17 ms·

Leaked documents expose Avast antivirus subsidiary selling web browsing data

759 points by jeremiahlee 7y ago

coldcode 7y ago
The power of customer data making money is hard to resist.
rkagerer 7y ago
The article seems a little sensationalized, but even viewed in a generous light it's still downright creepy. ...clients include Google, Yelp, Microsoft, McKinsey, Pepsi, Sephora, Home Depot, Condé Nast, Intuit, and many others. It is possible to determine from the collected data what date and time the anonymized user visited YouPorn and PornHub, and in some cases what search term they entered into the porn site and which specific video they watched. Although the data does not include personal information such as users' names, it still contains a wealth of specific browsing data, and experts say it could be possible to deanonymize certain users.
- adossi 7y ago
  Yeah it's creepy, but I wonder how that data is used? Like, what ads will Google show me depending on the type of porn I watch?
  - mikejb 7y ago
    IIUC, porn is used as an example to highlight that these are very personal details that are being sold, and porn preferences are things people often fear more of leaking than - for example - their financial data. John Oliver, in his work on the NSA scandal had Snowden explain individual NSA programs based on "dick picks", to help people visualize and clarify the consequences of what otherwise is just generically described as "selling/stealing your data".
    - freehunter 7y ago
      Yeah people always assume the buyers of the data are companies like Google, and not some group who wants to blackmail you if you don't give them five Bitcoins.
    - nonbirithm 7y ago
      > porn preferences are things people often fear more of leaking than - for example - their financial data I remember this being the opposite - for nude pictures instead of porn preferences at least. Avast did a study where 77% of US respondents said that between nude pictures and financial data they would rather have nude pictures of them leaked[0]. Maybe it's because financial data is directly tied to one's well-being but except for certain professions nude photos aren't. Then again nude photos aren't necessarily the same as porn. [0] https://thenextweb.com/insider/2015/11/17/study-smartphone-users-fear-leaked-bank-data-more-than-leaked-nudes/ https://thenextweb.com/insider/2015/11/17/study-smartphone-u...
  - nexuist 7y ago
    Dating sites, for one.
    - inkeddeveloper 7y ago
      Hard to find a dating site that specializes in ... looks up his profile ... oh boy, that's some weird stuff.
  - _jal 7y ago
    Why concentrate on intended use? More interesting is what, er, unanticipated value-add might be there. Could a malicious actor create a blackmail-bot? It wouldn't even need to be that great - just something a little more believable than the "I took over your computer and videoed you masturbating" spam. Could more subtle, targeted blackmail operation involve this data? There is a lot of this sort of thing in politics. We know PIs, bail-bonders and other folks on the fuzzy LE/commercial coercion industry line were heavy users of realtime cellphone tracking. I imagine the more creative ones have considered the value of these data pits, too.
- vatueil 7y ago
  For context, the sentence starts with: > Some past, present, and potential clients include... Keyword "potential".
  - nabakin 7y ago
    Exactly. That word makes me discredit the entire list. Although, the subtitle does say > Its clients have included Home Depot, Google, Microsoft, Pepsi, and McKinsey.
    - makomk 7y ago
      From the PCMag article, it seems that Jumpshot's marketing materials claimed they'd worked with some companies that denied actually doing business with them when contacted by reporters, hence the "potential" clients - it's not clear who's lying.
- palant 7y ago
  The article is actually rather generous, particularly when it says "could be possible to deanonymize certain users." Having done my own research on that [1], I would have formulated this as "allowed to deanonymize most users." [1] https://palant.de/2020/01/27/avasts-broken-data-anonymization-approach/ https://palant.de/2020/01/27/avasts-broken-data-anonymizatio...
rmist 7y ago
> Avast was collecting the browsing data of its customers who had installed the company's browser plugin, which is designed to warn users of suspicious websites. I have never really felt the need of antivirus plugins. Firefox's built in features (https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...) has always been good enough in my experience.
- m-p-3 7y ago
  And you can also help flagging those pages or malicious files by either submitting a phishing report[1] or uploading a potentially malicious file[2] [1]: https://safebrowsing.google.com/safebrowsing/report_phish/?tpl=mozilla https://safebrowsing.google.com/safebrowsing/report_phish/?t... [2]: https://www.virustotal.com/ https://www.virustotal.com/
- lucasmullens 7y ago
  I doubt anyone's installing the Avast chrome extension voluntarily. It's mostly just people forgetting to uncheck a box when installing some software.
  - roryokane 7y ago
    No, Chrome and Firefox nowadays don’t allow extensions to be automatically installed and enabled. Any extensions running were specifically enabled by the user at some point. I know this because I helped someone install McAfee antivirus a few days ago. Both Chrome and Firefox showed a small, non-modal popover on the next launch saying that an extension had tried to install itself. The popover contained two buttons, one for enabling the extension and one for keeping it disabled (Chrome) or uninstalling it (Firefox). If you never clicked inside the popover (as many alert-blind users might do), the extension would stay disabled.
klohto 7y ago
The data is heavily anonymized and aggregated before selling. Avast is a Czech company under GDPR with regulators breathing on it’s neck. “Selling data to Google” is true as much as when my github project is cloned by Google guy and I claim it’s used by Google :) It’s a free product and it’s written in T&S, why is Vice so sensational? EDIT: Calm it, I was proven wrong about the EULA
- tastroder 7y ago
  We regularly call out random browser extensions doing the same thing, it's not sensationalized to call out a top 10 manufacturer in the "security" space on this behaviour. Anonymization of search histories has, time and time again, been shown to be largely ineffective. https://www.avast.com/eula https://www.avast.com/eula does not mention Jumpshot and grepping around does not indicate any sensible anonymization and aggregation efforts, just the default legalese whereas the demo video on https://www.jumpshot.com/solutions/industry/retail https://www.jumpshot.com/solutions/industry/retail leads me to believe that while they might not tie histories to a single user, they show statistics like "XX% of users shopping at A, went on to buy at B" which indicates at least some level of unaggregated data / tracking. If the Vice article is to be believed, that's certainly enough to at least raise an eyebrow. The opt-in the article talks about is likely to be an underspecified mess that's intended to decieve the user, this functionality has simply no place in an AV package. Let's not act like it's hard to get users to press a shiny green button these days. That might be found GDPR compliant in court, it's still not morally right.
  - speedgoose 7y ago
    No way this is GDPR compliant.
    - BlueTemplar 7y ago
      Yeah. But courts are relatively slow. It will likely take half a decade before they get to face real consequences?
  - klohto 7y ago
dgaudet 7y ago
> Some past, present, and potential clients include ... i'm having a hard time reading past the word "potential". that suggests exaggeration to me.
- Mtinie 7y ago
  It could be exaggeration, or “potential” in this case could include data from people and companies who expressed interest in the product captured during lead generation.
skocznymroczny 7y ago
Most antivirus software feels sketchy in general (snake oil). The only antivirus I run at the moment is Windows Defender. For me the main reason is that Microsoft actually benefits from a virus free system because it improves Windows as a platform. Antivirus software vendors benefit from viruses spreading around because it improves sales of their products. Also Windows Defender is fairly non-intrusive, it doesn't advertise a sketchy VPN, a sketchy adblock, a sketchy torrent or any other tool that usually anti-virus vendors try to bundle together.
- nesky 7y ago
  Doubling down on this, I do the same and have had maybe 1 instance where Defender didn't catch something in what seems like the last 10 years I've used it almost exclusively for 'virus' protection.
  - lawnchair_larry 7y ago
    How would you know if it didn’t catch something?
    - nesky 7y ago
      Don't recall what specifically I was doing at the time but was maybe 7 or 8 years ago my computer got a virus and took me close to a week to fully gain control of my machine again. Only time I got actual warnings from Defender about something it couldn't erase.
    - penagwin 7y ago
      More often then not you'll find some "helpful" changes to your browsing experience, and/or "team.bitcoinz" running at 100% cpu, or your files are encrypted. Most viruses aren't stealthy, although a few are, and you're right, those you'll have a hard time with if they're well hidden and undetected. IMO - Something like Glasswire + Windows Defender is pretty robust. Nearly any virus will need network connectivity after all.
      - 7y ago
smrtinsert 7y ago
This just feeds my conspiracy that all antivirus companies are worse than the viruses themselves.
beart 7y ago
I've often felt that antivirus software is like the rock that keeps the tigers away. I haven't used it since the AOL days, and that's also the last time I was actually hit with Malware (something from Kazaa I would guess.) It's also worth noting that every corporate IT department I've ever seen installs antivirus software on employee machines, so it must be good for something? I'm curious what the actual statistics are for caught viruses.
- Spooky23 7y ago
  For corporate IT, it’s a compliance requirement. It is the equivalent of putting a sign in the bathroom that says to wash your hands, only less effective. AV does almost nothing and costs almost nothing. The newer products are different and more effective, and come with an appropriate price tag. (The Microsoft solution costs as much as O365!)
  - 52-6F-62 7y ago
    > For corporate IT, it’s a compliance requirement. It is the equivalent of putting a sign in the bathroom that says to wash your hands, only less effective. AV does almost nothing and costs almost nothing. Corporate IT at my previous employer even allowed and aided us in uninstalling the resource-hogging McAfee installation that comes default with a company machine. That stuff was crippling our machines.
    - bradknowles 7y ago
      We loved it at a previous employer when the corporate-approved Endpoint Protection Solution silently installed a new firewall component, without telling anyone. Of course, it is (was?) a requirement of the corporate-approved Mobile Device Management system. Broke everyone in the company for weeks (?), because the only thing it allowed was ports 80 and 443. No one could figure out what the problem was, because the OS-standard firewall configuration clearly showed that all the required ports were open, and therefore it couldn't possibly be a firewall problem. Well, at least it broke all those people who had the corporate MDM software installed on their machines. Those who had a different MDM installed and so could not install the corporate MDM, well those people were able to get regular work done.
_jal 7y ago
Kind of amusing that this is currently the #2 story, while #1 is "Trust Is at the Core of Software Marketing". If you had told me five years ago that I would stand up exfil monitors on my home network because commercial and criminal surveillance was so pervasive, I would have said that would be crazy talk. And yet here we are.
- dredmorbius 7y ago
  What are you using for this, what is blocked / how do you construct blocklists?
  - _jal 7y ago
    This is very much a new work in progress. Basically, DNS logging forwards to a daemon I wrote that detects Base64/UU/other encodings in DNS requests and asks the network manager[1] to shut off connectivity to the client asking such questions. There is a volume-of-queries timer, and I have some other ideas to add to it. I'm working on a TLS-inspecting proxy with squid and sslsplit, as I expect there's a lot to look at. I very much want to know if something emits any of various magic numbers - SSN, bank account numbers, address book entries, IMEIs, etc. As far as more general blocking, I use parts of Pihole, which merges with some other data sources, to defeat DNS resolution for folks I don't want on my internet. And I use Maxmind's geoip data to generate iptables rules to block most of the world on public facing infra - my tiny user base is not in most of it. [1] I use Unifi gear, this will do you no good if you don't: https://github.com/Art-of-WiFi/UniFi-API-client https://github.com/Art-of-WiFi/UniFi-API-client
    - dredmorbius 7y ago
      Thanks. EFF's analysis of Amazon Ring egress traffic mentions some possibly useful tools for inspecting SSL/TLS traffic. Specifically: mitmproxy and Frida. https://www.eff.org/deeplinks/2020/01/ring-doorbell-app-packed-third-party-trackers https://www.eff.org/deeplinks/2020/01/ring-doorbell-app-pack... (https://news.ycombinator.com/item?id=22165568 https://news.ycombinator.com/item?id=22165568)
ropiwqefjnpoa 7y ago
Does this include AVG for Business? I dropped them just over a year ago.
dessant 7y ago
Here's the rejected Firefox blocklist request for Avast extensions: https://bugzilla.mozilla.org/show_bug.cgi?id=1600600 https://bugzilla.mozilla.org/show_bug.cgi?id=1600600 Blocklisting the extensions would disable existing installations and stop ancillary data collection, which is prohibited by Firefox Add-on Policies. https://extensionworkshop.com/documentation/publish/add-on-policies/ https://extensionworkshop.com/documentation/publish/add-on-p... > Mozilla expects that the add-on limits data collection whenever possible, in keeping with Mozilla's Lean Data Practices and Mozilla's Data Privacy Principles, and uses the data only for the purpose for which it was originally collected. There are a number of browser extensions maintained by antivirus companies that use security as a disguise to collect and monetize user data. It is time for Google and Mozilla to act on this issue and protect users from these predatory practices. Benign extensions that are genuinely useful and don't have a company behind them do not get this treatment [1], they are blocked whitout preliminary contact with developers [2]. [1] https://www.jeremiahlee.com/posts/page-translator-is-dead/ https://www.jeremiahlee.com/posts/page-translator-is-dead/ [2] https://www.ghacks.net/2019/11/05/mozilla-bans-all-extensions-that-execute-remote-code/ https://www.ghacks.net/2019/11/05/mozilla-bans-all-extension...
- horsawlarway 7y ago
  I want to second this sentiment and EXPLICITLY call out Mozilla. I am the lead dev for a relatively small Firefox extension. We do not do ANY tracking. We were rejected and removed for simply including the sdk for Microsoft outlook addins as a script in one of our html pages (we share the codebase for an outlook addon as well). This script is well documented and published by Microsoft. I find the hypocrisy here staggering. I know that Firefox gets a lot of love, particularly on HN because it feels like Mozilla is still a trustworthy company. I want to clearly express that I no longer believe this. They want addons in the store that they can use for marketing and sales. Period.
  - minewastaken 7y ago
    https://digdeeper.neocities.org/ghost/mozilla.html https://digdeeper.neocities.org/ghost/mozilla.html This article, along with some other sites and my own digging made me leave Firefox for good. It's a good read if you value privacy and think Mozilla is the good guy in a field dominated by evil corporations. At first it might seem biased, but the author makes very good points and backs them up with tons of sources that can't be really argued - most of the article is reviewing privacy policies and terms of service agreements that are available publicly to check. For now I stuck with Pale Moon, but I'm considering some other browsers like Ungoogled Chromium for my daily private and work use. Pale Moon feels kinda janky and old-school in a not good way. But it's fast and (with some minor tweaking: https://spyware.neocities.org/guides/palemoon.html https://spyware.neocities.org/guides/palemoon.html) respects your privacy 100%.
chinathrow 7y ago
Avira Free just installed Avira VPN while updating a client to Win 10 recently, I assume that they're after data collection too. That was the last straw - Windows Defender only at this point of time.
js8 7y ago
I work in Prague and I know some people who work for Avast. It's an open secret that the company got pretty rich on selling customer data from their antivirus (that was before GDPR, though). I am glad that somebody confirmed the rumor.
lousken 7y ago
Eset and Windows Defender is pretty much the only two antiviruses left that I still kinda trust. The rest has become either bloatware or straight up spyware.
- tomaskafka 7y ago
  Why would you trust Eset? Once they can monetize the user data (and every AV/browser company can), their shareholders will compel them to do it.
  - alibert 7y ago
    They do only paid AV and, for what it's worth, Google has included the Eset AV engine in Chrome (Win only).
  - lousken 7y ago
    Well e.g. they don't spam you with ads for their other products. They like to say that your PC is slow and show you their nice tools that should fix it (although I know avg does that, not sure if avast too, but they're supposed to be the same thing now). People tend to freak out if they see something like this popping out of taskbar. Eset doesn't do any of this and keeps quiet unless there is a problem. Also don't add snake oil parts to their products like registry cleaners and install extensions. The most obtrusive thing they do is probably MITM TLS connections which I don't agree with but at least kinda understand. As for the data monetization, you can compare privacy policy of those two companies https://help.eset.com/eav/12/en-US/privacy_policy.html https://help.eset.com/eav/12/en-US/privacy_policy.html vs https://www.avast.com/products-policy https://www.avast.com/products-policy . They speak for themselves.
inkeddeveloper 7y ago
Is it bad that my first reaction is, "Of course."
- zentiggr 7y ago
  Nope, just confirms you're seeing reality.
sct202 7y ago
My dad had me remove Avast (that he paid for) from his laptop over Christmas because he started to get mailers based on his browsing activity. It literally locked up his computer for an hour uninstalling and giving prompts that would try to get you to accidentally cancel the uninstall.
- AJ007 7y ago
  You should send this to the Vice authors. I emailed some journalists about Jumpshot a few years back. It’s good that everyone now understands what is going on.
- BlueTemplar 7y ago
  Sigh, and I have been trying to warn mine since the summer, but it's going to take something even worse than that I guess...
jannes 7y ago
I don't use Avast myself (for obvious reasons), but how do they get around HTTPS encryption? Do they install a self-signed root certificate into the OS/browser? Wouldn't that be easily detectable?
- RL_Quine 7y ago
  If you’re injecting into the browser you don’t need to worry about SSL- that’s handled for you.
- stordoff 7y ago
  They can instruct the browser to log/leak HTTPS keys: https://textslashplain.com/2019/08/11/spying-on-https/ https://textslashplain.com/2019/08/11/spying-on-https/ NB this article also notes the selling of data - from the article it cites: > Jumpshot is the data arm of Avast[...] This suite of products, in order to function, must collect and analyze every URL visited by every browser of every machine on which its installed. [...] Because Avast has to see and process all these URLs anyway (in order to serve their function of providing web security), they anonymize, aggregate, and remove any personally-identifiable information from the browser URL visits and then provide them to Jumpshot, who then makes estimates about broad web usage behavior. In my opinion, this is both an ethical way to gather crucial data about what’s happening on the web[...]
  - tomaskafka 7y ago
    They aren't "making estimates about broad usage behavior", they just sell the raw clickstream. Amd lie.
deleted 7y ago
[deleted]
nif2ee 7y ago
Most B2C privacy/security based companies are either snake oil or outright scams.
s_dev 7y ago
Can we discuss how ridiculous PCI compliance is to require anti-virus softare? Particularly in mac OS where anti-virus software is the primary surface area for introducing viruses. Why hasn't this requirement been updated to somthing more sensible?
- reaperducer 7y ago
  From your mouth to God's ear. IT installed freaking Norton on all of my new Macs. Now I feel less safe, and I get the software nagging me all the time.
- GordonS 7y ago
  Keep in mind that PCI requirements only apply to machines within the cardholder environment - everything else is out of scope. What this means is that as long as you isolate your cardholder environment, you don't need to deploy AV across your whole company - only on those in scope. I'm not a huge fan of AV, but I do advocate for a layered approach to security, and have to concede that AV may have some value as a "last chance" layer if malware somehow manages to get past your other defences.
ggregoire 7y ago
How are the AV companies still alive with Windows Defender installed on every Windows since like Windows 7 or 8?
- kijin 7y ago
  Windows Defender is a little too understated IMO. Most people don't even know that it's a decent antivirus. I wouldn't mind if better marketing for Windows Defender made a bunch of shady antivirus companies go bankrupt, but Microsoft probably doesn't want to get into another round of antitrust lawsuits.
- reaperducer 7y ago
  How are the AV companies still alive with Windows Defender installed on every Windows since like Windows 7 or 8? Apparently by selling your information.
- mywittyname 7y ago
  Computer salesman have talking points about how WD doesn't catch 95% of virus out there. Of course, they leave out the part about how WD focuses on the 5% of viruses actually found in the wild, as continuously surveyed by Microsoft, not the 30k variants of known viruses that are not relevant to a Windows 10 machine. My go to is to say, the security lead for Google Chrome once tweeted, "the biggest impediment to implementing a secure browser is AV software."
  - alibert 7y ago
    I saw that quote being posted quite often in HN. I always smile at this because Google Chrome (on Windows only) includes a cleanup tool based on an popular AV engine. https://www.blog.google/products/chrome/cleaner-safer-web-chrome-cleanup/ https://www.blog.google/products/chrome/cleaner-safer-web-ch... https://www.eset.com/int/google-chrome-cleanup/ https://www.eset.com/int/google-chrome-cleanup/
    - mywittyname 7y ago
      I think his original criticism was that the OS hooks that typical AV install are a source of vulnerabilities and bugs. I don't think he took issue with the idea of a well-maintained database of signatures used to identify malicious code, just most vendors implementations that check against such.
markosaric 7y ago
Avast/Jumpshot data is bought by many marketing companies too and packaged as SEO tools, market research/analysis. They've been really proud to talk about their ability to collect all this data in the past [1]. But recently it became clear that all the data is stolen without user permission. [1] "Jumpshot Knows What You're Buying, Browsing, Searching" https://www.cmswire.com/digital-marketing/jumpshot-knows-what-youre-buying-browsing-searching/ https://www.cmswire.com/digital-marketing/jumpshot-knows-wha...
- BlueTemplar 7y ago
  Puts the popcorn in the microwave.
detcader 7y ago
I just tried to uninstall the Avast desktop software, but "avast.hub" and avast "worker" processes remained running even after the "Uninstall Avast" process quit. Probably just incompetence... Probably!
- Sophistifunk 7y ago
  >Probably just incompetence... Probably Right. Just like Zoom.
sagunsh 7y ago
I don't use any antivirus software now a days. They basically seems to slow down the computer (I am not quite sure about this) but here I got one more reason not to use one. I guess qindows defender is okay and sufficient for most of the cases and you can always switch to Linux.
- rafaelvasco 7y ago
  Yeah, I stopped using AV in Win7. Never looked back;
drewrem11 7y ago
PCMag article talks about how Avast's 'de-identification' of the collected browser histories can fail and be used to by third-party companies to link your web clicks to your real identity https://www.pcmag.com/news/the-cost-of-avasts-free-antivirus-companies-can-spy-on-your-clicks https://www.pcmag.com/news/the-cost-of-avasts-free-antivirus...
- deleted 7y ago
  [deleted]
ryuukk_ 7y ago
that's what every VPNs are doing that's what every firefox/chrome extentions are doing that's what every mobile apps are doing Time to wake up slaves of the modern world
deleted 7y ago
[deleted]
- deleted 7y ago
  [deleted]
asasidh 7y ago
If you are using a product that dials home, paid or otherwise, you have to assume it is collecting and selling your data.
jacquesm 7y ago
AV software acts like and treats your computer pretty much the same way that malware does, it should not be surprising the companies do the same. They're in Prague, would be nice to see the teeth of the GDPR used to put the fear of god into parties in this space. Maximum penalty times the number of clients they had should do the job nicely.
- catalogia 7y ago
  Is there any chance what they're doing might fall under some sort of 'unauthorized access' computer hacking criminal law? Something that could get individuals sent to prison rather than just getting the company fined? There is no way they had meaningful informed consent for any of this. I don't think shit like this will stop unless executives and the engineers who humor them start getting their lives justifiably destroyed.
  - BlueTemplar 7y ago
    Maybe, if government computers were involved ?
annoyingnoob 7y ago
I thought this was well known. I wrote code to ingest Jumpshot data years ago. You have to wonder about the quality of the data though - maybe those using Avast aren't the best measure of all things web related.
jammygit 7y ago
Anything named an antivirus should be possibly to sue for this sort of thing, right? It could not possibly be more misleading It’s like a locksmith company monetizing by sneaking people into your home when you’re asleep
- bradknowles 7y ago
  That would be William Brodie. See https://en.wikipedia.org/wiki/William_Brodie https://en.wikipedia.org/wiki/William_Brodie Edit: I only know this because I recently heard about this guy on the British TV show "QI".
partiallypro 7y ago
Until Windows 10 (which just has a great built in virus detection system,) I would always push people to Avast. I am shamefully disappointed that they've fallen this far.
- BlueTemplar 7y ago
  Sadly, I wouldn't be certain about Windows 10 itself not spying on users and exfiltrating this information... (Today or in the future.)
ThePhysicist 7y ago
Funny, just today I looked at their analyst presentation, which mentions that 17 % of their revenue comes from user data monetization: https://investors.avast.com/Document-Download/Analyst%20Teach-In/986db62f-83c5-46c5-bb2e-212475ef6bb5/Analyst%20Presentation%205%20July%20F https://investors.avast.com/Document-Download/Analyst%20Teac...
d-c 7y ago
They entice us with free products, meanwhile they're biting...
tomc1985 7y ago
I wish there was a way to punish all the people participating in these data sharing things. Because it is endemic, a gold rush even, with every single individual involved lacking scruples as they sell their fellow man out
- 1000units 7y ago
  Many people who post here are involved.
tomaskafka 7y ago
It's amusing to watch how slowly is this becoming a common knowledge - company I worked for at the time has been buying complete Jumpshot url logs 4 years ago, and everyone knew where the data is coming from.
Joeri 7y ago
I'm not surprised. The antivirus sector seems to prey on people as much as the virus makers. I had my PC infected accidentally by norton antivirus a few years ago. They snuck it onto my system by hiding themselves in an oracle java update. They didn't install right away, waited a bit so I couldn't immediately link it back to what caused it. The uninstall function in programs and settings was a misdirection and threw an obscure error. The uninstaller downloadable from their website would pretend to uninstall, require a reboot, and after the reboot the malware would reseat itself on my system. Eventually I had to start up in safe mode and painstakingly go through my system file by file, and registry key by registry key, to root it out. They know all the techniques the viruses use, and they use most of them. That was when I decided to stop using Oracle Java on all my personal systems and minimize my use of Oracle products on a professional basis. Learning they were a malware distributor was the drop that tipped the bucket.
- mschuetz 7y ago
  Glad I'm not the only one. I was a Java dev for many years and also used it for private projects. When they started shipping unwanted malware together with Java was when I decided to remove Java from my toolset.
  - bArray 7y ago
    > When they started shipping unwanted malware together with > Java was when I decided to remove Java from my toolset. Would just like to say, OpenJDK is quite a solid step-in replacement for Oracle's Java: https://openjdk.java.net/ https://openjdk.java.net/ I've used it in production, I've built apps that I then _had to_ use Oracle's Java (without problem), using older and newer versions have been very stable - would very much recommend. I had one issue 8 years ago between versions, but nothing since.
- barbarbar 7y ago
  I have never heard of this. Do you know which versions that include that kind of malwa reference.
- LargoLasskhyfv 7y ago
acvny 7y ago
Haha, you wanted free antivirus?
whatsmyusername 7y ago
Avast also portscans your local network. I kept getting alarms on my Symantec laptop and couldn't figure out why. Took running TCPNetView on the two avast machines full time and waiting for the alarm to fire to figure it out.
Animats 7y ago
Look at in Avast's privacy policy: "Enable use of your personal data to create a de-identified data set that is provided to Jumpshot to build trend analytics products and services."[1] Where does the "consent" mentioned there occur? They claim to be GPDR compliant; it has to be explicit and separate from other agreements. [1] https://www.avast.com/privacy-policy https://www.avast.com/privacy-policy
Sophistifunk 7y ago
I'm glad Vice is writing about this, but how many mb of browser-tracking crap do you think Jane Sixpack gets alongside that article if she doesn't have a (real) adblocker and noscript?
jameslin 7y ago
If you are not being sold a product, you are being sold as a product.
ansmithz42 7y ago
My question on avast is: How do we know it has completely uninstalled from our devices? Given the reputability of this company whose to say they don't leave something behind after we uninstall. It would be great if someone with the means could do a before and after test to verify this.
dancemethis1 7y ago
Another day, another leak of proprietary software collecting and selling sensitive user data. Hopefully Discord's day is coming soon.

759 points by jeremiahlee 7y ago

The power of customer data making money is hard to resist.

The article seems a little sensationalized, but even viewed in a generous light it's still downright creepy. ...clients include Google, Yelp, Microsoft, McKinsey, Pepsi, Sephora, Home Depot, Condé Nast, Intuit, and many others. It is possible to determine from the collected data what date and time the anonymized user visited YouPorn and PornHub, and in some cases what search term they entered into the porn site and which specific video they watched. Although the data does not include personal information such as users' names, it still contains a wealth of specific browsing data, and experts say it could be possible to deanonymize certain users.

adossi 7y ago
Yeah it's creepy, but I wonder how that data is used? Like, what ads will Google show me depending on the type of porn I watch?
- mikejb 7y ago
  IIUC, porn is used as an example to highlight that these are very personal details that are being sold, and porn preferences are things people often fear more of leaking than - for example - their financial data. John Oliver, in his work on the NSA scandal had Snowden explain individual NSA programs based on "dick picks", to help people visualize and clarify the consequences of what otherwise is just generically described as "selling/stealing your data".
  - freehunter 7y ago
    Yeah people always assume the buyers of the data are companies like Google, and not some group who wants to blackmail you if you don't give them five Bitcoins.
  - nonbirithm 7y ago
    > porn preferences are things people often fear more of leaking than - for example - their financial data I remember this being the opposite - for nude pictures instead of porn preferences at least. Avast did a study where 77% of US respondents said that between nude pictures and financial data they would rather have nude pictures of them leaked[0]. Maybe it's because financial data is directly tied to one's well-being but except for certain professions nude photos aren't. Then again nude photos aren't necessarily the same as porn. [0] https://thenextweb.com/insider/2015/11/17/study-smartphone-users-fear-leaked-bank-data-more-than-leaked-nudes/ https://thenextweb.com/insider/2015/11/17/study-smartphone-u...
- nexuist 7y ago
  Dating sites, for one.
  - inkeddeveloper 7y ago
    Hard to find a dating site that specializes in ... looks up his profile ... oh boy, that's some weird stuff.
- _jal 7y ago
  Why concentrate on intended use? More interesting is what, er, unanticipated value-add might be there. Could a malicious actor create a blackmail-bot? It wouldn't even need to be that great - just something a little more believable than the "I took over your computer and videoed you masturbating" spam. Could more subtle, targeted blackmail operation involve this data? There is a lot of this sort of thing in politics. We know PIs, bail-bonders and other folks on the fuzzy LE/commercial coercion industry line were heavy users of realtime cellphone tracking. I imagine the more creative ones have considered the value of these data pits, too.
vatueil 7y ago
For context, the sentence starts with: > Some past, present, and potential clients include... Keyword "potential".
- nabakin 7y ago
  Exactly. That word makes me discredit the entire list. Although, the subtitle does say > Its clients have included Home Depot, Google, Microsoft, Pepsi, and McKinsey.
  - makomk 7y ago
    From the PCMag article, it seems that Jumpshot's marketing materials claimed they'd worked with some companies that denied actually doing business with them when contacted by reporters, hence the "potential" clients - it's not clear who's lying.
palant 7y ago
The article is actually rather generous, particularly when it says "could be possible to deanonymize certain users." Having done my own research on that [1], I would have formulated this as "allowed to deanonymize most users." [1] https://palant.de/2020/01/27/avasts-broken-data-anonymization-approach/ https://palant.de/2020/01/27/avasts-broken-data-anonymizatio...

rmist 7y ago

> Avast was collecting the browsing data of its customers who had installed the company's browser plugin, which is designed to warn users of suspicious websites. I have never really felt the need of antivirus plugins. Firefox's built in features (https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...) has always been good enough in my experience.

m-p-3 7y ago
And you can also help flagging those pages or malicious files by either submitting a phishing report[1] or uploading a potentially malicious file[2] [1]: https://safebrowsing.google.com/safebrowsing/report_phish/?tpl=mozilla https://safebrowsing.google.com/safebrowsing/report_phish/?t... [2]: https://www.virustotal.com/ https://www.virustotal.com/
lucasmullens 7y ago
I doubt anyone's installing the Avast chrome extension voluntarily. It's mostly just people forgetting to uncheck a box when installing some software.
- roryokane 7y ago
  No, Chrome and Firefox nowadays don’t allow extensions to be automatically installed and enabled. Any extensions running were specifically enabled by the user at some point. I know this because I helped someone install McAfee antivirus a few days ago. Both Chrome and Firefox showed a small, non-modal popover on the next launch saying that an extension had tried to install itself. The popover contained two buttons, one for enabling the extension and one for keeping it disabled (Chrome) or uninstalling it (Firefox). If you never clicked inside the popover (as many alert-blind users might do), the extension would stay disabled.

klohto 7y ago

The data is heavily anonymized and aggregated before selling. Avast is a Czech company under GDPR with regulators breathing on it’s neck. “Selling data to Google” is true as much as when my github project is cloned by Google guy and I claim it’s used by Google :) It’s a free product and it’s written in T&S, why is Vice so sensational? EDIT: Calm it, I was proven wrong about the EULA

tastroder 7y ago
We regularly call out random browser extensions doing the same thing, it's not sensationalized to call out a top 10 manufacturer in the "security" space on this behaviour. Anonymization of search histories has, time and time again, been shown to be largely ineffective. https://www.avast.com/eula https://www.avast.com/eula does not mention Jumpshot and grepping around does not indicate any sensible anonymization and aggregation efforts, just the default legalese whereas the demo video on https://www.jumpshot.com/solutions/industry/retail https://www.jumpshot.com/solutions/industry/retail leads me to believe that while they might not tie histories to a single user, they show statistics like "XX% of users shopping at A, went on to buy at B" which indicates at least some level of unaggregated data / tracking. If the Vice article is to be believed, that's certainly enough to at least raise an eyebrow. The opt-in the article talks about is likely to be an underspecified mess that's intended to decieve the user, this functionality has simply no place in an AV package. Let's not act like it's hard to get users to press a shiny green button these days. That might be found GDPR compliant in court, it's still not morally right.
- speedgoose 7y ago
  No way this is GDPR compliant.
  - BlueTemplar 7y ago
    Yeah. But courts are relatively slow. It will likely take half a decade before they get to face real consequences?
- klohto 7y ago

dgaudet 7y ago

> Some past, present, and potential clients include ... i'm having a hard time reading past the word "potential". that suggests exaggeration to me.

Mtinie 7y ago
It could be exaggeration, or “potential” in this case could include data from people and companies who expressed interest in the product captured during lead generation.

skocznymroczny 7y ago

Most antivirus software feels sketchy in general (snake oil). The only antivirus I run at the moment is Windows Defender. For me the main reason is that Microsoft actually benefits from a virus free system because it improves Windows as a platform. Antivirus software vendors benefit from viruses spreading around because it improves sales of their products. Also Windows Defender is fairly non-intrusive, it doesn't advertise a sketchy VPN, a sketchy adblock, a sketchy torrent or any other tool that usually anti-virus vendors try to bundle together.

nesky 7y ago
Doubling down on this, I do the same and have had maybe 1 instance where Defender didn't catch something in what seems like the last 10 years I've used it almost exclusively for 'virus' protection.
- lawnchair_larry 7y ago
  How would you know if it didn’t catch something?
  - nesky 7y ago
    Don't recall what specifically I was doing at the time but was maybe 7 or 8 years ago my computer got a virus and took me close to a week to fully gain control of my machine again. Only time I got actual warnings from Defender about something it couldn't erase.
  - penagwin 7y ago
    More often then not you'll find some "helpful" changes to your browsing experience, and/or "team.bitcoinz" running at 100% cpu, or your files are encrypted. Most viruses aren't stealthy, although a few are, and you're right, those you'll have a hard time with if they're well hidden and undetected. IMO - Something like Glasswire + Windows Defender is pretty robust. Nearly any virus will need network connectivity after all.
    - 7y ago

smrtinsert 7y ago

This just feeds my conspiracy that all antivirus companies are worse than the viruses themselves.

beart 7y ago

I've often felt that antivirus software is like the rock that keeps the tigers away. I haven't used it since the AOL days, and that's also the last time I was actually hit with Malware (something from Kazaa I would guess.) It's also worth noting that every corporate IT department I've ever seen installs antivirus software on employee machines, so it must be good for something? I'm curious what the actual statistics are for caught viruses.

Spooky23 7y ago
For corporate IT, it’s a compliance requirement. It is the equivalent of putting a sign in the bathroom that says to wash your hands, only less effective. AV does almost nothing and costs almost nothing. The newer products are different and more effective, and come with an appropriate price tag. (The Microsoft solution costs as much as O365!)
- 52-6F-62 7y ago
  > For corporate IT, it’s a compliance requirement. It is the equivalent of putting a sign in the bathroom that says to wash your hands, only less effective. AV does almost nothing and costs almost nothing. Corporate IT at my previous employer even allowed and aided us in uninstalling the resource-hogging McAfee installation that comes default with a company machine. That stuff was crippling our machines.
  - bradknowles 7y ago
    We loved it at a previous employer when the corporate-approved Endpoint Protection Solution silently installed a new firewall component, without telling anyone. Of course, it is (was?) a requirement of the corporate-approved Mobile Device Management system. Broke everyone in the company for weeks (?), because the only thing it allowed was ports 80 and 443. No one could figure out what the problem was, because the OS-standard firewall configuration clearly showed that all the required ports were open, and therefore it couldn't possibly be a firewall problem. Well, at least it broke all those people who had the corporate MDM software installed on their machines. Those who had a different MDM installed and so could not install the corporate MDM, well those people were able to get regular work done.

_jal 7y ago

Kind of amusing that this is currently the #2 story, while #1 is "Trust Is at the Core of Software Marketing". If you had told me five years ago that I would stand up exfil monitors on my home network because commercial and criminal surveillance was so pervasive, I would have said that would be crazy talk. And yet here we are.

dredmorbius 7y ago
What are you using for this, what is blocked / how do you construct blocklists?
- _jal 7y ago
  This is very much a new work in progress. Basically, DNS logging forwards to a daemon I wrote that detects Base64/UU/other encodings in DNS requests and asks the network manager[1] to shut off connectivity to the client asking such questions. There is a volume-of-queries timer, and I have some other ideas to add to it. I'm working on a TLS-inspecting proxy with squid and sslsplit, as I expect there's a lot to look at. I very much want to know if something emits any of various magic numbers - SSN, bank account numbers, address book entries, IMEIs, etc. As far as more general blocking, I use parts of Pihole, which merges with some other data sources, to defeat DNS resolution for folks I don't want on my internet. And I use Maxmind's geoip data to generate iptables rules to block most of the world on public facing infra - my tiny user base is not in most of it. [1] I use Unifi gear, this will do you no good if you don't: https://github.com/Art-of-WiFi/UniFi-API-client https://github.com/Art-of-WiFi/UniFi-API-client
  - dredmorbius 7y ago
    Thanks. EFF's analysis of Amazon Ring egress traffic mentions some possibly useful tools for inspecting SSL/TLS traffic. Specifically: mitmproxy and Frida. https://www.eff.org/deeplinks/2020/01/ring-doorbell-app-packed-third-party-trackers https://www.eff.org/deeplinks/2020/01/ring-doorbell-app-pack... (https://news.ycombinator.com/item?id=22165568 https://news.ycombinator.com/item?id=22165568)

ropiwqefjnpoa 7y ago

Does this include AVG for Business? I dropped them just over a year ago.

dessant 7y ago

Here's the rejected Firefox blocklist request for Avast extensions: https://bugzilla.mozilla.org/show_bug.cgi?id=1600600 https://bugzilla.mozilla.org/show_bug.cgi?id=1600600 Blocklisting the extensions would disable existing installations and stop ancillary data collection, which is prohibited by Firefox Add-on Policies. https://extensionworkshop.com/documentation/publish/add-on-policies/ https://extensionworkshop.com/documentation/publish/add-on-p... > Mozilla expects that the add-on limits data collection whenever possible, in keeping with Mozilla's Lean Data Practices and Mozilla's Data Privacy Principles, and uses the data only for the purpose for which it was originally collected. There are a number of browser extensions maintained by antivirus companies that use security as a disguise to collect and monetize user data. It is time for Google and Mozilla to act on this issue and protect users from these predatory practices. Benign extensions that are genuinely useful and don't have a company behind them do not get this treatment [1], they are blocked whitout preliminary contact with developers [2]. [1] https://www.jeremiahlee.com/posts/page-translator-is-dead/ https://www.jeremiahlee.com/posts/page-translator-is-dead/ [2] https://www.ghacks.net/2019/11/05/mozilla-bans-all-extensions-that-execute-remote-code/ https://www.ghacks.net/2019/11/05/mozilla-bans-all-extension...

horsawlarway 7y ago
I want to second this sentiment and EXPLICITLY call out Mozilla. I am the lead dev for a relatively small Firefox extension. We do not do ANY tracking. We were rejected and removed for simply including the sdk for Microsoft outlook addins as a script in one of our html pages (we share the codebase for an outlook addon as well). This script is well documented and published by Microsoft. I find the hypocrisy here staggering. I know that Firefox gets a lot of love, particularly on HN because it feels like Mozilla is still a trustworthy company. I want to clearly express that I no longer believe this. They want addons in the store that they can use for marketing and sales. Period.
- minewastaken 7y ago
  https://digdeeper.neocities.org/ghost/mozilla.html https://digdeeper.neocities.org/ghost/mozilla.html This article, along with some other sites and my own digging made me leave Firefox for good. It's a good read if you value privacy and think Mozilla is the good guy in a field dominated by evil corporations. At first it might seem biased, but the author makes very good points and backs them up with tons of sources that can't be really argued - most of the article is reviewing privacy policies and terms of service agreements that are available publicly to check. For now I stuck with Pale Moon, but I'm considering some other browsers like Ungoogled Chromium for my daily private and work use. Pale Moon feels kinda janky and old-school in a not good way. But it's fast and (with some minor tweaking: https://spyware.neocities.org/guides/palemoon.html https://spyware.neocities.org/guides/palemoon.html) respects your privacy 100%.

chinathrow 7y ago

Avira Free just installed Avira VPN while updating a client to Win 10 recently, I assume that they're after data collection too. That was the last straw - Windows Defender only at this point of time.

js8 7y ago

I work in Prague and I know some people who work for Avast. It's an open secret that the company got pretty rich on selling customer data from their antivirus (that was before GDPR, though). I am glad that somebody confirmed the rumor.

lousken 7y ago

Eset and Windows Defender is pretty much the only two antiviruses left that I still kinda trust. The rest has become either bloatware or straight up spyware.

tomaskafka 7y ago
Why would you trust Eset? Once they can monetize the user data (and every AV/browser company can), their shareholders will compel them to do it.
- alibert 7y ago
  They do only paid AV and, for what it's worth, Google has included the Eset AV engine in Chrome (Win only).
- lousken 7y ago
  Well e.g. they don't spam you with ads for their other products. They like to say that your PC is slow and show you their nice tools that should fix it (although I know avg does that, not sure if avast too, but they're supposed to be the same thing now). People tend to freak out if they see something like this popping out of taskbar. Eset doesn't do any of this and keeps quiet unless there is a problem. Also don't add snake oil parts to their products like registry cleaners and install extensions. The most obtrusive thing they do is probably MITM TLS connections which I don't agree with but at least kinda understand. As for the data monetization, you can compare privacy policy of those two companies https://help.eset.com/eav/12/en-US/privacy_policy.html https://help.eset.com/eav/12/en-US/privacy_policy.html vs https://www.avast.com/products-policy https://www.avast.com/products-policy . They speak for themselves.

inkeddeveloper 7y ago

Is it bad that my first reaction is, "Of course."

zentiggr 7y ago
Nope, just confirms you're seeing reality.

sct202 7y ago

My dad had me remove Avast (that he paid for) from his laptop over Christmas because he started to get mailers based on his browsing activity. It literally locked up his computer for an hour uninstalling and giving prompts that would try to get you to accidentally cancel the uninstall.

AJ007 7y ago
You should send this to the Vice authors. I emailed some journalists about Jumpshot a few years back. It’s good that everyone now understands what is going on.
BlueTemplar 7y ago
Sigh, and I have been trying to warn mine since the summer, but it's going to take something even worse than that I guess...

jannes 7y ago

I don't use Avast myself (for obvious reasons), but how do they get around HTTPS encryption? Do they install a self-signed root certificate into the OS/browser? Wouldn't that be easily detectable?

RL_Quine 7y ago
If you’re injecting into the browser you don’t need to worry about SSL- that’s handled for you.
stordoff 7y ago
They can instruct the browser to log/leak HTTPS keys: https://textslashplain.com/2019/08/11/spying-on-https/ https://textslashplain.com/2019/08/11/spying-on-https/ NB this article also notes the selling of data - from the article it cites: > Jumpshot is the data arm of Avast[...] This suite of products, in order to function, must collect and analyze every URL visited by every browser of every machine on which its installed. [...] Because Avast has to see and process all these URLs anyway (in order to serve their function of providing web security), they anonymize, aggregate, and remove any personally-identifiable information from the browser URL visits and then provide them to Jumpshot, who then makes estimates about broad web usage behavior. In my opinion, this is both an ethical way to gather crucial data about what’s happening on the web[...]
- tomaskafka 7y ago
  They aren't "making estimates about broad usage behavior", they just sell the raw clickstream. Amd lie.

deleted 7y ago

[deleted]

nif2ee 7y ago

Most B2C privacy/security based companies are either snake oil or outright scams.

s_dev 7y ago

Can we discuss how ridiculous PCI compliance is to require anti-virus softare? Particularly in mac OS where anti-virus software is the primary surface area for introducing viruses. Why hasn't this requirement been updated to somthing more sensible?

reaperducer 7y ago
From your mouth to God's ear. IT installed freaking Norton on all of my new Macs. Now I feel less safe, and I get the software nagging me all the time.
GordonS 7y ago
Keep in mind that PCI requirements only apply to machines within the cardholder environment - everything else is out of scope. What this means is that as long as you isolate your cardholder environment, you don't need to deploy AV across your whole company - only on those in scope. I'm not a huge fan of AV, but I do advocate for a layered approach to security, and have to concede that AV may have some value as a "last chance" layer if malware somehow manages to get past your other defences.

ggregoire 7y ago

How are the AV companies still alive with Windows Defender installed on every Windows since like Windows 7 or 8?

kijin 7y ago
Windows Defender is a little too understated IMO. Most people don't even know that it's a decent antivirus. I wouldn't mind if better marketing for Windows Defender made a bunch of shady antivirus companies go bankrupt, but Microsoft probably doesn't want to get into another round of antitrust lawsuits.
reaperducer 7y ago
How are the AV companies still alive with Windows Defender installed on every Windows since like Windows 7 or 8? Apparently by selling your information.
mywittyname 7y ago
Computer salesman have talking points about how WD doesn't catch 95% of virus out there. Of course, they leave out the part about how WD focuses on the 5% of viruses actually found in the wild, as continuously surveyed by Microsoft, not the 30k variants of known viruses that are not relevant to a Windows 10 machine. My go to is to say, the security lead for Google Chrome once tweeted, "the biggest impediment to implementing a secure browser is AV software."
- alibert 7y ago
  I saw that quote being posted quite often in HN. I always smile at this because Google Chrome (on Windows only) includes a cleanup tool based on an popular AV engine. https://www.blog.google/products/chrome/cleaner-safer-web-chrome-cleanup/ https://www.blog.google/products/chrome/cleaner-safer-web-ch... https://www.eset.com/int/google-chrome-cleanup/ https://www.eset.com/int/google-chrome-cleanup/
  - mywittyname 7y ago
    I think his original criticism was that the OS hooks that typical AV install are a source of vulnerabilities and bugs. I don't think he took issue with the idea of a well-maintained database of signatures used to identify malicious code, just most vendors implementations that check against such.

markosaric 7y ago

Avast/Jumpshot data is bought by many marketing companies too and packaged as SEO tools, market research/analysis. They've been really proud to talk about their ability to collect all this data in the past [1]. But recently it became clear that all the data is stolen without user permission. [1] "Jumpshot Knows What You're Buying, Browsing, Searching" https://www.cmswire.com/digital-marketing/jumpshot-knows-what-youre-buying-browsing-searching/ https://www.cmswire.com/digital-marketing/jumpshot-knows-wha...

BlueTemplar 7y ago
Puts the popcorn in the microwave.

detcader 7y ago

I just tried to uninstall the Avast desktop software, but "avast.hub" and avast "worker" processes remained running even after the "Uninstall Avast" process quit. Probably just incompetence... Probably!

Sophistifunk 7y ago
>Probably just incompetence... Probably Right. Just like Zoom.

sagunsh 7y ago

I don't use any antivirus software now a days. They basically seems to slow down the computer (I am not quite sure about this) but here I got one more reason not to use one. I guess qindows defender is okay and sufficient for most of the cases and you can always switch to Linux.

rafaelvasco 7y ago
Yeah, I stopped using AV in Win7. Never looked back;

drewrem11 7y ago

PCMag article talks about how Avast's 'de-identification' of the collected browser histories can fail and be used to by third-party companies to link your web clicks to your real identity https://www.pcmag.com/news/the-cost-of-avasts-free-antivirus-companies-can-spy-on-your-clicks https://www.pcmag.com/news/the-cost-of-avasts-free-antivirus...

deleted 7y ago
[deleted]

ryuukk_ 7y ago

that's what every VPNs are doing that's what every firefox/chrome extentions are doing that's what every mobile apps are doing Time to wake up slaves of the modern world

deleted 7y ago

[deleted]

deleted 7y ago
[deleted]

asasidh 7y ago

If you are using a product that dials home, paid or otherwise, you have to assume it is collecting and selling your data.

jacquesm 7y ago

AV software acts like and treats your computer pretty much the same way that malware does, it should not be surprising the companies do the same. They're in Prague, would be nice to see the teeth of the GDPR used to put the fear of god into parties in this space. Maximum penalty times the number of clients they had should do the job nicely.

catalogia 7y ago
Is there any chance what they're doing might fall under some sort of 'unauthorized access' computer hacking criminal law? Something that could get individuals sent to prison rather than just getting the company fined? There is no way they had meaningful informed consent for any of this. I don't think shit like this will stop unless executives and the engineers who humor them start getting their lives justifiably destroyed.
- BlueTemplar 7y ago
  Maybe, if government computers were involved ?

annoyingnoob 7y ago

I thought this was well known. I wrote code to ingest Jumpshot data years ago. You have to wonder about the quality of the data though - maybe those using Avast aren't the best measure of all things web related.

jammygit 7y ago

Anything named an antivirus should be possibly to sue for this sort of thing, right? It could not possibly be more misleading It’s like a locksmith company monetizing by sneaking people into your home when you’re asleep

bradknowles 7y ago
That would be William Brodie. See https://en.wikipedia.org/wiki/William_Brodie https://en.wikipedia.org/wiki/William_Brodie Edit: I only know this because I recently heard about this guy on the British TV show "QI".

partiallypro 7y ago

Until Windows 10 (which just has a great built in virus detection system,) I would always push people to Avast. I am shamefully disappointed that they've fallen this far.

BlueTemplar 7y ago
Sadly, I wouldn't be certain about Windows 10 itself not spying on users and exfiltrating this information... (Today or in the future.)

ThePhysicist 7y ago

Funny, just today I looked at their analyst presentation, which mentions that 17 % of their revenue comes from user data monetization: https://investors.avast.com/Document-Download/Analyst%20Teach-In/986db62f-83c5-46c5-bb2e-212475ef6bb5/Analyst%20Presentation%205%20July%20F https://investors.avast.com/Document-Download/Analyst%20Teac...

d-c 7y ago

They entice us with free products, meanwhile they're biting...

tomc1985 7y ago

I wish there was a way to punish all the people participating in these data sharing things. Because it is endemic, a gold rush even, with every single individual involved lacking scruples as they sell their fellow man out

1000units 7y ago
Many people who post here are involved.

tomaskafka 7y ago

It's amusing to watch how slowly is this becoming a common knowledge - company I worked for at the time has been buying complete Jumpshot url logs 4 years ago, and everyone knew where the data is coming from.

Joeri 7y ago

I'm not surprised. The antivirus sector seems to prey on people as much as the virus makers. I had my PC infected accidentally by norton antivirus a few years ago. They snuck it onto my system by hiding themselves in an oracle java update. They didn't install right away, waited a bit so I couldn't immediately link it back to what caused it. The uninstall function in programs and settings was a misdirection and threw an obscure error. The uninstaller downloadable from their website would pretend to uninstall, require a reboot, and after the reboot the malware would reseat itself on my system. Eventually I had to start up in safe mode and painstakingly go through my system file by file, and registry key by registry key, to root it out. They know all the techniques the viruses use, and they use most of them. That was when I decided to stop using Oracle Java on all my personal systems and minimize my use of Oracle products on a professional basis. Learning they were a malware distributor was the drop that tipped the bucket.

mschuetz 7y ago
Glad I'm not the only one. I was a Java dev for many years and also used it for private projects. When they started shipping unwanted malware together with Java was when I decided to remove Java from my toolset.
- bArray 7y ago
  > When they started shipping unwanted malware together with > Java was when I decided to remove Java from my toolset. Would just like to say, OpenJDK is quite a solid step-in replacement for Oracle's Java: https://openjdk.java.net/ https://openjdk.java.net/ I've used it in production, I've built apps that I then _had to_ use Oracle's Java (without problem), using older and newer versions have been very stable - would very much recommend. I had one issue 8 years ago between versions, but nothing since.
barbarbar 7y ago
I have never heard of this. Do you know which versions that include that kind of malwa reference.
LargoLasskhyfv 7y ago

acvny 7y ago

Haha, you wanted free antivirus?

whatsmyusername 7y ago

Avast also portscans your local network. I kept getting alarms on my Symantec laptop and couldn't figure out why. Took running TCPNetView on the two avast machines full time and waiting for the alarm to fire to figure it out.

Animats 7y ago

Look at in Avast's privacy policy: "Enable use of your personal data to create a de-identified data set that is provided to Jumpshot to build trend analytics products and services."[1] Where does the "consent" mentioned there occur? They claim to be GPDR compliant; it has to be explicit and separate from other agreements. [1] https://www.avast.com/privacy-policy https://www.avast.com/privacy-policy

Sophistifunk 7y ago

I'm glad Vice is writing about this, but how many mb of browser-tracking crap do you think Jane Sixpack gets alongside that article if she doesn't have a (real) adblocker and noscript?

jameslin 7y ago

If you are not being sold a product, you are being sold as a product.

ansmithz42 7y ago

My question on avast is: How do we know it has completely uninstalled from our devices? Given the reputability of this company whose to say they don't leave something behind after we uninstall. It would be great if someone with the means could do a before and after test to verify this.

dancemethis1 7y ago

Another day, another leak of proprietary software collecting and selling sensitive user data. Hopefully Discord's day is coming soon.