Your antivirus can change owners overnight
Kaspersky users in the US woke up to a different antivirus. A reminder to know who runs your most trusted software.
This week many Kaspersky users in the US found that their antivirus had been replaced by another product, UltraAV, through an automatic update. It followed the US ban on Kaspersky software, and the customers had been told by email. Many still didn’t notice until a new icon appeared.
Whatever you think of either company, the lesson is bigger. Security software runs with the highest rights on your machine and updates itself silently. The company behind it can be sold, banned or replaced, and the software changes with it.
Questions worth asking about any tool with deep access, such as antivirus, remote support, backup agents or browser extensions:
- Who owns it today, and where is it based?
- Can it update or replace itself without anyone approving?
- Would we notice if it changed?
- How fast could we remove it from every machine?
Keep a short list of these tools, their owners and their renewal dates. Read the vendor emails nobody reads. That’s usually where the change is announced.