight as you can.
- tptacek 11y agoThis is I think exactly correct. It's always funny to see people suggest that security companies should somehow be better at secure code than other companies, as if narrowing the set intersection of possible programmers from "capable programmers" to "capable programmers who can quickly write lots of different file format parsers" somehow makes it easier to find "programmers with an intuitive knack for secure programming". No. The more specialized your application domain, the harder it usually gets to source programmers who are also incredibly diligent. Security companies as a general rule have poorer code quality than other companies.
- xorcist 11y agoThat's one way to see it. I usually don't think about security in terms of individual programmers' capabilities but more what the company behind them wants to accomplish. Security should be a process. Compare the code coming out of Microsoft in 2000 with 2010 -- still not great perhaps, but what a difference a change in objective can make. Antivirus programmers are paid to add new parsers. Not to assess the security implications of the software. The result is predictable. Sourcing competent programmers would make zero difference as long as they have no incentives to change their process.
- technion 11y agoI had a recent conversation with a McAfee engineer regarding the use of MD5 in the whitelisting system. If it has "seen" an executable before, it assumes it clean and doesn't scan it, based on a hash. He absolutely promised me that: * No stronger hash exists * MD5 collisions are literally impossible I pointed him to a paper his own research department released, referring to the Flame malware utilising an MD5 collision, and he informed me he had previously looked at it, and it was a "typo" that he would get fixed. This is a senior developer responsible for many of the design decisions in the product. It's frightening.
- ikeboy 11y agoWhy is Google publishing this before the XSS has been fixed? Shouldn't they wait for further response from AVG?
- brazzledazzle 11y agoIf I had to guess: because at this point it's obvious that they have no idea what they're doing and will struggle to not just fix it, but maintain the level of quality needed to keep it that way.
- ikeboy 11y agoThen tell AVG that. I've seen plenty of bugs where the original fix didn't fix everything, and the reporter explains why, and then they wait for another response. Here they didn't even keep the 90-day deadline.
- uxp 11y ago> I've seen plenty of bugs where the original fix didn't fix everything You're right, but plenty of bugs aren't for a browser extension that is supposed to enhance the user's security when browsing the internet. The initial fix appeared to show a complete lack of understanding of basic web security. If you and an intelligent coworker have an agreement to review each other's code on commit, and that coworker responds to a valid complaint about what they've written with something that's probably lifted off of the first StackOverflow post they searched for that addresses the literal value of the complaint without actually solving the problem, you'd probably be a bit peeved that they're not doing their job. Here, the Chrome developers are just showing frustration at AVG's apparent lack of basic skill.
- ikeboy 11y agoFrustration is fine. I'd even be fine if they banned AVG. But revealing a 0-day publicly without giving time to respond is worse, and is also not in line with Google's policies as I understand. Many security bugs are for things that one might think are basic after hearing about them, and that shouldn't make it right to 0-day them. edit: why would revealing a vulnerability to the world before it's been fixed be the right response to incompetence on the part of the vendor?
- rasz_pl 11y agoIts almost 2016, any Antivirus Software is snake oil at this point. Bypassing _every single product on the market_ is trivial, few nops here, powershell script there and you are in. https://www.youtube.com/watch?v=8Z7L498dNB0 https://www.youtube.com/watch?v=8Z7L498dNB0 https://www.youtube.com/watch?v=DzC8jJ0ESJ0 https://www.youtube.com/watch?v=DzC8jJ0ESJ0 I could go as far as calling them fraud for giving false sense of security. Recent case of malware swapping bank account numbers on the fly for example: ESET fail https://www.youtube.com/watch?v=7MR2PvX3OBY https://www.youtube.com/watch?v=7MR2PvX3OBY McAfee fail https://www.youtube.com/watch?v=Go-qqOOE6oY https://www.youtube.com/watch?v=Go-qqOOE6oY Trend Micro was also a fail https://www.youtube.com/watch?v=DpS501wRvuo https://www.youtube.com/watch?v=DpS501wRvuo but curiously google removed this clip?!?:)
- ryanlol 11y agoDo not confuse security vendors with snake oil vendors.
- abusque 11y agoWhich companies, if any, in the anti-virus business would you not consider as "snake oil vendors"? I'm genuinely curious, I haven't had to deal with Windows systems for so long, I'm not well acquainted with AVG and their competitors.
- tracker1 11y agoHonestly, for some time the security software from MS has been "good enough" for most people. Then again, there's plenty of people that will click "OK" to just about anything that pops up... which is why when one of my grandmother's PCs finally died, I bought her a chromebook... best option for those not technically inclined.
- ryanlol 11y agoNone. grsecurity (Well, Open Source Security, Inc.) is a good example of an actual security vendor.
- yrro 11y agoMicrosoft
- ryanlol 11y agoMicrosoft has by far the best AV product (from a code quality aspect, at the very least), but I'm not sure if it qualifies as a vendor in this context. After all, MSE is essentially free.
- bedhead 11y agoAVG is not a security vendor - they are a malware company disguised as a security vendor. They're just like all the other browser highjacking bullshit companies like Perion. Look at AVG's logo and how similar it is to Windows'...the whole thing is designed to confuse people.
- proactivesvcs 11y agoI've also seen them directly involved in affiliate toolbar installers and hosting "safe site"-style badges for sites that are pushing scamware/malware. Agree that AVG is not a security vendor.
- modeless 11y agoCan a class action lawsuit be started to deal with this sort of criminal incompetence?
- djsumdog 11y agoIf I have a windows machine or VM, I simply don't run anti-virus. There's no point. At Kiwicon last year, some French researcher showed how most anti-virus scanners were so badly written, he could exploit their scanning engines with basic malformed PDFs and JPEGs. Most of those scanners run as the SYSTEM user, so you basically can control a system with a PDF. ...but I hesitate to tell non-developers to uninstall their anti-virus. I don't want to be responsible for them getting exploited, but I usually do tell them why I don't run anti-virus and that the choice is up to them. I always emphasize the biggest thing you need to do as far as security goes is to run all updates. Never skip or delay updates. The moment Chrome/FF wants you to restart, you restart them. Run Windows update (even though Windows 10 is another beast/debate entirely, if you chose to run it, you should run updates).
- hjek 11y agothis one? http://joxeankoret.com/download/breaking_av_software_44con.pdf http://joxeankoret.com/download/breaking_av_software_44con.p...
- djsumdog 11y agoYep, that's the one
- deleted 11y ago[deleted]
- CaptSpify 11y agoAlso, "don't be stupid about what you install". Even intelligent programmers fall for this. Yes, I know the app says it will download files faster for you, no that doesn't make sense, don't install it.
- slavik81 11y agoActually, opening a bunch of connections in parallel can and will improve your download speed on some sites, if there's per-connection rate limiting. http://www.downthemall.net/howto/faq/#faq7 http://www.downthemall.net/howto/faq/#faq7
- aasdh 11y agoThis is wrong. I have read some documentary on this by AVG. and they were asked about it and they denied it.
- simoncion 11y agoA few things: * Tavis Ormandy is the researcher doing the reporting. He's currently employed at Google as a security researcher. Given his reputation, and Google's reputation, I trust that his reports are true reports, rather than fiction. * The report covers a span of ~13 days. It's entirely possible that the AVG commentary that you read was posted on or after 2015-12-21, the date on which Mr. Ormandy mentions that AVG reports that they're going to be pushing the fixed version of the extension into the Chrome Webstore. * It's also entirely possible that the AVG commentary that you read is either a pack of lies, or -when read very closely- says a _bunch_ of things but ultimately utterly fails to say anything like "The thing reported by Mr. Ormandy in Google Security Research Issue #675 is actually not a problem. Mr. Ormandy's reports are untrue.".
- Animats 11y agoSomething called "Web TuneUP" just screams crapware. It sounds like one of those browser toolbar things advertised via flashing banner ads that hijack your browser. A company that bundles something like that is no longer credible as a security vendor.
- cpeterso 11y agoAVG's CEO, Gary Kovacs, was formerly CEO of Mozilla. There must be a strong cognitive dissonance field surrounding AVQ's corporate headquarters to publish this level of "security" software.
- yuhong 11y agoI wonder if anyone at Mozilla have a current contact.
- ra1n85 11y agoI long stopped using AVG because their business model seemed to transition to largely something predatory - browser bars, hijacked home pages, "tune-ups".
- guelo 11y agoAt one point it looked like Microsoft was going to kill the scammy Windows "security" industry by releasing their own anti-virus. But then they backed-off and now MSE seems to be purposefully curtailed.
- gvb 11y agoMSE was absorbed into Windows Defender in Windows 8 & 10. I don't recall any publicity from Microsoft telling their users this - I only know because I did google searches on how to install MSE on Win8 which turned up the answer that its already in there, just renamed. In my experience, a lot of people, including IT people who should know, have not gotten the message. There are a lot of people paying a lot of money for crap snake oil when they could have free (arguably better) snake oil. Ref: https://en.wikipedia.org/wiki/Windows_Defender https://en.wikipedia.org/wiki/Windows_Defender In Windows 8, functionality has increased to offer antivirus protection as well. Windows Defender in Windows 8 resembles Microsoft Security Essentials and uses the same virus definitions.
- dendory 11y agoI remember using AVG many years ago when it was a decent product. I recently had the displeasure to have to install it again. AVG Free right now is malware, plain and simple. It highjacks your home page in every browser, changes your search page, and silently installs an extension. And if you go and switch the home page back, it shows you a popup asking you to set it back to AVG. This is pure malware behavior.
- zump 11y agoWho the fuck would get something called Web TuneUP?
- georgemcbay 11y agoI'm primarily a Windows user on the desktop/laptop side (though I do also use a lot of Linux/Unix/embedded systems) and my advice to everyone who asks (as the token 'IT advice guy' to lots of friends and family) is just don't install anti-virus software. Modern Windows is better off without it. As far back as XP the best option was to install Microsoft's own Windows Defender and uninstall everything else, now just use what the OS already comes with. Microsoft's goal with virus elimination is to make Windows work better, 3rd party vendor's goals with virus elimination are to upsell you on a lot of crap you don't need. It isn't difficult to see why the 3rd party stuff is all a bunch of crap that floods you with false positives while bogging your system down in an attempt to seem like it is doing something useful. Yes, there are occasionally exceptions to the rule, but they all eventually follow a logical progression from useful lightweight tool to bloated piece of shit that is worse than most viruses they could possibly save you from.