Bitdefender Disables Anti-Exploit Monitoring in Chrome After Google Policy Change

secwatcher shares a report: Last week we reported that Chrome has started displaying alerts more often that suggest users remove programs that are considered incompatible applications with Chrome because they inject code into the browser's processes. These alerts are displayed by Chrome after the browser crashes and suggest the user remove the listed programs because "this application could prevent Chrome from working properly." One of the programs that a lot of users have seen listed in these alerts and is suggested to be removed is the Bitdefender antivirus program as shown above. Having a well known company like Google telling users to remove a security solution is a problem as these programs are important for many users to have installed on their computers in order to protect them from malware, unwanted programs, and malicious websites. Due to these alerts and their suggestion to remove the antivirus software, Bogdan Botezatu, a senior e-threat analyst for Bitdefender, has told Bleeping Computer that as of August 20th, Bitdefender is no longer monitoring Chrome 66 and later with their anti-exploit technology.

Re:

[Anonymous Coward]

In this case BitDefender is the bad guy. Broadcast-injecting DLLs into processes is *not* safe, and is how Google is able to say what to uninstall. If they did their code-injection correctly there wouldn't be as much issue.

Re:

[tepples]

If they did their code-injection correctly there wouldn't be as much issue.

Is there even a "correctly" in Chrome's extension API?

Actually good news

[Anonymous Coward]

This is actually good news. It means your antivirus is not MitM-ing all your web traffic and downgrading HTTPS connections.

Insecure security solutions

[next_ghost]

Good, the security solutions vendors will finally learn how to do their job without creating more security holes than they're trying to block.

So some malware won't be infecting Chrome anymore?

[robkeeney]

Using anti-virus like Bitdefender is rather like paying a rude thug to live in your house, eat all your food, and hog the TV just to ensure a burglar doesn't break in.

Re:So some malware won't be infecting Chrome anymo

[llamalad]

If you replace "tv" with "couch", and add "lick your face with the same tongue that just slobbered over a rotting bird wing she found in the bushes" you'll have perfectly described my dog.

Re:

[Darinbob]

That's art.

Chrome: broken by design

[Sebby]

From treating perfectly good encryption algorithms as 'not good enough and warn the user immediately even though it's still perfectly safe', even though Google's own keys use the same algorithm but don't trigger a warning, to trying to freak the user out about 'this totally static site that doesn't use HTTPS must be insecure even though you can't submit info to it because it's totally static', Chrome has become the worst browser to use by a company throwing its weight around like a bully to get everything done its way.

Re:

[hjf]

On the contrary. I like google's approach. I'm tired of software developers going "but security is haaaaaaaaaaaaaaaaaaaaaaaard"

What certificate for a home router?

[tepples]

Many routers, printers, and network attached storage (NAS) boxes for home use offer a web-based configuration interface. If someone buys one of these devices, where should he or she obtain a TLS certificate to use with said device in order to suppress "Not Secure" messages in web browsers?

Let's Encrypt and other publicly trusted CAs won't issue a certificate for a private IP or a name in a made-up TLD, such as .internal or .test. It has to be a real domain. Nor do all dynamic DNS providers offer enough features to pass an ACME dns-01 challenge, namely being on the Public Suffix List and supporting TXT records.

Or should it be the device manufacturer's responsibility to issue a name under the manufacturer's domain and resell a certificate from a known CA, the way Plex does? If so, watch the manufacturer set the certificate's expiry the same as that of the warranty on the device, so that the user has to re-buy hardware in order to renew the certificate. Nor do I see how that would apply to a home-built server made out of a Raspberry Pi or Intel NUC.

Re:

[thegarbz]

where should he or she obtain a TLS certificate to use with said device in order to suppress "Not Secure" messages in web browsers?

You know they could just click okay and move on with their lives.

Re:

[tepples]

You know they could just click okay and move on with their lives.

Except a lot of them won't. Even with the warning for cleartext HTTP becoming scarier in recent versions of Chromium and Google Chrome, it's still not nearly as conspicuous/"scary" as the warning for a self-signed certificate.

Not secured. Your pencil, socks are not secured

[raymorris]

Your pencil and your socks are not secured. You don't have any locks in your socks to keep other feet out. Anyone can use your pencil.

The reason they aren't secured is because there is no significant strong reason to do so. They aren't security sensitive. It's not that your pencil or your socks are INSECURE, they just are not secured because there is no reason to.

Similarly, a cat video isn't security sensitive. It's neither secure nor insecure.

This matters because if you get confused and start trying to sec

Comcast has been caught

[tepples]

to trying to freak the user out about 'this totally static site that doesn't use HTTPS must be insecure even though you can't submit info to it because it's totally static'

The sentiment that Chrome is trying to get across in that case is "Chrome cannot guarantee that your Internet service provider has refrained from injecting malicious JavaScript code into the static site that you are viewing." Xfinity by Comcast, for example, has been caught doing this [privateint...access.com]. What would be a better way to express this in a manner short enough to fit in the location bar?

Re:

[roca]

Non-TLS HTTP traffic can be redirected to carry out DDoS attacks and for other nefarious purposes. See https://en.wikipedia.org/wiki/... [wikipedia.org].

Unfortunately the idea that there are public Web sites that "don't need" to use TLS is naive and obsolete.

More Google hegemony

[Rick Schumann]

Google is starting to sound like Microsoft. "We own your computer, not you, you should do as we say when we say to do it because we say so".

Re:

[FictionPimp]

I've been working to remove google completely from my life. Search was easy, email was easy, storage was easy. Photo/video apps is a bit harder.

Re:

[Rick Schumann]

Store your data at home on your own hardware. USB flash drives come in gigantic capacities these days. So do SSDs. You don't need 'The Cloud' at all.

Offsite backup; ISP-created home server hurdles

[tepples]

Store your data at home on your own hardware.

That has a few drawbacks. First, it does nothing to protect the data from fire, flood, or another disaster that renders electronics in your home inoperable. Second, many home ISPs ban running a server at home or block incoming connections or both, as do their direct competitors in the same geographic market (if any even exist). Third, if your dynamic DNS provider isn't on the Public Suffix List or doesn't support TXT records, you still have to buy a domain and keep it renewed in order to qualify for a Let's

Re:

[Rick Schumann]

Why do you need 24/7/365 instant access to pictures or files from any device anywhere on the Internet anywhere in the world? Are you a professional photographer or some other profession that requires it? If not then why can't you just store your photos and whatnot on a flash drive or SDHC or some other device you own and have control of and just keep it on you? If it's so vitally important that you're going to kill yourself if it gets destroyed then keep a copy of it somewhere else. I believe 99% of everyon

Re:

[tepples]

Why not just keep your own stuff for ZERO money per month

How do you keep data safe from fire, flood, or other disasters that affect your home "for ZERO money per month"?

Re:

[Rick Schumann]

I already covered that: make more than one copy, keep them somewhere else. Also how often does your house burn to the ground, get destroyed by a flood, or blown away by a hurricane or tornado? If the answer is 'often' then I think you've got worse problems to worry about than whether you should use 'The Cloud' for storing pictures of your cat(s) or not. :-)

Re:

[FictionPimp]

auto backup of photos as I take them on my phone. Let's start there. I don't have to worry about syncing my phone when I get home to protect my vacation trip photos. I don't have to worry about dropping my phone off the boat and losing the days photos. I don't have to worry about how much storage I've got left. That's what google has.

Bitdefender casts "harm reputation" - and misses!

[zarmanto]

... a senior e-threat analyst for Bitdefender ... [said that] ... Bitdefender is no longer monitoring Chrome 66 and later with their anti-exploit technology.

I entirely understand their chagrin -- but this response might be a mistake. For an anti-virus/anti-malware package to blatantly state that they're not monitoring a browser, just because the makers of that browser are getting a bit paranoid about plugins (rightfully so, mind you) ... yeah, that's not going to sit well with a lot of people. Some people will blame Google, and some will blame Bitdefender... and both will lose face to some degree -- as well as lose users. Thing is, Google can afford to lose bo

Re:

[Mal-2]

I nuked Bitdefender because at seemingly random intervals, it regards gcc++ as a hacking tool and quarantines parts of it. Good riddance.

Sounds like you have whitel and blacklist backward

[raymorris]

Sounds like you're confusing whitelisting with it's opposite, blacklisting.

Blacklisting says "this person isn't allowed to do this to that". Anyone can do anything, except for the listed blocks. Blacklisting has been outdated for 20 years.

Whitelisting says "only this person can do this thing to that". Nobody can do anything unless they have been explicitly approved. Whitelisting is fundamentally the most secure approach you can ever have.

For public resources, including accessing the public internet, the rig

Google is in the right on this one

[roca]

AV vendors inject DLLs into browser processes and monkeypatch browser machine code in crazy ways to monitor browser activity. Predictably, this has created all kinds of problems. It's common for browser updates to invalidate some assumption made by the AV developers, causing frequent browser crashes. It's also common for the AV hooks to have terrible performance properties. It's also common for the AV code to introduce security vulnerabilities.

AV vendors know that when the browser crashes or is slow, users