Anti-virus anonymity question

Question

Many people pay for VPNs and select the VPN based on whether or not that VPN keeps logs of the user's activities and if so for how long. The motivation is privacy- they don't want their surfing habits to be known. Of course they take other steps , controlling cookies etc to control their privacy also.

My question is how privacy is potentially effected anti-virus software. As far as I can tell virtually all of the anti-virus makers now attempt to identify phishing sites and other malicious URLS. In order to do this, they intercept every url their customer surfs to, in order to examine it for viruses or check it against, say, a black list of known bad urls. \

My question is, aren't these companies in a position to benefit or monetize their user's definitive clickstreams? I read the privacy policy of two, BitDefender and Eset and they both sort of say, to the best of my ability to understand, that you're permitting them total access to all knowledge of when and where you surf, full stop. They then say they might share any information they collect with their partners yadda yadda yadda. This was my understanding of their privacy policies and maybe I am mistaken.

My question is- very many people go out of their way to read the TOS for their VPNs to make sure they're not being logged, but these anti-virus companies make NO promises about any logs they might keep or for how long.

People who are worried enough about getting hacked and privacy that they buy a VPN also are likely to use an anti-virus it seems to me. Is this an example of badly compartmentalized risk assessment ? It seems like the anti-virus companies have and may keep all the information users were so worried about their VPN having and keeping?

Have I got this wrong?

Answer 1

There are two ways in which these lookups may be ~safe for your privacy.

First, these lookups should be encrypted via SSL. Assuming a good SSL implementation (i.e. assuming nothing like Heartbleed) and a client that quickly revokes rogue certs, this means that third parties cannot directly see your data, so you merely have to trust the lookup server.

Second, the lookups should be hashed. Because these hashes cannot be salted, somebody with access to your lookups could note what you have in common with others, but won't be able to identify sites for which they have only hashes.

I can't speak to the setup at Eset or Bitdefender, but Google Safe Browsing does both.

An additional protection, which may require some legwork to configure, would be to tunnel connections to this lookup server over Tor or some other network connection (e.g. a proxy) that is decently uncorrelated to the rest of your network activity (which e.g. uses your VPN). One complication: some VPN setups won't let you make any network connections that don't pass through the VPN.

Answer 2

"My question is, aren't these companies in a position to benefit or monetize their user's definitive clickstreams?" > Yes, they are. And, if I were you, I would not only look at my anti-virus software, but also directly to my browser which, depending on your provider, will most likely send the very same URLs to either Microsoft or Google services (Google is even largely funding Firefox to provide such service).

If privacy is a real concern to you, using a specific platform like Tails may make sense (either natively or from within a virtual machine, depending on your needs). It will bring you a reasonable guaranty that no setting in your platform may threaten your privacy (moreover it relies on a specific and free tunneling system called Tor, specially designed for anonymity purpose).

Otherwise, your anti-virus software and browser should at least offer you the possibility to disable such web security feature (even if it might difficult to find, buried in some "advanced" configuration screen, and that disabling it may result in frightening messages "You are not protected anymore!" - the price for freedom maybe ;) ).

As a complement you may also want to double check that no other service / plugin / toolbar still send such requests: a network monitoring tool like Wireshark can allow you to check the actual servers contacted by your computer (you may not see the data when it is ciphered, but if you see a call to Google or BitDefender servers upon each URL you type, you can esilly draw your own conclusions...).

Answer 3

Disclaimer: I work for an anti-virus vendor.

In order to do this, they intercept every url their customer surfs to, in order to examine it for viruses or check it against, say, a black list of known bad urls.

You can also add that this list is typically "in the cloud", meaning it is stored on a server. So to check the URL for being malicious it is being sent to the anti-malware vendor servers.

There are three reasons for this.

1. The database of existing phishing, fraud and malicious URLs is huge. I won't go into details but please trust me it would not fit into memory of most modern laptops.

2. The content of this database changes very frequently (up to hundreds of changes in one minute). Synchronizing those changes with end users copies would put significant burden (in terms of traffic and CPU resources) to the end users.

3. The content of this database is the result of highly comprehensive and valuable research. And unlike the malware detections, this kind of database would be reverse engineered easily, allowing malware authors to react immediately when their URLs/domains are detected.

My question is, aren't these companies in a position to benefit or monetize their user's definitive clickstreams?

Yes, we are. Note that your anti-virus has access to much more than your URLs, and as Kaspersky case proved. Thus if your vendor is not trusted, you have much higher risks to consider than click monetization.

And user trust is something which is difficult to gain, and - once lost - is almost impossible to gain back. Again the situation with Kaspersky showed it well, with major US retailer stopping selling it. So for a vendor this would be a very major risk to take, against a relatively small payout.

However we do benefit from knowing those URLs. This allows us to focus our research into areas which affects our users the most. For example, if we see many of our users attempt to access a particular phishing or C&C domain, we can focus our efforts in shutting this particular domain down much quicker. This in turn benefits everyone - not just our users.