+- Sinisterly (https://sinister.ly)
+-- Forum: General (https://sinister.ly/Forum-General)
+--- Forum: World News (https://sinister.ly/Forum-World-News)
+--- Thread: AVG auto-installs vulnerable Chrome extension (/Thread-AVG-auto-installs-vulnerable-Chrome-extension)
AVG auto-installs vulnerable Chrome extension - meow - 01-01-2016
I'm not really sure whether this fits in with world news or not, but I figured I'd put it here since it's a pretty big deal for the 9 million Chrome users that were affected by it.
https://code.google.com/p/google-security-research/issues/detail?id=675
https://www.reddit.com/r/netsec/comments/3ykf1j/avg_autoinstalls_web_tuneup_chrome_extension/
Quote:When a user installs AVG AntiVirus, a Chrome extension called "AVG Web TuneUp" with extension id chfdnecihphmhljaaejmgoiahnihplgn is force-installed. I can see from the webstore statistics it has nearly 9 million active Chrome users.
https://chrome.google.com/webstore/detail/avg-web-tuneup/chfdnecihphmhljaaejmgoiahnihplgn/reviews
This extension adds numerous JavaScript API's to chrome, apparently so that they can hijack search settings and the new tab page. The installation process is quite complicated so that they can bypass the chrome malware checks, which specifically tries to stop abuse of the extension API.
Anyway, many of the API's are broken, the attached exploit steals cookies from avg.com. It also exposes browsing history and other personal data to the internet, I wouldn't be surprised if it's possible to turn this into arbitrary code execution.
For more information follow the links.
RE: AVG auto-installs vulnerable Chrome extension - Skullmeat - 01-01-2016
(01-01-2016, 11:48 PM)meow Wrote: I'm not really sure whether this fits in with world news or not, but I figured I'd put it here since it's a pretty big deal for the 9 million Chrome users that were affected by it.
https://code.google.com/p/google-security-research/issues/detail?id=675
https://www.reddit.com/r/netsec/comments/3ykf1j/avg_autoinstalls_web_tuneup_chrome_extension/
For more information follow the links.
AVG. Their AV is trash. It's detection rate is low, and the software is buggy and vulnerable. I've seen so many users with AVG and their system is infected to hell.
RE: AVG auto-installs vulnerable Chrome extension - mothered - 01-02-2016
That's what can happen when you Install software with an "Ad-Supported" license, which Is exactly what AVG Is.
You don't know what crapware you're getting during the Installation process, and whether It's malicious. I know very well of all the freeware sites that "claim" not to not have any bundled software with their products. Such sites are not purely "freeware", hence their software comes bundled with unexpected surprises. My site that's In my signature Is probably the only one (or one of very few) that only provides purely "freeware" tools and nothing else,
So when looking for licensed products without additional bundled software, license types like GPL, Donationware, MS-PL, FTL are some common types that do not Include anything other than the product Itself.