8

It seems like many antivirus programs use the cloud to scan files for malware. Isn't this a privacy concern if local files are being uploaded to the cloud? For example with Automatic Sample Submission and Cloud Based Protection in Windows 10.

How exactly does this work because if some remote computer in the cloud can detect it, why not just have virus signature updates (like the old way of doing it)? If they use more advanced scanning techniques wouldn't this imply the whole file is being transferred and run?

Improve this question

3 Answers 3

Reset to default
1

This works differently depending on the AV that you are using. Some engines send the file to the cloud and generate a signature. In this case, the response is yes, they send the files to the cloud and this is a privacy issue (in some countries). On the other hand, some engines take metrics from the file and send these metrics to the cloud for post analysis or whatever. I would suggest you check the terms and conditions of the AV and you will probably find the answer. Or just ask them, specially if the information that they scan is protected and can not be transfered and things like that.

Improve this answer
0

In at least some AV products (Kaspersky is one I'm familiar with), the local application has signatures and heuristic/behaviour controls. What it's doing is (I think) three things:

  1. If there's doubt (heuristics and behaviour detection are statistical systems so they might not be 100% sure how to classify something), or it looks wrong but doesn't match a signature, uploading the file can allow human examination, and updating of signatures so that other systems are more exactly protected.
  2. If its not clear or the user has specified they will choose all actions, then it can be useful to check how other users have handled the same file. If most block it, the user can be told so. (I've used this facility quite a lot for a sense of comfort on "odd" system processes that I can't tell are needed or wasting resources.)
  3. Anti malware companies also track malware quite a lot. If they can't get feedback what has been detected (and what variants or novel behaviours seen), they can't do their own work as accurately. To take a simple example, Stuxnet apparently tried to attack only if it detected certain hardware and geographical regions. An antivirus company in (say) Canada just might never see many files to analyse them, unless their software in other locations can autoforward suspect files to them.

Against that, a lot of the time a hash (used as a numeric value that uniquely identifies a file) is enough, and much quicker to send, so I would expect a lot of the time, that is what's sent and checked. You can see this on the website virustotal.com which let's you enter a hash of a file instead of uploading the entire file itself.

Yes there are security concerns. But given the power within the system granted to an antimalware package, if you don't trust them, you'll have far bigger concerns than their cloud facility.....

Improve this answer
1
  • 2
    This is an informative answer about how AV companies work, but doesn't really answer the question of whether there's a privacy concern with AVs uploading your (potentially sensitive) local files (potentially without your knowledge or consent).
    – Mike Ounsworth
    Commented Aug 10, 2018 at 20:15
0

Antiviruses often send suspicious files to their editors to enable further analysis by humans, to determine if they're actually harmful or not. If yours does that, this can definitely be a privacy concern, and you should think about it before deciding whether to leave it on.

Some antiviruses (e.g Avira) prompt you by default before sending each file. If yours does, there's no harm in keeping the option active. If it doesn't and you're not comfortable with a few of your files being potentially seen by humans, you should probably turn it off.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .