The publisher admits having integrated in a careless way in its applications a library that collects navigation data and was rather intended for security products. This collection is now disabled.
A few days ago, several security researchers revealed strange exfiltrations of personal data in a series of signed applications signed Trend Micro and spread through the Mac App Store. These included Dr.Antivirus, Dr.Cleaner and Dr.Unarchiver.
The Japanese publisher, known for its security solutions, came out of his silence and gave explanations in a blog note. He recognizes that his apps on Mac App Store systematically exfiltrated the user’s browsing history for security reasons. It was a question in particular " to analyze if the user had met adware or other threats, thereby improving the product and the service ".
According to Trend Micro, this collection was done only once, after installation of the software, and covered only the last 24 hours. The data thus recovered were stored for three months on a server in the United States, managed by Amazon Web Services (AWS). The publisher underlines, moreover, that this collection appeared in the conditions of use that people are obliged to accept. It was not about a data theft.
All the collected data were erased
However, Trend Micro recognizes to have exceeded the limits by activating this collection for all its applications, including the utility software that had no security feature. Apparently, it was about a regrettable error. This collection function appeared in a library that has was automatically joined into all the incriminated applications. Absurd.
Just to put up a good show, the editor specifies to have erased all the data collected and stored in the AWS server. It has also deleted the browsing history collection feature from all its macOS applications intended for the public: Dr Cleaner, Dr Cleaner Pro, Dr. Antivirus, Dr Unarchiver, Dr Battery and Duplicate Finder.
All these applications are unavailable on the Mac App Store for now, but the publisher - who doubtless considers having made amends - hope to be quickly able to find its place in this application store.
On their side, the security researchers remain cautious. They think that the security argument is easy to blame.
“Yeah, but we did it for security” - (Nikolai Hampton)September 10, 2018
In addition, Thomas Reed, researcher at MalwareBytes, does not remember having seen a note or a notification concerning this data collection while he looked for one. And it’s hard to check it now, while the applications are not available anymore.
“The dated collected was explicitly identified to the customer in the data collection policy and is highlighted to user during the install. It's hard to verify after the apps were removed, but I explicitly looked for in-app data collection notification and did not find any.” - Thomas ReedSeptember 10, 2018
The researcher Privacy 1st considers for his part that, even if the users had received an alert, this way of doing is neither professional nor ethics.
“Even if they think that it is all okay to do that, it is not ethical nor professional.” - Privacy 1st (@privacyis1st) September 11, 2018
I've made a lot of articles with tools, explanations and advises to show you how to protect your privacy and to secure your computer, GO check them out!
This is my guide to secure your PC after a fresh installation of Windows
If you think that your phone or your PC has been hacked, you have to check it right now!
That's how you can be more Anonymous on the internet!
Why your PC is slow?
You Feel hot? Your computer also!
How an adware works?
That's how you should guard against Trojan!
