Slashdot Log In
AVG Backs Down From Flooding the Internet
Posted by
timothy
on Sun Jul 06, 2008 02:41 AM
from the time-off-for-good-behavior dept.
from the time-off-for-good-behavior dept.
Simon Wright writes "As a website that is featured heavily in many Google Australia search results, Whirlpool (Australia's largest technology forum) has been particularly affected by AVG's LinkScanner. We've seen a traffic increase as much as 12 hits per second from these bots. So we've actively and loudly campaigned against this move by AVG, encouraging all users of AVG 8.0 to uninstall the product. The discussion starts here. And AVG's backing down is posted here."
From that URL:"'As promised, I am letting you know that the latest update for AVG Free edition has addressed and rectified the issue that [Whirlpool] have brought to our attention. This update has now been released to users and has also been built into the latest installation package for AVG Free.' — Peter Cameron, Managing Director, AVG Australia."
Related Stories
[+]
IT: AVG Fakes User Agent, Floods the Internet 928 comments
Slimy anti-virus provider AVG is spamming the internet with deceptive traffic pretending to be Internet Explorer. Essentially, users of the software automatically pre-crawl search results, which is bad, but they do so with an intentionally generic user agent. This is flooding websites with meaningless traffic (on Slashdot, we're seeing them as like 6% of our page traffic now). Best of all, they change their UA to avoid being filtered by websites who are seeing massive increases in bandwidth from worthless robots.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Good Stuff! (Score:5, Insightful)
I was looking at alternatives to AVG because of this. Good to know I don't have to keep looking.
Re:Good Stuff! (Score:5, Insightful)
Maybe you should keep looking. A company in the business that AVG is in should have seen this coming, what makes you think more of the same "quality" is not in the future? It shows a serious lack of foresight for a company that should have top-drawer management and programmers considering their business. Frankly, this kind of crap reflects badly on what consumers should assume for the quality of their product.
Parent
Re:Good Stuff! (Score:5, Interesting)
I don't disagree. Version 8 of their product is the most bloated thing I've seen in ages. Almost moreso than the consumer Norton/McAffee stuff. And to top it off, it's so naggy it's ridiculous.
Parent
Re:Good Stuff! (Score:5, Insightful)
Parent
Re:Good Stuff! (Score:5, Insightful)
AVG took a serious wrong turn somewhere. It used to be a no-questions-asked-use-me-please virus scanner of the highest quality. I used to recommend it to everyone. I used to start fixing my friends' computers by uninstalling the bloated virus scanners they had and installing AVG.
Now they've gone corporate (for lack of a better term).
Anyone know of an alternative to fill the role?
Parent
Moon Secure AV (FOSS) (Score:4, Informative)
This is what I'm switching to:
http://www.moonsecure.com/ [moonsecure.com]
Parent
I certainly won't be looking (Score:5, Insightful)
. A company in the business that AVG is in should have seen this coming, what makes you think more of the same "quality" is not in the future?
No, I certainly won't be looking. There are just a handful of companies which *listen* to its customers. There fewer that listen to the users of their product which use it for free.
AVG shown that at least they do listen to their users, and are likely to rectify when they screw up. Similar to what happened with Netflix.
A bad company is not one which makes wrong choices, we all make wrong choices. But when the company is not able to acknowledge their errors and rectify, is when you should start looking for someone else to make business with.
I use AVG Free and recommend it to all the people who come to ask me for an Antivirus. The truth (in my opinion) is that such a thing should be provided with Microsoft Windows for free, after all it is the fault of their crappy Operating System that the computers get all infected.
Parent
Re:I certainly won't be looking (Score:5, Informative)
Parent
Re:Good Stuff! (Score:4, Insightful)
You might want to keep looking. Companies that do this kind of thing once don't usually stop at 1.
Parent
Re:Good Stuff! (Score:5, Insightful)
I was looking at alternatives to AVG because of this. Good to know I don't have to keep looking.
If you have a look at the Whirlpool page, you'll see that every page in the forum is headed by an orange banner, that not only references the AVG problem and suggests users uninstall the software, but also recommends and has direct links to "superior alternatives" such as Avast and Avira.
I can't think of a better way to quickly change a company's mind than this sort of strategy :)
Parent
Another reason (Score:5, Interesting)
That's a good one, but there's also this suggestion from TFA:
Parent
Re:Good Stuff! (Score:5, Insightful)
There are (or at least there were) other motives to dump AVG.
1) I installed it - just once, long ago, and threw it out of the window as soon as I found out that it was adding a spam footer advertizing itself in each e-mail I sent. Didn't even try to find if that could be turned off: garbage belongs in the garbage bin, not on my PC, and certainly not in my outgoing mails without my knowledge.
Don't know if they're still doing it, or if it's still on by default, and I'm not interested in finding out either.
2) Visit the forum TFA links to, find the post by the guy who upgraded to Avast and immediately discovered a pile of bad stuff on his system that AVG had apparently missed. Instead of scanning sites you don't visit, it sounds like they'd better start doing something about the quality of the scan on those you DO visit.
I'm sure #2 hasn't always been as bad as it sounds here. But protection is a process, not a goal, and it smells like they're lagging a bit behind right now.
Parent
LinkScanner was unnecessary in the first place (Score:5, Interesting)
I fail to see what Grisoft ever thought LinkScanner would acheive above the scanners that are becoming common in competing products that simply intercept http and pop3 traffic as it comes over the network. To me it seemed unnecessary to actually fetch every single search result. It also would obviously interfere with web analytics, and is potentially a security risk to people using AVG, not in terms of desktop security, but in terms of your real-life personal security. For example, I recall a recent article where the FBI had arrested people [slashdot.org] merely for clicking links to a porn site they had set up. Are you really safe from such operations and the general tendency of Government agencies to monitor activity these days when your computer is in effect programmed to click links for you?
I don't see information at the links in the summary of what changes were actually made to AVG now. Does anyone have details?
Re:LinkScanner was unnecessary in the first place (Score:5, Interesting)
Parent
Re:LinkScanner was unnecessary in the first place (Score:5, Funny)
It turns out that LinkScanner was implemented in secret by two employees during odd hours, when all the other people had gone home(*). One of these employees, who likes to use the handle "pinky", was in charge of unit testing, while the second employee, who sometimes goes under the nickname "brain", actually designed the module.
Investigations are ongoing, but preliminary questioning of the employees does suggest that LinkScanner's purpose was either to "take over the world", or possibly to "zort" a "narf-poit".
(*) except for Norm, who didn't notice anything because he was busy looking for a misplaced stapler in another part of the building.
Parent
Re:LinkScanner was unnecessary in the first place (Score:5, Funny)
Parent
Way to go! (Score:5, Insightful)
Anyway, the statement that "We've seen a traffic increase as much as 12 hits per second" is meaningless without knowing the overall traffic levels - for example, is +12/sec an increase of 100%, or an increase of 1%?. It's referred to as a "significant drain" on resources, but quoting one number without the other is pointless.
Re:Way to go! (Score:5, Informative)
Simon has state that the server normally deals with 50 queries / second.
So 12 more / second is quite a bit of load.
Cheers WTW
Parent
Re: (Score:3, Informative)
Well, I'm not sure how efficient Coldfusion is for handling large web forums, and how fast their database back-end is (16 million posts), but if each request takes 0.1 second of CPU time, it means it's enough traffic to keep a whole extra server busy. Approaching it differently: there are typically about 1000 users online, which open maybe one page per minute each. That means about 20 page requests
Re:Way to go! (Score:5, Informative)
The single web server that powers Whirlpool is typically handling 30 to 40 non-cached template requests per second. We've got over 15 gigabytes worth of user posts online, and receive hundreds of referrals from Google every minute.
Given that it's running on a 4-year-old web server (in tandem with another 4-year-old MySQL box), I think ColdFusion is doing pretty well for itself.
Cheers
Simon Wright
Parent
Re:Way to go! (Score:5, Informative)
That's 40 requests per second to the web server, not the database. Actually, this custom-built application is quite efficient, because that only translates to around 50-70 queries per second.
MySQL isn't the bottleneck. It's simply running on hardware that's not even a quarter as powerful as it should be if it were commercially operated. And that's before we take into account failover resources or future proofing.
I've seen cases of PHPBB and vB installations, with better hardware than us, unable to handle even a tenth the load we get.
40 requests per second is not a small load for a single website. Whirlpool gets around 1.5 to 2 million non-spider page views per day, plus and additional half million spider hits.
PostgreSQL and Firebird are certainly more comprehensive database stacks, but I'm quite sure they wouldn't match MySQL for efficiency when dealing with these relatively uncomplicated queries. Even if they could provide a nominal improvement, the effort involved in porting the databases and every query in this custom application would be extreme overkill.
Cheers
Simon Wright
Parent
So is AVG still a good AV prog? (Score:4, Informative)
I use AVG... and was watching this.
I'm sure they thought it was a good idea, and sometimes good companies make bad moves.... I got AVG because leo laporte reccomended it, and dammit, i like leo.
But things change over time... is AVG still a good free AVG prog? And I dont mean just because of this controversy, they made good on it and responded. I mean the long haul.
Re:So is AVG still a good AV prog? (Score:5, Interesting)
I second your question. I used AVG Free for a long time and uninstalled it very quickly when I heard the news. But I'm having choosing a replacement cost-free anti-virus program for Windows. Here's are the factors I've been considering...
AVG Free [avg.com] Pro: seems pretty effective and runs inobtrusively (at least locally). Con: has DDoS'd websites in the past and perhaps still shouldn't be trusted.
Avira [avira.com] Pro: no track record of DDoS'ing websites. Con: obnoxious pop-ups "reminding" me about the premium version; apparently [wikipedia.org] got some poor reviews for infection treatment.
Avast [avast.com] Pro: no track record of DDoS'ing websites. Con: requires manual re-registration.
I'm using Avira now but I'm considering switching again because of the pop-ups. Any advice? (And yes, I already run Linux but still need Windows for some things, and no, I'm not interested in paying for anti-virus software, since 99% of virus protection is common sense.)
Parent
Re:So is AVG still a good AV prog? (Score:5, Informative)
How about:
"Program Settings"->Sounds->Settings...
Then scroll to the "Automatic VPS Update" event and pick the "(None)" sound.
Parent
Re:So is AVG still a good AV prog? (Score:4, Insightful)
Actually, let me clarify that statement. You might need AV software if you are a very uninformed user who likes to open email attachments from unknown people or download lots of useless software from questionable sources. However, if that person I described is not you, then you do not need AV software, and it is just taking system (and apparently network) resources.
The reason you don't need AV software is because there are only two ways to get virus on your computer: 1) Network-related software you use is exploited. 2) You willingly (although accidentally) run the bad software yourself. Yes, I'm simplifying things, but it is hardly any more complicated than this. Since you are an informed user, you have learned not to run bad software, so #2 doesn't apply to you; and since you patch your system regularly (right?), #1 is very unlikely.
However, there may be a tiny window between the time that an exploit is found and the patch being made available where you could potentially be vulnerable. Theoretically, AV software can 'protect' you in this scenario since virus definitions are made available sooner than patches. The solution here is, again, to be an informed user. If a piece of software you use becomes vulnerable to a new exploit, you should know about it and take the necessary precautions yourself during the time before a patch is released, in order to protect your system. This will protect you much better than any AV software will, and it's not difficult since there are not many pieces of software which could even be exploited (the main ones are your browser and other internet-related apps).
Now, I'm a user and developer of Mac OS X, Linux, BSD, and Windows. I have been running Vista for almost a year without a hitch by being an informed user. Actually, I also usually install patches long after they are available because I turned off the automatic download/install feature (I like to know what's using my internet connection), and for some reason it doesn't even notify me of the availability of patches so I often forget. Nevertheless, I've never been compromised mainly because I don't run questionable software or read unknown emails, and the security of the software (and patches) has been good enough.
In my opinion, AV software is a scam. It might be useful for grandmas and other clueless users who open email attachments indiscriminately, but I cannot see how anyone informed enough to be on
Parent
Re:So is AVG still a good AV prog? (Score:4, Insightful)
You have a point, but I received an infected Word file from a customer just a couple years ago.
When the contract is a few million bucks, you suck it up and run AV and don't tell them how to run their business.
Parent
Re:So is AVG still a good AV prog? (Score:5, Informative)
This is about the same amount of protection as pulling out is a form of birth control.
Are you telling me:
1. You never open links in search results to sites you have never been to?
- If you are running windows using Firefox or IE there have been many cases of 0 day exploits
2. Do you not use any USB storage devices?
- Just this Christmas I purchases a digital photo frame for a family member that had built in storage. low and behold when I went to preload it with photos it was already infected with a virus that was set to use auto play to install.
3. You 100% trust EVERY thing your friends or family send you? Document infections are still somewhat common. I suppose using Open office would get you around macro infections but you also might not be able to open company documents then.
I would also imagine that ANYONE who is on slashdot and manages security also believes in the layered approach. Inbound only filtering from your firewall and using your gut to know what is safe or not is an easy one to work around.. Well unless you are a hermit that never gets any email.
Parent
Re:So is AVG still a good AV prog? (Score:5, Funny)
Damnit! That's why I keep having kids.
Parent
Re:So is AVG still a good AV prog? (Score:4, Informative)
I don't browse (usually) for pr0n or for cracks, so I don't worry.
What about those cracks into the high profile web servers that deposit malware? You have to trust every webmaster out there to have properly secured their systems.
Parent
Re:So is AVG still a good AV prog? (Score:4, Interesting)
3. Run anything you don't 100% trust in a VM without network access
Which is easier to set-up for an average user: the above, or installing an antivirus? I consider myself fairly computer savy, but I have absolutely no clue how to set up a VM.
Parent
Re: (Score:3, Insightful)
I'm not sure why this guy is moderated flamebait, because he certainly has a point. I guess I'm the kind of user he describes, and how many viruses have I seen in the last 8 or so years? Zero. That's right, none.
And is this because I don't bother to check? Hardly: I'm running Zone Alarm, SpyBot S&D, and Avira, and I make backups (to USB disk). I even rotate those backup disks to an off-site location (my parents house!). I have all my patches up to date. I watch the lights on my ADSL modem for activity a
Network-Related Software? (Score:3, Interesting)
Seriously, take an XP box and plug it directly into a home cable/ADSL modem.
About a year and a half back, I did that for maybe a week. I'd kept all the crit updates in there, and yet the AV software would pop up every few hours announcing that a new gift had arrived on the PC. Installed a third-party firewall, and then put the thing behind a router/hardware firewall.
Malware evolves rapidly, and we as individuals can't spend as much time combating it as the
Re:So is AVG still a good AV prog? (Score:5, Informative)
I recently gave up on AVG. It was a nice free option until this version 8. Surely, Grisoft knew this was a big problem for a long time. They're not the only people who thought this approach of extra verification would be a good idea. MCAfee did it, Opera (I think) just linked up with one of the Microsoft spawns that tests everything and drags web use to a crawl. It's as poor an idea as "background" disk defragging which does nothing other than work the drives because it's not possible to sort a drive which is in flux.
Avast! is frequently recommended as a free anti-virus. BUT...do some research and you'll see it's not that great at catching known junk. ESET does test very well but you only get 30 days of free use. Avir's free version does seem to offer full integration (in-line scanning, auto updates, etc.) which I don't remember being there a few years ago when freeware scanners only worked on-demand. http://www.free-av.com/ [free-av.com] It tests very well, actually, better than AVG and Avast!
In their defense, if I remember correctly, AVG DID offer free fully integrated inline scanning first with a decent catch rate. Why did it take them so long to comprehend version 8 was a hog and would generate so much anger and resentment? Who knows. Maybe their time has past just line PKZip...
Parent
Re:So is AVG still a good AV prog? (Score:5, Informative)
Parent
Re:So is AVG still a good AV prog? (Score:5, Informative)
The and Update system in AVG 8.0 is vastly improved.
I was using Avast and and installed it for several family members only to have one of them get a HORRID spyware infection.
Interestingly AVAST did not detect it at all, Spybot and Ad-aware could not completely remove it, but after installing AVG 8.0 it cleaned everything up.
After checking several reviews it seems AVG 8.0 has one of the best Virus and Spyware detection rates among current products.
Parent
Re:So is AVG still a good AV prog? (Score:5, Informative)
Well, yes but.. (you've seen the complaints).
Other decent free ones are:
Avast [avast.com] is popular.
AVira [avira.com] seems good, you get one popup ad per update.
Comodo [comodo.com] permits business use.
BitDefender [bitdefender.com] has a free version.
I'm not including ClamAV because it's just a scanner, no realtime protection.
Posting AC because I've moderated,
number11
Parent
I've uninstalled AVG Free after using it for years (Score:4, Insightful)
I followed instructions as posted recently here to remove LinkScanner: this resulted in a re-install of AVG (without LinkScanner). The first update this re-install wanted was LinkScanner plus plugins, there was no way I could cancel and just get virus definitions, no point in continuing.
I have installed Clam. Now I can scan what I want when I want.
ZXTM TrafficScript rule: (Score:4, Informative)
Users of Zeus Technology's ZXTM could use the following TrafficScript rule to protect themselves from AVG's DDoS attacks:
if( http.getHeader("Accept-Encoding") == "" &&
http.getHeader("Referer") == "" )
{
$ua = http.getHeader("User-Agent");
if( $ua == "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"||
$ua == "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;1813)"||
$ua == "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"||
$ua == "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;1813)" )
{
connection.discard();
}
}
Whirlpool and WebCentral (Score:3, Interesting)
Thing about Whirlpool is that it's a custom CF package developed by the webmaster and it's a thing of beauty. The ugly thing about is that it's hosted on WebCentral.
WebCentral [webcentral.com.au]... Whirlpool doesn't have to pay any money to WebCentral, they host it for free. The funky thing is that almost nobody on Whirlpool ever recommends WebCentral for webhosting. They recommend all sorts of other companies in Australia, except probably the most vocal one, WebCentral.
The reason? I've got customers that have PHP and ASP websites with WebCentral and pay $40 a month for a massive 200 MB of storage and 1 GB of transfers. Which is nothing these days. And for that amount of money, you'd think that the sites would at least be quick... think again. They are slow because WebCentral really don't know what they are doing. They've only got IIS and the first access to a website always takes ages for the DLL of the virtual site to start up and do its stuff. All the subsequent accesses are pretty quick. 12 accesses per second for the biggest techie forum in Australia shouldn't be all that much extra and certainly shouldn't bring the server to its knees. Search on Whirlpool hasn't been working most of the time because WebCentral's servers just won't take it. Full-text search will never exist, not as long as it's on WebCentral anyways.
WebCentral got bought out, not too long ago, by MelbourneIT, a registrar for .au domains, so you'd think that WebCentral had a clue when it came to DNS. They don't. I asked them to set up a new subdomain with a different IP address? What do they do? The redirect mail.something.com.au to point to the new IP address, with the hilarious consequence of a dozen people not being able to get any emails for a few days.
And then there's the case of the $65 for 2 year domain registration. You'd think that would include DNS hosting, as asiaregistry.com do for $30 for 2 years. MelbourneIT offers a 1-page website for $140 for 2 years. Well, think again. The $65 only cover domain reservation. It means that you register a domain, pay them money, but that's it. They sell you a product that's more than twice as expensive than with a reasonable competitor, but you can't actually do anything with it. No, what you want is 'Domain Parking', there's no way to get DNS hosting apart from that. $240 for 2 years. We've had domain names with AsiaRegistry for years now, and they've been absolutely reliable, more so than WebCentral will ever be.
I called them about that, they say that the advantage is them being a local business. That's the entire argument. A local business with shit webhosting and crap value. Don't ever do business with WebCentral.
There's no way I'd ever post this on Whirlpool, because it'd get removed by WebCentral, one way or another, immediately. And there's no way you'll see Simon Wright responding to me, it's like everything is open for discussion on Whirlpool as long as it's on topic, except WebCentral. They do provide hosting for free and can make Simon's life a bit uncomfortable at least if WebCentral is all of a sudden open for discussion.
Re:Whirlpool and WebCentral (Score:5, Informative)
As the owner of Whirlpool, please moderate the parent as uninformed.
While I'm not in a position to provide an unbiased opinion of WebCentral, they do cater to a very important market -- people who need a premium quality service. If my experience with the $0 service they provide Whirlpool is any indication, WebCentral are not just technically excellent, their support system is outstanding and reactive. I can only imagine how much better they treat the customers who pay them.
Just because you only want the bargain service, doesn't mean everyone does.
And the only reason Whirlpool isn't blazing fast, is because we're running with a bunch of WebCentral's spare hardware. We're a community service, not a business.
Cheers
Simon Wright
Parent
So, what if LinkScanners scan engine... (Score:5, Insightful)
A programm that fetches each and every link it comes across *can't* be a very good idea. Certainly a feature invented by people without a security mindset [schneier.com]?
They will be back. (Score:4, Insightful)
AVG 8.0 (Score:4, Insightful)
I actually bought AVG 8.0 (been using the free edition for years and felt guilty), then immediately uninstalled it.
The problem? Crashing my machine left and right. I could reliably crash winamp by opening small files, and other programs acted very very oddly.
Uninstalled, and the problems went away.
Re:Are you sure? (Score:5, Informative)
See: http://forums.whirlpool.net.au/forum-replies.cfm?t=1007329&p=13#r256
The fix has been independently tested.
Cheers WTW
Parent
Re:Are you sure? (Score:5, Insightful)
The problem is that the link scanning featured caused a great deal of traffic to sites - even sites that consumers did not visit. That's not cool.
Parent
Re:Are you sure? (Score:4, Insightful)
It would be quite convenient if one could just piss in any doorway when the need arose. We don't do it (most of us) because it is antisocial.
Accessing every webpage you see a link to multiplies the bandwidth you use by at least an order of magnitude.
Parent
Re:Are you sure? (Score:5, Insightful)
Aside from the problem with increased traffic for webmasters to deal with, if someone had found an exploit for AVG, many systems might have been compromised without the user actively visiting the exploiting sites, making it worse in some ways than an iframe-based exploit. If all it effectively takes is for a link to appear in the page, that adds danger to what was just inconsiderate behavior.
Parent
Re:Are you sure? (Score:5, Insightful)
Because the idea itself is flawed. Normally you visit only a minuscle part of the links your browser shows you. LinkScanner follows all of those links even when you never planned to visit them.
Parent
Re:Are you sure? (Score:5, Insightful)
Parent
Re:Are you sure? (Score:5, Insightful)
It could be a lot more than tenfold.
For example, the first link in Google for "wine" is for a program that lets you run windows software in other operating systems, and no 3 is the wikipedia entry about it. The rest of the links are about alcoholic drinks.
Most people outside of slashdot are going to be interested in the alcoholic drink links, but if they have AVG installed, they will be "visiting" winehq.org as well, even though they probably already have windows and the wine program will be completely useless for them.
Parent