Jump to content

SweX

Most Valued Members
  • Posts

    2,266
  • Joined

  • Last visited

  • Days Won

    110

Posts posted by SweX

  1. Popular Chrome extension turns out to be Spyware!

     

    If an extension is listed for Chrome and has a decent rating, it is surely safe to install, right? Maybe not. In today’s world spying has become a common activity. That does not mean though that it is any more acceptable. A Chrome extension known as Webpage screenshot collects private information about its users and shamelessly sells it to a third party. What is astonishing is that the extension has an excellent rating of 4.5 stars and has been downloaded by 1.2 million users worldwide. This highlights the lack of awareness among customers as to what such programs actually do behind the scenes.

     

    According to the founder of the CSIS Security Group, Peter Kruse:

    “To avoid any security check or detection mechanism from Google, Webpage Screenshot includes a sleep function, so that the spyware-like behavior will not be activated right away, but a week later.”

     

    Google’s security check usually filters out malicious extensions from the chrome library, which is probably why the original software does not act like spyware at all. After a week however, it downloads additional components/code and commences the spying program. This way, the spyware part of code evades the scanners. Once activated, the spyware component collects sensitive information about the user and transmits it to the ip address: 64.34.175.88, located in New York, USA.

     

     

    hxxp://blog.emsisoft.com/2015/04/10/popular-chrome-extension-turns-out-to-be-spyware/

  2. I find it really surprising that you care about memory usage. With people having at least 4 to 8 GB RAM these days, and AV using 50 MB to 300 MB is no big deal as long as it's light on your system. Memory usage is not what determine if an AV is light or not it is how it handles real time file scanning that is the main factor I really surprises me that at this day and age people still jude an AV's lightness in terms of " oh my!! it is using 200 MB of RAM WOW" Let it use all it needs as long as your system is light and runs fast.

    It is indeed a big deal if the product is not meant to use more than 100-120MB like ESS/NOD32. If it uses 300MB then it means there is a problem. And if there is a leak, chance is it wouldn't stop at 300MB but continue to increase all the time if allowed, even to GB size in some cases.

     

    "Memory usage is not what determine if an AV is light or not"

     

    That's correct, and can actually not be said enough. But the size of the program and databases ESS/NOD32 vs heavy lifters like KIS, BIS, could be reflected on the RAM usage if they are loaded in RAM like ESET. ESS is a tiny tight package compared to them.

     

    If KIS would use 250MB it would be quite normal (unless things have changed)

    But if ESS would use that much, it indicates that there is a problem.

     

    Avast on the other hand flushes the ram by design so it will rarely go above the 5MB mark. (unless things have changed)

     

    So there is more than one thing that can be connected to the RAM usage of a product.

  3. Occasionally ?  I thought you checked Wilders more or less everyday. At least I see you online more often that what I would call occasionally  :D And I sent you the PM on Wilders since that's where the thread is located. 

     

    Well I checked the send date to be sure, and the PM was indeed sent on Mars 11. 

     

    That's great to hear. Yeah I know it was the driver that was detected as Unsafe (optional). But I also know that SurfRight would like to get it fixed ASAP as they don't want their software to be associated with PUA detections in any way.

  4. I've scanned hmpalert3.exe but ESET didn't report anything on it.

    Still, it would be good if ESET replied back when other vendors make contact don't you think? Zero response doesn't sound good.

     

    ESET currently has a false positive on one of our drivers. We have submitted 2-weeks ago, received zero response. So if you have enabled PUA to maximum in ESET, be sure to disable that.

    https://www.wilderssecurity.com/threads/hitmanpro-alert-support-and-discussion-thread.324841/page-199#post-2479163

     

    I also sent the following link in a PM to you on Wilders on Mars 11 to let you know, but you didn't reply to my PM or made a reply in the thread: https://www.wilderssecurity.com/threads/hitmanpro-alert-support-and-discussion-thread.324841/page-175#post-2468397

  5. @rugk, I couldn't have answered the root cert question as I haven't used the tool, so good that dom1da could chime in on that.

     

    Yeah, I also think it would be great to have their own tool included in their own KB article.  :)

  6. I knew about this before anyone else. Hence my post. I want a change log. Not an argument. Thanks. 

     

    17. Do not pre-announce releases.  Due to differences in scheduling, it may sometimes take several minutes after a release has appeared on ESET's web site for the release announcement to appear here in the forum.

     

    https://forum.eset.com/topic/76-rules-of-the-eset-security-forum/ 

     

    And with the announcement comes the changelog: https://forum.eset.com/topic/4614-eset-nod32-antivirus-80312-released/

  7. I ask because the Anti-Phishing descriptor on ESET's Technology page (hxxp://www.eset.com/us/home/whyeset/technology/) doesn't include Nod32 in 'Related products'. I hadn't noticed that before.

    Yes it should be listed. Your link goes to the .com/us/... tech site.

     

    For the sake of it I checked the .com/int/...tech site (link in my signature) and NOD32 is not listed under Anti-Phi there either.

     

    hxxp://www.eset.com/int/about/technology/

  8. @SweX

    WOW, I didn't know that ESET published their own tool to remove it. Great... :)

    However in their KB article they linked to the official tool from Levono, so what's the best way? Use the ESET tool or the Levono tool?

    I search yesterday and I searched now again, but I just can't find the article, blog post, or whatever it was that I read a few days ago where it was nicely explained that the ESET tool would literally find everything connected to Superfish. 

     

    So you just have to believe me...this tool rocks.  :D

  9. @rugk: I can't give you any response because NOD32 doesn't give any name in the message.

    I don't believe the notification in your screenshot in post #8 is an ESET detection notification, at least it doesn't look like it. It seems to be from the browser itself. Firefox uses "malware data" provided by Google, so if it is blocked in Chrome there is a chance that it is blocked in Firefox as well.

  10. Swedish newspaper DN had this story about the Chrome extension "webpage screenshot" today, so I made a rough translation of the important bits from the article.....

     

    According to the article it will send data each minute about what websites you have visited to a server in the U.S., even from secure connections. It does not collect content from visited websites or content from emails, but it has capabilities to do that if the "dev" want to. The "dev" says to DN that the purpose with collecting all this is to build up statistics on browsing behaviours and sell it because it has a high commercial value, and he point out that it's not data from individuals that is interesting but browsing behaviours as a whole.

     

    The code that makes the spying possible is not present in the extension's source code at first, but gets downloaded from the Internet some time after install, and the spying begins around 1 week after install. Which could be one reason to why the extension passed the security checks.

     

    Original: hxxp://www.dn.se/nyheter/sverige/hemlig-kod-spionerar-pa-svenskars-surfvanor/

     

    Translated: https://translate.google.com/translate?sl=sv&tl=en&js=y&prev=_t&hl=sv&ie=UTF-8&u=http%3A%2F%2Fwww.dn.se%2Fnyheter%2Fsverige%2Fhemlig-kod-spionerar-pa-svenskars-surfvanor%2F&edit-text=&act=url

     

    The extension at the google store (don't install it):

    https://chrome.google.com/webstore/detail/webpage-screenshot/ckibcdccnfeookdmbahgiakhnjcddpki?hl=sv

     

    [privacy]

    The notice you see about having access to your history and website data is automatically generated because Webpage Screenshot uses chrome extensions api. Be sure that it doesn't look at your private data!
    A researchers from UC Berkeley tested and review the source code of this extension.

     

    For your own privacy, Webpage Screenshot Capture will not send anything to any server.

     

    hxxp://mac.softpedia.com/get/Internet-Utilities/Webpage-screenshot-for-Chrome.shtml

     

    Edit: The above link doesn't work anymore, but I remember that the Developer name at Softpedia was "Amina" which is beginning of the first name Aminadav Glickshein.

  11. "which will show several notification to encourage users of Windows 7 and Windows 8.1 to upgrade to Windows 10."

     

    If we change out the word "notifications" to Ads it sounds so much worse, and wrong. People shouldn't need to be convinced to update, if Win 10 is good enough people will update anyway since it's a Free upgrade after all, providing it actually is better than the OS they currently use, and that remains to be seen. It's up to MS to show their users that they "still got it".

  12. IMO, instead of fiddling around with exclusions and start believing the product is wrong and that it may be a FP each time it detects something(doing its job), simply send in a FP report to ESET and be done with it.

     

    hxxp://kb.eset.com/esetkb/index?page=content&id=SOLN141&actp=search&viewlocale=en_US&searchid=1428166173832

     

    If it really is a FP they will take care of it, if not then the detection will stay, and if you're still not happy after that then you can use exclusions provided you know about the risks. 

     

    "I never saw one stopping a download without expressly asking me if I want to continue or not."

     

    And if the user takes the wrong decision and end up infected they would blame the product, and the vendor would blame the user for taking the wrong decision. Therefore, no questions asked is best for the majority of users. But when it comes to user optional detections like Unsafe/Unwanted the choice is totally yours.

  13.  

    It's one thing to forget a username or password ... but to not know the email address that you used to create your ESET account is somewhat incredible.

    How many email addresses do you use?

    Anyways ... assuming that you at least haven't forgot all of the email addresses that you use, go here and just keep putting in email addresses until you get a message saying the information has been sent to your email.

     

    I use 3 email addresses, my wife has 5 or so ... we maintain a file that details what email and password is linked to each online service we use.

     

    Those who fail to prepare, prepare to fail ...

     

    did you happen to notice that my post was almost 5 months ago before you replied?

    Hello,

     

    I believe Destarah responded to the post by "hash" that was made yesterday : https://forum.eset.com/topic/3605-need-to-reinstall-smart-security-after-reformat/?p=26223

×
×
  • Create New...