-
Tips for becoming a good boxer - November 6, 2020
-
7 expert tips for making your hens night a memorable one - November 6, 2020
-
5 reasons to host your Christmas party on a cruise boat - November 6, 2020
-
What to do when you’re charged with a crime - November 6, 2020
-
Should you get one or multiple dogs? Here’s all you need to know - November 3, 2020
-
A Guide: How to Build Your Very Own Magic Mirror - February 14, 2019
-
Our Top Inspirational Baseball Stars - November 24, 2018
-
Five Tech Tools That Will Help You Turn Your Blog into a Business - November 24, 2018
-
How to Indulge on Vacation without Expanding Your Waist - November 9, 2018
-
5 Strategies for Businesses to Appeal to Today’s Increasingly Mobile-Crazed Customers - November 9, 2018
AVG’s Chrome extension exposes personal data of 9 million users
Customers who install AVG software on their PC get a prompt in the end to safeguard their browsers. If you want it, you’ll have to download it manually from the Chrome store.
Advertisement
Web TuneUp works by validating links that appear on a web browser page, such as on a search engine results list. That investigation could mean the extension is permanently banned from Chrome.
Quite a few issues arise from installing the extension, for instance that it changes the startup setting to “open a specific page” ignoring the users choice (for instance to continue the last session). It is not known yet if any users were affected by the security scare. AVG earns when users make searches and click on ads on the custom search engine they have created.
AVG developers have quickly responded to the issue, but it has been revealed that despite the messages exchanged between the two companies, the Amsterdam-based company has failed in its initial attempt to fix the flaw. On the email, he wrote that he apologizes for the note’s angry tone but that they are not pleased with what the tool is doing to their Chrome users. “The extension is so badly broken that I’m not sure whether I should be reporting it to you as a vulnerability, or asking the extension abuse team to investigate if it’s a PuP [Potentially unwanted Program]”.
Google Project Zero researcher Tavis Ormandy discovered a vulnerability, since fixed, in AVG Web TuneUp, a Chrome extension that forcibly installs when users install the AVG antivirus software. Malicious websites could exploit the toolbar’s programming blunders to access other websites a user was logged into. As the Google employee pointed out in a second report, anyone can add that to their domain and because it does not check for a secure origin, it is vulnerable to man-in-the-middle attacks, effectively disabling SSL.
Advertisement
As of December 28, AVG had completed a more secure patch, but installations of the plugin were still frozen while Google’s Chrome Web Store team investigated possible policy violations by AVG-violations that could get AVG kicked off the Chrome Store completely. I can see from the webstore statistics it has almost 9 million active Chrome users. The irony of an anti-malware extension jeopardizing security is not lost on anyone.