AVG antivirus is always at the top of any average internet user’s top ten antivirus. They have built a solid reputation over the years that the recent news about AVG’s Web TuneUp software having some security issues sent a bit of a shock wave in the internet world. AVG’s Web TuneUp is pitched as an absolutely free and easy way for internet users to defend themselves against invisible threats, or threats that cannot be detected by your average software. In tech terms, these sort of hidden threats are known as malwares.
The problem for the software started on the 15th of December last year when Google security team known as Project Zero, flagged the issue. In a post on the Project Zero site, Tavis Ormandy, head of the group informed the other members of the group about the issue. The chief issue for Ormandy and his team was the ability of the AVG Web TuneUp to override safety issues built into Google’s browser, Chrome.
According to Ormandy, the flaw in Web TuneUp was noticeably altering Chrome’s settings by automatically installing a plug-in into the browser. One of the consequences of this is that users of the software cannot even opt out of it which meant one is stuck with it. The only solution being the drastic measure of uninstalling both the browser and the anti-malware.
What is the effect of this glitch on users of AVG’s Web TuneUp? It meant that people’s internet history can be viewed by others. Again, other personal data can be accessed by strangers if they knew where to look. And the scariest part is that the bug could open a window for hackers to spy on people’s emails and other activities done online by the unwary. Basically, one is left wide open for some malicious hacker to do as they please with our online data.
Apparently, this is the second time that the potential bugs in the software have being flagged. Scientists working at the security firm Ensilo pointed out that AVG’s Web TuneUp contained a security flaw that made it possible for serious hackers to add specific codes to Windows PC. This malwares would be able to compromise Windows in-built security features.
This time around Project Zero’s head didn’t stop at just pointing out the problem. He followed it up by writing a strongly-worded mail to AVG. Ormandi wrote,
‘Apologies for my harsh tone, but I’m really not thrilled about this trash being installed for Chrome users. My concern is that your security software is disabling web security for nine million Chrome users, apparently so that you can hijack search settings and the new tab page. I hope the severity of this issue is clear to you, fixing it should be your highest priority.’
That strongly-worded letter was written on the 15 of December, and after a few more exchanges between AVG and Google, the problem was finally solved by AVG after its initial attempt to fix the problem met with failure. Google was gracious enough to acknowledge that the problem had finally being fixed on the 26 of December 2015. AVG confirmed this in a statement that read in part,
“We thank the Google Security Research Team for making us aware of the vulnerability with the Web TuneUp optional Chrome extension.The vulnerability has been fixed; the fixed version has been published and automatically updated to users.’
What this debacle has shown is that any software is capable of introducing bugs to our PCs and leaving us very vulnerable to attacks from hackers and malicious malwares, even if the software is a supposed to improve web security.