Researcher Caught 4 spying extensions. Two from AVG and two from Avast are found spying on millions of users’ data including their browsing history.
The following are the extensions that caught stealing users’ data.
- Avast Online Security
- Avast SafePrice
- AVG Online Security
- AVG SafePrice
The extensions or add-ons are developed for security purpose to warn users’ when they surf any malicious website or download any malicious data while the SafePrice extension helps the user to purchase with best offers, comparison and a lot more.
A researcher Wladimir Palant notified the companies a month ago about the stealing behavior of the add-ons. A unique user identifier is generated by the extensions to track users.
When Avast Online Security extension is active, it will request information about your visited websites from an Avast server. In the process, it will transmit data that allows reconstructing your entire web browsing history and much of your browsing behavior. The amount of data being sent goes far beyond what’s necessary for the extension to function, especially if you compare to competing solutions such as Google Safe Browsing.
Wladimir Palant
The extensions can steal the following data:
- URL of the website, Users’ visit
- Page Title
- Referrer URL
- Users’ Country Code
- Browser Name and Version as well as OS Name and Version
- Webpage landing status (Direct, By Bookmark or Other ways)
Tracking tab and window identifiers as well as your actions allows Avast to create a nearly precise reconstruction of your browsing behavior: how many tabs do you have open, what websites do you visit and when, how much time do you spend reading/watching the contents, what do you click there and when do you switch to another tab. All that is connected to a number of attributes allowing Avast to recognize you reliably, even a unique user identifier
Wladimir Palant
Within 24 hours after notified, Mozilla takeover both the extensions.
This add-on violates Mozilla’s add-on policy by collecting data without user disclosure or consent
Mozilla
While Chrome has not removed the extensions yet. Mozilla is yet to blacklist the extensions that are it will be under use by users who have these installed on their browsers, so it is requested to all of you to remove any of the above mentioned four extensions if you are using them.
