Norton 360 Criticized For Installing a Cryptominer (krebsonsecurity.com) 96
"Norton 360, one of the most popular antivirus products on the market today, has installed a cryptocurrency mining program on its customers' computers," reports security researcher Brian Krebs.
The Verge follows up: The TL;DR is that yes, Norton does install a crypto miner with its software, without making that clear in the initial setup process. But it isn't going to do anything unless you specifically opt in, so it's not a situation where you'll install the security suite and instantly start seeing your computer lag as it crunches crypto in the background.
A NortonLifeLock spokesperson also told The Verge in an email that you can completely remove NCrypt.exe by temporarily turning off Norton's tamper protection feature, and then deleting the executable. We confirmed that ourselves, and it could be good news for anyone worried about Norton remotely activating the feature.
But Krebs reports the product has drawn some bad reactions — and not just because Norton is keeping 15% of the currencies mined: [M]any Norton users complain the mining program is difficult to remove, and reactions from longtime customers have ranged from unease and disbelief to, "Dude, where's my crypto...?"
According to the FAQ posted on its site, "Norton Crypto" will mine Ethereum cryptocurrency while the customer's computer is idle. The FAQ also says Norton Crypto will only run on systems that meet certain hardware and software requirements (such as an NVIDIA graphics card with at least 6 GB of memory). "Norton creates a secure digital Ethereum wallet for each user," the FAQ reads. "The key to the wallet is encrypted and stored securely in the cloud. Only you have access to the wallet." NortonLifeLock began offering the mining service in July 2021...
[M]any users have reported difficulty removing the mining program.
From reading user posts on the Norton Crypto community forum, it seems some longtime Norton customers were horrified at the prospect of their antivirus product installing coin-mining software, regardless of whether the mining service was turned off by default. "How on Earth could anyone at Norton think that adding crypto mining within a security product would be a good thing?," reads a Dec. 28 thread titled "Absolutely furious."
"Norton should be DETECTING and killing off crypto mining hijacking, not installing their own," the post reads....
"Norton is pretty much amplifying energy consumption worldwide, costing their customers more in electricity use than the customer makes on the mining, yet allowing Norton to make a ton of profit," tweeted security researcher Chris Vickery. "It's disgusting, gross, and brand-suicide."
Then there's the matter of getting paid.... "Transfers of cryptocurrencies may result in transaction fees (also known as "gas" fees) paid to the users of the cryptocurrency blockchain network who process the transaction," the FAQ explains... Which might explain why so many Norton Crypto users have taken to the community's online forum to complain they were having trouble withdrawing their earnings. Those gas fees are the same regardless of the amount of crypto being moved, so the system simply blocks withdrawals if the amount requested can't cover the transfer fees.
Thanks to Slashdot reader JustAnotherOldGuy for tipping us off to the story!
The Verge follows up: The TL;DR is that yes, Norton does install a crypto miner with its software, without making that clear in the initial setup process. But it isn't going to do anything unless you specifically opt in, so it's not a situation where you'll install the security suite and instantly start seeing your computer lag as it crunches crypto in the background.
A NortonLifeLock spokesperson also told The Verge in an email that you can completely remove NCrypt.exe by temporarily turning off Norton's tamper protection feature, and then deleting the executable. We confirmed that ourselves, and it could be good news for anyone worried about Norton remotely activating the feature.
But Krebs reports the product has drawn some bad reactions — and not just because Norton is keeping 15% of the currencies mined: [M]any Norton users complain the mining program is difficult to remove, and reactions from longtime customers have ranged from unease and disbelief to, "Dude, where's my crypto...?"
According to the FAQ posted on its site, "Norton Crypto" will mine Ethereum cryptocurrency while the customer's computer is idle. The FAQ also says Norton Crypto will only run on systems that meet certain hardware and software requirements (such as an NVIDIA graphics card with at least 6 GB of memory). "Norton creates a secure digital Ethereum wallet for each user," the FAQ reads. "The key to the wallet is encrypted and stored securely in the cloud. Only you have access to the wallet." NortonLifeLock began offering the mining service in July 2021...
[M]any users have reported difficulty removing the mining program.
From reading user posts on the Norton Crypto community forum, it seems some longtime Norton customers were horrified at the prospect of their antivirus product installing coin-mining software, regardless of whether the mining service was turned off by default. "How on Earth could anyone at Norton think that adding crypto mining within a security product would be a good thing?," reads a Dec. 28 thread titled "Absolutely furious."
"Norton should be DETECTING and killing off crypto mining hijacking, not installing their own," the post reads....
"Norton is pretty much amplifying energy consumption worldwide, costing their customers more in electricity use than the customer makes on the mining, yet allowing Norton to make a ton of profit," tweeted security researcher Chris Vickery. "It's disgusting, gross, and brand-suicide."
Then there's the matter of getting paid.... "Transfers of cryptocurrencies may result in transaction fees (also known as "gas" fees) paid to the users of the cryptocurrency blockchain network who process the transaction," the FAQ explains... Which might explain why so many Norton Crypto users have taken to the community's online forum to complain they were having trouble withdrawing their earnings. Those gas fees are the same regardless of the amount of crypto being moved, so the system simply blocks withdrawals if the amount requested can't cover the transfer fees.
Thanks to Slashdot reader JustAnotherOldGuy for tipping us off to the story!
A clandestine cryptominer (Score:4, Insightful)
Re: (Score:1)
Re: (Score:2)
I use Norton, but had no intention of turning on mining, since I don't want to increase my energy bill by running my system at higher wattage than I normally do. I am not a crypto fan, so I agree this is not really a great idea for a security product, but then again, there are probably lots of people who appreciate having crypto mining set up for them. In the end, mining will have to be stopped or changed so that it does not waste insane amounts of energy. This is not sustainable, or positive for the planet
Re: (Score:2)
Re: (Score:2)
It's not a feature. It's a requirement.
Features can be deprecated when you realize what a bad idea they are.
Re: (Score:3)
I have a central heat pump system now, but I used to run mining software whenever it was colder than 50f to supplement electric baseboard heat.
(Bought the heat pump, and the house around it with my crypto profits.)
Re: A clandestine cryptominer (Score:3, Insightful)
If some aspect of an application is only mentioned in the EULA, and not advertised in promotional material like the slick sheet, I think most people would call that a clandestine feature.
Re: (Score:2)
Yeah. And if they had you agree to botnet software in the EULA, are they even an anti-malware product?
Re: (Score:2)
So software that performs actions unknown to you, is difficult to remove, provides not benefit, and actively works against the user? Sounds like malware. I don't care how pro-crypto-coin someone is, you don't do this behind the scenes, which in the best case scenario gives you only a few cents a week.
Re: (Score:2)
So software that performs actions unknown to you, is difficult to remove, provides not benefit, and actively works against the user? Sounds like malware.
Just sounds like Norton software ...
Re: (Score:2)
Norton software that's been weaponized.
Re:A clandestine cryptominer (Score:4, Insightful)
Poor Peter Norton, he must be appalled by what has happened to his once great company.
I find it appalling that anyone uses software from Symantec, there doesn't seem to be a program that they can't ruin and still make a profit on. Norton Utilities, Delrina WinFax, Backup Exec, PowerQuest Drive Image, you name it, if Symantec bought it they removed features, mangled the interface, hosed up the functionality, and to add insult to injury jacked up the price.
Re: (Score:2)
Sleezy (Score:2)
Re: (Score:2)
No one told me that McAfee bought Nortons!
Re: (Score:1)
Norton Commander was a nice piece of software. Never had a use for their AV
Re: (Score:3, Funny)
[M]any users have reported difficulty removing the mining program.
It's OK, most anti-malware utilities will remove cryptominers, just download something like Norton 360 and... oh....
Brand suicide (Score:3)
It is but then again this is the age of people who love to eat the dog food.
The fees are an interesting addendum. Basically all Norton's cryptography gets pooled to a single wallet. So they are probably doing little more than robbing people. It would be brilliant to see someone give a breakdown of how much profit Norton makes from this. It has to be in their filings somewhere.
I am relatively pro cryptocurrency and I think it has good use cases but it's shit like this that gives the whole community flak as a bunch of grifters.
Re: (Score:3)
Re: (Score:2)
Or more fundamentally, can a corpse commit suicide? Even without cryptomining, Norton 360 is effectively malware with the amount of resources it hogs on the system. Combine that with the fact that Norton pays for the installation sideloaded with other software (which windows defender flags a "Potentially Unwanted Software") it has more in common with malware than software which removes malware.
Illegal in some places. (Score:2)
Re: (Score:2)
Who owns the computer?
You still own your computer, bought & paid for & you're responsible for paying to maintain it. But that doesn't matter. As Microsoft & Apple have shown is that what's really important is who *controls* your computer, what software you can & can't install or uninstall, which settings you can change, etc..
Norton have simply decided to take a little more control over your computer because their profits are more important than your electricity bill. It's just another (very inefficient) way to ch
Re: (Score:2)
If it's in the EULA then it technically isn't "behind their backs". Unless EULAs are also illegal.
Re: (Score:2)
I'm fortunate to be able to read 1200 words per minute.
Before Steam had a return policy I purchased, and before installing, read the EULA for Sid Meir's Civ 5. I noticed two things. They said that by accepting I was agreeing to let the company send messages to people on my contact lists. And If I don't accept the terms of the EULA to return to place of purchase.
Pointing out to Valve that their own UI was presenting that return policy, I got a refund because the first portion was unacceptable (since I also d
Re: (Score:2)
You're retarded to be afraid of responding to emails on your own PC.
I'm never gotten malware on my own PC; I don't do porn sites or piracy on it, and I carefully check what I install.
AAA PC games are less likely to have malware than visiting /. in a web browser without adblock.
Re: (Score:3)
TFS says the feature is opt-in and you surely agree at some point in the install process to install their cryptominer. I'm against the whole fucking thing on the basis of sustainability but frankly they don't seem to be turning the feature on by default so where's the harm done directly by Norton? If harm is done it's only after the user enables the feature, so arguably the user is doing the actual deed.
This assumes TFS is correct (ha ha ha) and that it's not actually opt-out.
Re: (Score:2)
they don't seem to be turning the feature on by default
YET. When you install an update six months from now and it mentions on Page 47 of the EULA that no one ever reads that you agree to allow the update to enable the service, a lot of people will of course blame Microsoft for slowing their computer down.
So.... (Score:2)
Wasn't that already a problem in June? Also by this point, I doubt anybody expects anything from those "Security in a box" products other than wasting CPU cycles.
A really, really bad idea (Score:4, Insightful)
Whoever is responsible should be fired immediately. Security needs simplicity. Security software needs to be free of any bloat or non-security related features. This is a really, really bad misconduct by the manufacturer. If they had offered this as a separate product, it would have been in bad taste but otherwise acceptable. But to install it as part of a security product is utterly wring, no matter whether it runs afterwards or not.
Re: (Score:2)
Re: (Score:2)
You have any better solution than AV in the mess that the MS eco-system is? No? Then do not presume you have the right to mock anybody.
That said, yes, business "ethics" and solid engineering are incompatible. That is why in other engineering disciplines, the share price is very much not the product. For the effects of violating that, see, e.g. Boeing for a recent example. If they were not that deep in bed with the military, they would probably have ceased to exist after the mass-manslaughter they did and th
Re: (Score:2)
I have yet to see a single issue that Norton AntiVirus can handle that Windows Defender hasn't also been able to clean, but I have seen things that Defender could take care of that Norton didn't even acknowledge.
Re: (Score:2)
More fundamentally, security products need trust.
Re: (Score:2)
Indeed, they do. They may get some trust upfront, but once they fail to justify that, it is basically game over.
Re: (Score:2)
Well, I could see one reason for embedding a cryptominer: make the Norton subscription free/keep Norton active when the subscription expires.
Something like: "Your subscription has ended. Norton will continue working but will now mine crypto during idle time to pay for the subscription. Decline/Accept".
That could make some sense to me. But obviously not what they did, which I agree was a dubious direction.
Norton is malware (Score:5, Insightful)
Like most other anti-malware outfits, Norton stared into the abyss for too long and became what it was supposed to fight. Uninstall as long as you still can.
Re: (Score:2)
Re: (Score:2)
I'm reminded of the version of Symantec WinFax that would ask you four times "ARE YOU SURE?" when you tried to uninstall, and in the end would just delete the link to the interface and leave everything in place. We found it faster to just reimage the hard drive than to try to remove WinFax.
That product gave me the one and only pleasant experience with Symantec tech support. When I called their music-on-hold machine had broken so someone had grabbed their Discman out of the car and plugged it into the phon
But will we notice the difference? (Score:4, Funny)
I mean. Norton was always a resource hog, so how much more of one will it be now?
(Yes that was sarcasm before people start going hurr durr...)
Re: (Score:2)
Maybe it's a conspiracy with Dell and other computer makers, to give people a reason to upgrade their old computers which suddenly seem so much slower than they did before!
Give them time (Score:2)
Decent business model (Score:2)
Re: (Score:2)
Re: (Score:2)
As Fons De Spons there said, if miners are imbedded into apps and websites, and use your electricity to earn $.25 worth of crypto for the owner of the site, or app designer, ad’s could go away.
Personally, despite hating how ad flooded the web has become, I’m not sure the wasted electricity is a worthy tradeoff. Adblockers still work.
Re: (Score:2)
Re: (Score:2)
Both you and the website would be better off if you just paid them not to mine *or* bother you with ads.
Ads let people trade a service for something non-monetary: an attempt at psychological manipulation. Allowing mining is just trading giving the website a quarter for giving the website a quarter and destroying another.
Re: (Score:2)
Am I missing something? (Score:2)
Re: (Score:2)
I remember using Norton Utilities in the late 80's but when it became the Symantec the product became bloated and worthless and I have not touched it in over 30 years.
Re: (Score:2)
Norton Utilities, good product. Symantec buys it, product becomes crap.
Delrina WinFax, good product. Symantec buys it, product becomes crap.
BackupExec, good product. Symantec buys it, product becomes crap.
Drive Image, good product. Symantec buys it, product becomes crap.
Etc. Etc. Etc.
Why does anyone ever buy software from Symantec? The pattern seems obvious to me, why isn't it to others?
Isn't it ironic? (Score:2)
So here we have an antimalware software provider, providing the added benefit of additionally installing optional malware, head spins.
Re: (Score:2)
So does Norton’s antivirus quarantine or uninstall itself once it notices this surreptitious activity?
Windows defender is actually good. (Score:2)
I rarely have issues, haven't used an Anti-virus software since 2007.
Most anti-virus software today is kind of like a virus in itself, and Northon just went out of their way proving that.
Other cases is who do you really trust? Remember, when you install an Anti-Virus free or not, you're essentially giving up all your data to the company behind the antivirus software.
Huh? Is norton run by ... (Score:1)
... chinese these days?
Bonkers (Score:3)
A reason that people use AV products is so that their computer isn't burning electricity for a third party and so that processor resource is there when needed. Personally I like my computer cores scaling down when idle.
What is the point of this, it almost guarantees that you'll burn the planet with no real benefit.
Re: (Score:2)
Norton can fuck right off with that shit.
Re: (Score:2)
Since when has any anti-virus been light on system resources? For over 20 years, these products have always caused more problems then they solved.
They are Cybercriminals by their own definition (Score:5, Interesting)
Defense against today's cyber threats.
Cyber threats are ever-evolving. Cybercriminals can steal personal information through your computers and mobile devices, and there are a number of ways that they do it.
Cybercriminals can use different types of malware to get what they want, such as:
Cryptojacking: Malware that gives cybercriminals access to "mine" cryptocurrency on your computer, at the expense of your resources.
Does anyone see AV working anymore? (Score:2)
I let my antivirus software updates lapse on my Windows machines several years ago and haven't noticed any trouble. I don't think it ever found anything legitimate, but did have a couple of troublesome false-positives. I think having ad blockers in web browsers are (were?) much more important.
Where do I send (Score:1)
It makes sense to somebody (Score:2)
While it's reprehensible that they would do this, especially in what is supposed to be a security product, you have to admire the audacity of it. "You will pay us money so that you can use your own resources to make more money for us." It's like somebody looked at Feudalism and thought, "what if the serfs had to pay a membership fee?"
When tech decides by them self⦠(Score:1)
Guys, guys ... (Score:2)
"Brand suicide?" (Score:2)
They've been irrelevant bloatware for a decade. I used to LOVE their products. Especially their enterprise AV. Then slowly the install got bigger, and bigger, and bigger, and I was looking at installers 5x the size they used to be. And customer computers (when I was a consultant) running slower and slower.
The only way they've managed to stay in business is via preinstall agreements with PC vendors.
Re: (Score:2)
Brand Suicide? (Score:2)
I agree that it's disgusting, but brand suicide? Look, they've done their apparent level best to kill that brand for years (decades really) and it's still alive. Suggesting that THIS is what's going to do in their fucking worth
The last piece (Score:2)
Of Norton/Symantec software I liked was the C/C++ compiler of the late 90â(TM)s. Too bad it had compatibility issues with most libraries - led to an early demise of an otherwise decent product.
The last purchase of anything Norton was with the laptops we bought our boys in 2007 - it was bundled. I did not renew the software.
Since then, I receive 3-5 emails per day in my Junk mailbox telling me my subscription is about to run out, has run out, or there is an update I must try.
Clearly, the scammers know
Re: (Score:2)
See my own separate comment on this (which I wrote before reviewing any others posted here). We had exactly the same experience, and I was just lamenting to myself that I did not dive deeper into the infuriating "subscription spam" - either as system messages or emails. Good to see that you covered that in more detail.
Lost a customer (Score:2)
I'm not on the market for an AV product right now, but next time I am I'll be looking elsewhere. I'm astonished someone at Norton thought this was a good idea. There are so many problems with this, not least in terms of resource usage. As a researcher what if I bring my laptop onto a military base and plug it into the wall? Now electricity paid for by the Federal government is powering a cryptomining operation (no matter how small) that will pay me, a private contractor, and Norton, a public company.
Even
Re: (Score:2)
They haven't been a "security" company since Peter Norton sold his Utilities to Symantec in the '90s. I have yet to see a single issue that Symantec software could deal with better than the built-in Windows Defender that comes free, but there have been several that Norton AV couldn't handle that Defender could.
Re: Lost a customer (Score:2)
Fair point (and I agree about Defender). I guess I should say a "purported AV/security company". Honestly I've been reasonably impressed (or may just not disappointed?) with Defender on my non-work machine. My employer just switched us from Symantec corporate AV to Sophos. Too early for me to decide how it compares to Symantec/Norton, or Defender.
Symantec is a top down grifter scam. (Score:2)
Another Symantec Sin (Score:2)
Norton is actually a unit of Symantec, a company from which I have never had a piece of usable software. Bought or used multiple copies of its various products over the years, six I think, because they were everywhere in stores, had huge name recognition, and were preinstalled in computers I bought, and so I thought maybe I just had a bad experience and maybe they make some good stuff and maybe should give it a (another) try. Never saw any of that good stuff.
Often their antivirus software was pre-installed
Re: (Score:2)
Norton is actually a unit of Symantec, a company from which I have never had a piece of usable software
I think you mean NortonLifeLock: https://en.wikipedia.org/wiki/... [wikipedia.org] a name that should instill a sense of competence and ethics to anyone who hears it.
Symantec split in two, with enterprise software going one way, consumer shit going the other. Vertias kept the enterprise stuff, Symantec the consumer bits. They eventually renamed themselves NortonLifeLock when they merged with LifeLock. I guess at some point Veritas sold Symantec Endpoint Protection to Broadcom. Meanwhile NortonLifeLock still owns the No
After deleting nCrypt.exe, do this... (Score:2)
A NortonLifeLock spokesperson also told The Verge in an email that you can completely remove NCrypt.exe by temporarily turning off Norton's tamper protection feature, and then deleting the executable. We confirmed that ourselves, and it could be good news for anyone worried about Norton remotely activating the feature.
After deleting the NCrypt.exe, create a directory in that location named "NCrypt.exe". That will prevent Norton from re-installing it. If the installer detects an entry named "NCrypt.exe" it will probably either call the file delete system call, which will fail, or try to overwrite the existing entry which will also fail.
Re: (Score:2)
Re: (Score:1)
After doing something like that? The only rational remedy is to remove Norton entirely. Don't even think about using them again.
Besides, Windows comes with AV software now.
Why would you do that? (Score:2)
'Cryptocurrency' is a troll-meme and needs to DIE and GO AWAY FOREVER. It's wasteful bullshit and you're either a fool or a scumbag if you involve yourself with it.
Friends don't let friends install Norton (Score:2)
Is this a surprise? (Score:2)
Board members want to know, "How can we get in on crypto?"
Class action lawsuit (Score:1)
I mean, it's Norton (Score:2)
What did you expect?
Hopefully you aren't expecting it to keep your computer safe. The best you can hope for is a bloated crap fest which is never fully able to be uninstalled.
File not found (Score:1)
Are we sure this is a real thing not a prank or third party S&G?
I have Norton installed, and even after doing a system wide search including mounting the partition under Linux I cannot find the file in question.
opt in (Score:2)