Protecting close to 200 million PCs, Macs, & Mobiles – more than any other antivirus

Archive

Archive for the ‘Uncategorized’ Category
January 25th, 2013

Introducing the New Avast Bug Bounty Program

Hello Avast fans!

No Bugs

It is my pleasure to officially announce the new Avast bug bounty program. As a security company, we very much realize that security bugs in software are reality. But we also realize that companies that are able to use their user communities to find and fix bugs are generally more successful that those that don’t. Therefore, we have decided to reward individuals who help us find and fix security-related bugs in our own software. This makes us probably the first security vendor with a reward program like this: I think it’s mainly because the other companies generally take the position that ‘Hey, we’re a security company. So we know security and it can’t happen to us.’ But in reality, that’s not what’s happening. Just look at bugtraq or the CVE databases and you will find that security software is no more immune to these issues than any other programs. A bit of irony, given that people generally install security software to fight security issues in the first place, isn’t it?

We at Avast take this very seriously. We know that being a market leader (Avast has more users than any other AV company in the world), we’re a very attractive target for the attackers. So, here’s our call to action: let’s unite and find and fix those bugs before the bad guys do!

 

Here’s how it works:

  • The bounty program is designed for security-related bugs only. Sorry, we’re not paying for other types of issues like bugs in the UI, localization etc. (nevertheless, if you find such a bug, we will of course very much appreciate if you report it).
  • This program is currently intended only for our product, i.e. not the website etc.
  • We’re generally only interested in these types of bugs (in the order of importance):
    • Remote code execution. These are the most critical bugs.
    • Local privilege escalation. That is, using Avast to e.g. gain admin rights from a non-admin account.
    • Denial-of-service (DoS). In case of Avast, that would typically be BSODs or crashes of the AvastSvc.exe process.
    • Escapes from the avast! Sandbox (via bugs in our code)
    • Certain scanner bypasses. These include include straightforward, clear bypasses (i.e. scenarios that lead to direct infection, with no additional user input), as opposed to things like deficiencies in the unpacking engine etc. In other words, we’re interested only in cases that cannot be mitigated by adding a new virus definition (please don’t report undetected malware)
    • Other bugs with serious security implications (will be considered on a case by case basis).
  • The base payment is $200 per bug. Depending on the criticality of the bug (as well as its neatness) the bounty will go much higher (each bug will be judged independently by a panel of experts). Remote code execution bugs will pay at least  $3,000 – $5,000 or more.
  • We might change these ranges based on the number and quality of incoming reports. Generally, the less reports we will get, the higher the bounty will go.
  • We will only pay for bugs in Avast itself. For example, if you find a bug in a Microsoft library (even if it’s used by Avast), please report it to Microsoft instead (it would be great if you could also notify us, but unfortunately, we cannot offer any reward in such cases).
  • The program is currently limited to consumer Windows versions of Avast (i.e.: Avast Free Antivirus, Avast Pro Antivirus, and Avast Internet Security). Only bugs in the latest shipping versions of these products will be considered.
  • Payment will be done preferably by PayPal. If you can’t accept PayPal (e.g. because it doesn’t work in your country), please get in touch with us and we will try to figure out something else.
  • Because of certain legal restrictions, we cannot accept submissions from the following countries: Iran, Syria, Cuba, North Korea and Sudan.
  • It is the researcher’s own responsibility to pay any taxes and other applicable fees in their country of residence.
  • In order to be eligible for the bounty, the bug must be original and previously unreported.
  • If two or more researchers happen to find the same bug, the bounty will be paid only to the one whose submission came in first.
  • You must not publicly disclose the bug until after an updated version of Avast that fixes the bug is released. Otherwise, the bounty will not be paid.
  • The bounty will be paid only after we fix the issue (or, in specific cases, decide to not fix it).
  • Some bugs may take longer to correct. We will do our best to fix any critical bugs in a timely fashion. We appreciate your patience.
  • Employees of AVAST and their close relatives (parents, siblings, children, or spouse) and AVAST business partners, agencies, distributors, and their employees are excluded from this program.
  • We reserve the right to change the rules of the program or to cancel it at any time.

 

How to report a bug and qualify for the bounty:

  • Please submit the bug to a special email address bugs@avast.com
  • If you’d like to encrypt your email (recommended), please use this PGP key.
  • A good bug report needs to contain sufficient information to reliably reproduce the bug on our side. Please include all information that may be relevant – your exact environment, detailed bug description, sample code (if applicable) etc. It also needs to contain a decent analysis – this is a program designed for security researchers and software developers and we expect certain quality level.
  • You will receive a response from an Avast team member acknowledging receipt of your email, typically within 24 hrs. If you do not receive a response, please do not assume we’re ignoring you – we will do our best to follow up with you asap. Also, in such a case it is possible your email didn’t make it through a spam filter.

 

Finally, I’d like to say thanks to everyone who helps to find and fix bugs in our products. Hopefully, this new reward program will take this initiative to a whole new level.

Happy [bug]hunting!

 

P.S. The bug bounty rules are also available on our main website here.

 

Categories: Technology, Uncategorized, Virus Lab Tags:
January 17th, 2013

Encrypt unsecured Wi-Fi for Apple iOS

SecureLineDo you use your mobile device to check email, use social networks or log in to your bank account while sipping a double mocha latte at your favorite coffee shop or while waiting for your next flight? That’s risky considering you cannot count on public Wi-Fi hotspots that you find in cafes, coffee shops, airports, schools, and hotels to be secure. Remote cybercrooks, and even the guy sitting a couple of tables from you sipping coffee, can use software to eavesdrop and snoop which could result in stolen credit card information and passwords or full-blown identify theft.

With new avast! SecureLine for iOS you can secure your wireless internet connection when using your iPad, iPhone, or iPod on a Public/Open Wi-Fi network. Here’s how it works:

VPN stands for Virtual Private Network.  avast! SecureLine VPN creates a private ‘tunnel’ through the internet for your data to travel through, and everything inbound and outbound through the tunnel is encrypted. Data is decoded at the VPN server, using advanced encryption protocols. Handy features also detect and filter malicious URLs, block ads in the browser and apps, or can compress your transferred data which saves your mobile data plan and enables access to US-only content. :-)

Download avast! SecureLine for iOS from iTunes. Read more…

Comments off
December 10th, 2012

Are we hard workers? Yes, but sometimes we need a break!

Traditionally Avast! organizes Christmas party for employees and their closest ones. This year it was in Hard Rock Cafe in downtown Prague and we really enjoyed it. Avast! arranged live music represented by Queenie, a Queen cover band. And we have to admit, these guys were great! Even Freddie Mercury would have been definitely satisfied with their performance. But Avast! also caters to our youngest ones. Last week we had Saint Nicholas’ day in our offices in Prague. There were almost fifty kids, a clown, Saint Nicholas, angel and devil. I believe you can imagine how our offices looked like during this event. :-) We decided to share this few precious moments with you, so you can feel the atmosphere. Hopefully you will enjoy it as much as we did.

 

 

Categories: Uncategorized Tags:
November 20th, 2012

Android PUP Detections – Oh, Not That One Again!

Potentially Unwanted Program – that’s what PUP stands for. You probably already had a chance to meet some PUPs on a Windows PC, but how does a PUP look on an Android phone? How will you know how to handle it?  All of this will be explained here.

When a PUP alert attacks you, don’t panic.

For starters, it’s just a warning. It’s not a standard virus and, no, your life is not in danger. PUP detections were made to warn people when a suspicious component or ability is detected within the application.

Let’s say you downloaded an app that’s called “Christmas Carols” (don’t panic about that, either; it’s still a month and a half till Christmas) and a PUP warning hits you. The detection name reads “Android:SpyPhone-E [PUP]”. What should you do? Well, what I would do is to sing Silent Night to that app and wave goodbye while uninstalling it. Why? Well, it’s an app that’s supposed to play Christmas carols and not “SpyMyPhone” or whatever that PUP warning says.

Read more…

Comments off
November 6th, 2012

Who are the AVAST Bugbusters?

On October 17,  I have received the invitation for the event: Win8 BugHunt. As the only lady invited to this event I felt really flattered. However I had no clue what is this event actually about … :D So I did my “InfoHunt” and this is what I have discovered:

Instead of running a “boring” test on a compatibility between avast! Antivirus and Microsoft® Windows® 8 operating system, Lukáš Hasík (director of QA team*) along with Michal Vaněk (Senior Quality Assurance Engineer) decided to organize a competition.  They invited, exclusively selected, eleven AVAST employees to the internal test called Win8 BugHunt. The goal of a test was simple: find as much bugs as possible in the shortest period.

All eleven participants had to install the latest version of Windows® 8 OS and start testing the latest internal built of avast! Free Antivirus. Each participant was given two hours to pass 10 assignments. The idea was to follow a “regular avast! user experience”. I myself decided to participate as a neutral watcher and follow others struggling with their ten tasks, which were following:

  1. Provide a custom installation of avast! Free Antivirus in a trial mode
  2. Install selected browser (Firefox, Chrome, Opera, Safari)
  3. Test a functionality of a Browser protection: WebRep, SiteCorrect, Phishing
  4. Test Remote Assistance feature
  1. Read more…
Categories: Uncategorized Tags:
November 5th, 2012

100,000 Voter Survey: Romney ahead but more believe that Obama will win

In a survey of 100,000 Avast users this past weekend, Avast users have shown just how close the upcoming Presidential Election is. The survey shows a narrow preference for Romney in the popular vote resulting in a large advantage for Romney in the Electoral College Vote. At the same time though, a clear majority believe that Obama will actually win:

  • 48.9% of users who are registered voters said they will definitely vote for Romney, compared to 46.1% who will vote for Obama. Interpreted by electoral votes, this is 290 votes for Romney and 230 for Obama.
  • As to who they think will actually win the election, however, 47.6% think Obama compared to 39.6% in Romney’s favor. Interpreted electorally, this gives 349 to Obama and only 189 to Romney.
  • New Mexico and Virginia are dead heats—46.9% for each candidate in New Mexico and 47.6% in Virginia.
  • The other tightly contested states in the survey are Florida with 49.2% for Romney and 47.5% for Obama; Ohio with 48.8% for Romney and 46.3% for Obama; and New Hampshire with 48.2% for Obama and 45.3% for Romney.

 

Of course, this has nothing to do with security, we don’t mix politics with business, and we have not taken any position on the election. Furthermore, we are based in the Czech Republic so any position we took would be meaningless anyways. But still, we have a large base of users in the USA—about 11 million—and we thought it could be insightful if their collective opinion could predict the election results as well as the professional polling firms. Read more…

Categories: CEO's corner, Uncategorized Tags:
October 18th, 2012

avast! only Free Antivirus to receive “ADVANCED+” award for Performance and Detection

Avast! Free Antivirus won the top rating for malware removal from independent research organization AV-Comparatives last month, and this month is the only antivirus solution that also received the ADVANCED+ award for performance. The latest performance test measured the impact on system resources and speed of 19 antivirus products, and avast! Free Antivirus was the best scoring FREE product again.

AV-Comparatives performance testing is a series of real-world scenarios that includes downloading, extracting, copying, and encoding files, installing and launching applications, in addition to an automated testing suite. The ranking system is three-levels: “Standard,” “Advanced” and “Advanced+” awards. To receive the “Advanced+” award, avast! Free Antivirus was compared to mostly paid-for antivirus suites based on how much impact the product has on system resources, including protection against ‘real-world’ zero-day malware attacks, detection of a representative set of malware discovered in the last 2-3 months, false positive rates, and scanning speed. Avast was the highest scoring free product and out-shined a host of paid-for products and other free products.

These results are proof that it is not necessary to pay for excellent quality antivirus protection.  Avast! Free Antivirus provides award-winning high protection rates against malware without degrading the system performance or troubling users.

Get award-winning antivirus protection on your own PC, download avast! Free Antivirus. We also have award-winning protection for Mac and your Android devices.

October 8th, 2012

Russian Odnoklassniki spamming

Recently, we’ve noticed that there are too many legitimate domains popping up in our url filters with malware. At first we thought we had a huge false-positive (FP) problem, but after analysis we found a pattern.

All of the referring links came from the Russian Odnoklassniki server, which is a quite-popular Russian social network. Users of that network are getting fake messages with links to photos.

Read more…

October 5th, 2012

Facebook charging for basic membership?

You ever heard the Peter Allen song “Everything old is new again?” Just like the Stranded Traveler scam that gets tweaked slightly as it makes its way through cyberspace, a recycled Facebook hoax is appearing on walls lately.

Viral status updates claiming that Facebook will start charging membership fees because of the new profile changes may have passed through your wall in the last week or so. The newest  variant is a claim that Facebook is moving to a “price grid” costing as much as $9.99 per month for a “Gold” membership. The message encourages users to copy and paste the message and share with friends before midnight. Other variations warn that your account will be deleted if you do not pay and that your fee will increase, depending on the number of friends you have, messages posted and sent, and pictures/videos/ games put on a user’s page.  The monthly fee will be capped at $50.00 per month at the high-end. Just to be clear – this is a hoax.

 

When in doubt, throw it out: Links on your Facebook wall, email, tweets, posts, and online advertising are often the way cybercriminals compromise your computer. If it looks suspicious, even if you know the source, it’s best to delete or if appropriate, mark as junk email.

Avast Software is proud to be a champion that supports National Cyber Security Awareness Month with news and tips on how, together, we can make a safer digital society.

Categories: Uncategorized Tags:
October 3rd, 2012

STOP. THINK. CONNECT.

Avast Software is proud to be a champion that supports National Cyber Security Awareness Month with news and tips on how, together, we can make a safer digital society.

One-fourth of Americans victims of data breach

A survey by the National Cyber Security Alliance found that twenty-six percent of Americans have been told their personal information, such as password or credit card number, may have been exposed by a data breach. Almost 100% agree that a safe and secure Internet is crucial to economic security and they do not feel completely safe from viruses, malware and hackers. But the same survey found that 64% said they have never installed security software or apps to protect against viruses or malware!

Cybersecurity begins with STOP. THINK. CONNECT. These three simple steps are the starting point for staying safer and more secure online.

  • STOP: Before you use the Internet, take time to understand the risks and learn how to spot potential problems. An obvious step is to install antivirus protection. We suggest avast! Free Antivirus.
  • THINK:  Take a moment to be certain the digital path ahead is clear. Watch for warning signs and consider how your online actions could impact your safety or your family’s. Avast! WebRep can help you determine if a website is trustworthy, for example.
  • CONNECT:  Enjoy the Internet with greater confidence, knowing you’ve taken the right steps to safeguard yourself and your computer.
Categories: Uncategorized Tags: