Avast is now officially spyware - selling user data!

[jagdtigger]

10 hours ago, leadeater said:

I bet you have zero trust in the entirety of Azure

As i said before, they done more than enough to deserve the zero trust classification .

[yian88]

1 hour ago, maartendc said:

Lol, sure, everything is rigged. Let's not do any testing of anything, because it's all "paid for".

 

Also, I can't tell whether you are upset at Windows Defender or Windows itself. Two different things. In your opinion, Windows is unsafe regardless of your antivirus option, so what are you even talking about?

 

Windows has gone a long way towards improving security with UAC and popping up alerts every time an app wants to make changes. If your user is dumb enough to click "agree" and "accept" to every prompt, no amount of OS security can save you.

 

Even on Android, scammers get users to install things outside of the app store and get their device compromised. It doesn't matter if your security is 100% waterproof. If your dumb user picks up the phone and provides their password and 2-factor authentication codes to a scammer, you are out of luck.

 

Teach your mother not to download and install random .exe's or clicking every scam e-mail instead of blaming Windows.

Yes but actually no.

Windows is unsafe by design.

Windows defender is mostly useless by itself.

What is unclear? any ranks showing defender being good or on top is probably fake or they tested something else but you didnt read the article and methodology you just look at the slide and fall into their trap.

Yes my mother sucks at using a PC no doubt about that she's unteachable, but its a different subject, windows does suck for non tech users, its current design fits perfectly the dev/office/server needs where an admin manages the OS'es of the users and sets up rules, but as a personal computer you want to use everyday for safe tasks its a bad design, most people adapt and learn, those that cant will have virus and security issues.

[leadeater]

1 hour ago, jagdtigger said:

As i said before, they done more than enough to deserve the zero trust classification .

Well that is just a you thing, there's a big difference between misunderstandings of what each person means by certain terms along with flawed and obnoxious UI design to rope you in to agreeing and the jump to actual selling of private data and sharing between entities not authorized to do so. Azure has been audited countless times by countless different organizations and has been accredited many different security and compliance standards.

 

Not liking a company and it's practices doesn't at all make it logical to assume they are breaching data security when there is mountains of evidence to show it isn't happening.

 

I personally dislike Azure, there are few services and things it is good for but overall it's a hard pass but my reasoning is technical and financial based not off a personal dislike of the company. This evaluation extends beyond just Azure though, I include all of them in this. Like 80% of "Cloud" is just hype and there's extremely poor analysis of options being done at upper management levels and I know right now and for the last 12 months there has been large shifts of companies moving parts or all services back on to their own resources due to far greater costs than expected, I bet they were told countless times beforehand by their own IT staff but cloud sales people are the best in the world so it's a losing battle until the bills come in.

[leadeater]

31 minutes ago, yian88 said:

What is unclear? any ranks showing defender being good or on top is probably fake or they tested something else but you didnt read the article and methodology you just look at the slide and fall into their trap.

https://www.av-test.org/en/antivirus/home-windows/

https://www.av-test.org/en/about-the-institute/test-procedures/

https://www.av-test.org/en/about-the-institute/test-procedures/test-modules-under-windows-protection/

 

Quote

The AV-TEST GmbH is the independent research institute for IT security from Germany. For more than 15 years, the experts from Magdeburg have guaranteed quality-assuring comparison and individual tests of virtually all internationally relevant IT security products.

 

One of the largest collections of digital malware samples in the world, the Institute's own research department, as well as intensive collaboration with other institutions, guarantee tests on an internationally recognized level and at the current state of the art. AV-TEST utilizes analysis systems developed in-house for its tests, thus guaranteeing test results uninfluenced by third parties and comprehensible at all times for all standard operating systems and platforms.

https://www.av-test.org/en/about-the-institute/

 

There are some trustworthy testers but even those aren't free from all criticism, will post below just keep in mind this is coming from someone with skin in the game. The gist is you need to click in to the details of each product and manually check each score, but we all were doing this anyway right?

 

Quote

However, we believe it is OK to take into consideration the results of the separate PROTECTION and PERFORMANCE categories and, of course, the promised REPAIR test.   Again, we don’t disagree with the methodology of their individual tests…we are taking issue with what scores are required in these tests to achieve “certification.”

https://eugene.kaspersky.com/2013/05/09/av-test-certification-devalued/

 

And if you don't trust them jump over to https://www.amtso.org/ which on the test results I have looked at there show Defender doing very well, most products over all do well and to do badly is an outlier (or refused to take part or issued a retraction/take down).

[captain_to_fire]

1 hour ago, leadeater said:

most products over all do well and to do badly is an outlier (or refused to take part or issued a retraction/take down)

In my opinion, this is how all antivirus programs detect malicious files:

• It examines files by pattern matching with known signatures or variations with similar malicious code (the 100% way to detect a virus is if the AV has signatures for it)
• If it's a new file and the AV can't make a decision if it's malicious or not, it'll execute it in a local emulator to see if it does something malicious like enumerating files to disk (ransomware) or hook into web browsers (spyware).
• But since malware authors are clever, they'd make their virus perform benign tasks when executed inside an emulator or conceal the payload to evade detection.
• But the antivirus can do one or both things: it uploads the suspicious file to a cloud based sandbox for a more thorough detonation and/or allow the malicious file to run while the AV monitors how the execution unfolds. Once detonated in the sandbox, the people of the AV company will document how it behaves and push an update to everyone.
• Should the unknown file allowed to run inside a PC and it performs a behavior characteristic of malware that the AV knows, it will terminate the process and, if the damage is not yet severe, it will try to roll back malicious actions like an unknown ransomware attempting to overwrite the Master Boot Record or modify registry keys.

Basically, they all work the same. The only differences I think between AV vendors is how often their researchers fine tune their machine learning algorithms based on the threats they're facing, and how many vulnerabilities does an antivirus has. Because an antivirus has a deep access of the system files including the kernel, it is another vector of attack as demonstrated by the researchers of Google Project Zero actually found critical vulnerabilities in AV programs from Kaspersky, Symantec, ESET, Sophos, FireEye, and even   Windows Defender [1] [2] [3], typically they find problems with the AV's file parser.

I think at the moment, only Microsoft has follwed Project Zero's recommendation of running the antivirus process inside a sandbox although I don't think it is enabled by default for everyone.

 

[leadeater]

7 minutes ago, captain_to_fire said:

Because an antivirus has a deep access of the system files including the kernel, it is another vector of attack as demonstrated by the researchers of Google Project Zero actually found critical vulnerabilities in AV programs from Kaspersky, Symantec, ESET, Sophos, FireEye, and even   Windows Defender [1] [2] [3], typically they find problems with the AV's file parser.

Yep sometimes an AV is like an off the shelf safe but you forget to change the default pin code, all the nice stuff is right in here but don't worry you know the pin 

[jiyeon]

I remember my former family PC coming with Avast, and I was immediately unsettled. Very glad the new family PC has a fresh Windows 10 install and no sign of Avast.

[Lii]

22 hours ago, atxcyclist said:

So, if AVG and Avast are garbage, what to do for legit free virus protection?

Virus total, tought it has a limit of 500mb for upload..

Or malwarebytes/kaspersky, as someone as already suggested.. but I wouldn't still give too much trust

[jagdtigger]

12 hours ago, leadeater said:

there's a big difference between misunderstandings of what each person means by certain terms

Yeah, because the telemetry fiasco was a misunderstanding and MS never lied about its existence. And never stressed falsely that the data they collect is anonymized.... /s

[leadeater]

19 minutes ago, jagdtigger said:

Yeah, because the telemetry fiasco was a misunderstanding and MS never lied about its existence. And never stressed falsely that the data they collect is anonymized.... /s

They didn't lie about it existing, what people disagreed on was whether or not you could actually anonymize the data and what classification names data types came under. That's some creative story recounting right there. It makes no difference what you or I say what data is what type, it only matters what the local laws of each country regard it as which you then have to comply to those local laws, that's all it's ever been, two different groups arguing what data is and is not allowed to be gathered by means of arguing the classification name of that data.

 

You're kidding yourself if you ever thought Microsoft said there was zero data collection.

[vanished]

7 hours ago, sowon said:

I remember my former family PC coming with Avast, and I was immediately unsettled. Very glad the new family PC has a fresh Windows 10 install and no sign of Avast.

Even though bloatware is far less common these days, I think due to efforts by Microsoft to make OEMs clean up their act*, I would still always just start by reinstalling any pre-installed system.  You just never know what they've done to it otherwise.

 

*ironically during the same period they massively cranked up the intensity of first-party bloatware like candy crush.  Very strange.

[mr moose]

8 hours ago, leadeater said:

They didn't lie about it existing, what people disagreed on was whether or not you could actually anonymize the data and what classification names data types came under. That's some creative story recounting right there. It makes no difference what you or I say what data is what type, it only matters what the local laws of each country regard it as which you then have to comply to those local laws, that's all it's ever been, two different groups arguing what data is and is not allowed to be gathered by means of arguing the classification name of that data.

 

You're kidding yourself if you ever thought Microsoft said there was zero data collection.

 

Just to add to this, no evidence has ever emerged that MS collected data that wasn't outlined in their privacy policy,  the DPA found this and their only gripe was that users were not adequately informed during the install process. Not once has any agency or security outfit discovered MS collecting data they didn't tell you about in their privacy policy nor have they ever been caught selling that data.  Nearly everything you hear on the internet about it is wrong in some fashion or another and people just soak it up.   Also for the record many government agencies have had access to the windows source code since 2003,  hell even china has access to it. 

 

 

[Otto_iii]

This is news?

If you ever had a 2 or 4 thread processor that got infected with it while installing CCleaner or Speccy you'd be well aware of how its not just spyware, but about the worst malware you can have on your computer, bad enough a complete wipe of storage and windows 10 is called for if you get it, as it embeds itself so deeply into the system that even with official uninstall clients, registry edits, and all other means it never really is removed and hampers performance like no tomorrow.  

Seriously i used to think of Norton and McAfee as bad, then once Avast bought Piriform and i accidentally got it on a few systems via installation of modern CCleaner and or Speccy clients i noticed the massive performance tank even after proper, intensive and official uninstallation.  Especially on 4 thread (whether 2 or 4 cores) systems they literally half the performance of the system, on a more modern system its still a major tank on performance. 

Windows 10 Defender is about the best anti-virus you can get, especially if performance is a factor, because of this all malware anti virus companies besides maybe Malwarebytes have taken to becoming worse then the programs they aim to prevent being installed on your computer, sad people are only just waking up to this.  They serve no purpose so have turned to the dark side. 


I really can't properly word the disdain i have for Avast.  John McAfee is likely involved in multiple homicides and i'd rather have him living in my neighborhood then avast on my computer, people who defend this program need their heads checked. 

[LunaP0n3]

Windows Defender, with Malwarebytes as a backup. I run Bitdefender on family PCs for peace of mind.

Gave up using avast a long time ago, got sick of the constant ads and popups.

Never looked back.

[Colonel_Gerdauf]

I was reading through this thread, fully expecting certain charlatans to act like obnoxious keyboard experts

 

And it is safe to say that I wasn't disappointed.

[ChroMeDoMe]

I use the paid version so I hope that this doesn't affect me, but the whole thing you mentioned about the email signature? Simply not true my good sir. I literally tried it not even 50 minutes ago and got no signature. I even used Gmail like you told me to

[RejZoR]

Ok, to hold everyone's horses, in order to even be affected by data collection of any kind, you were required to use any kind of avast! browser extension with enabled data sharing option (which granted, was enabled by default before).

 

- If you were only using avast! Antivirus without browser extension, you were NOT affected

- If you used avast! browser extension and had data sharing disabled in it, you were NOT affected

[SpikeSpiegel]

Official Avast statement on the recent news about privacy 

 

In December 2019, we acted quickly to meet browser store standards and are now compliant with browser extension requirements for our online security extensions. At the same time, we completely discontinued the practice of using any data from the browser extensions for any other purpose than the core security engine, including sharing with our subsidiary Jumpshot.
 
We ensure that Jumpshot does not acquire personal identification information, including name, email address or contact details. Users have always had the ability to opt-out of sharing data with Jumpshot. As of July 2019, we had already begun implementing an explicit opt-in choice for all new downloads of our AV, and we are now also prompting our existing free users to make an opt-in or opt-out choice, a process which will be completed in February 2020.
Our Privacy Policy details the protections we put in place for all our users. Users can also choose to adjust their privacy levels using the broad range of settings available in our products, including control over any data sharing at any time. We voluntarily comply with the GDPR and California Consumer Privacy Act (CCPA) privacy requirements across our entire global user base.
We have a long track record of protecting users’ devices and data against malware, and we understand and take seriously the responsibility to balance user privacy with the necessary use of data for our core security products.

 

While....

 

https://palant.de/2020/01/27/avasts-broken-data-anonymization-approach/

 

[Delicieuxz]

My expectation is that many free browser extensions are doing this and that people should expect this is what many browser extensions exist to do for their owners.

 

I would expect the popular money-saving Honey extension to be doing this, though I haven't researched it.

[Commodus]

2 minutes ago, Delicieuxz said:

My expectation is that many free browser extensions are doing this and that people should expect this is what many browser extensions exist to do for their owners.

 

I would expect the popular money-saving Honey extension to be doing this, though I haven't researched it.

Honey explicitly says it doesn't.  Hell, Linus is in an ad saying it doesn't.  While I don't want to speak in absolutes, you'd have to go out of your way to show that it was acting suspiciously (and it doesn't sound like it is).

[jagdtigger]

On 12/12/2019 at 12:02 AM, leadeater said:

They didn't lie about it existing

Oh sorry, they just conveniently forgot to notify users about it until they got a slap on the wrist..... (Which isnt any better than straight up lying about it.)  As for wether its anonymized or not, that one was busted by the Dutch DPI.

Edited January 29, 2020 by jagdtigger

[Xiee]

Stopped buying Anti Virus software since 2014. The last one I used was Norton Internet Security which was gifted to me.

Been using Windows Defender ever since and Malwarebytes on the side.

[K1ngtoni0]

On 12/10/2019 at 4:35 AM, Furiku said:

So, avast antivirus suite, favorite free antivirus package of 400 million people has been caught selling user browsing and other  user data for advertisers and other nefarious purposes.

This officially changes status of Avast from antivirus suite supposed to protect us from spyware and malware and other nasty things into spyware itself.

 

Avast CEO Ondrej Vlcek happily commented the following:

Personally I already stopped using Avast some years ago when they started adding signatures to all my emails without user consent advertising their product. (Still an avast user using web protection or email protection? send a test email with gmail and you'll be surprised to find out this is true. )

 

Free lunches aren't free after all.

 

 

 

https://www.forbes.com/sites/thomasbrewster/2019/12/09/are-you-one-of-avasts-400-million-users-this-is-why-it-collects-and-sells-your-web-habits/

I was downloading a driver searching application for my old fingerprint read from the 2000's and it download avast. It was very hard to remove avast because even tho I uninstalled it, it was running in the background when I checked task manager. So I just reset my pc and downloaded a fresh copy of windows.

[RejZoR]

I don't understand how people can't uninstall avast!... Also there is avast! Uninstall Utility if this happens for some bizarre reason...

[Colonel_Gerdauf]

My advice here is the same as always; stick to the built-in Defender, and in the very rare situation that you need something more advanced, then at that point it makes no sense trying to pinch a few pennies. There are plenty of paid (and very good) AV programs.