News for hackers. Stuff that matters.

A comment on Avast’s man in the middle.

Re:Avast’s man in the middle by 0942v8653 on Sunday December 13, 2015 @03:06PM (#10727691)
An antivirus software that can monitor HTTPS connections should be a non-issue. Because you're already trusting Avast with full privileges, it can monitor every keystroke and screenshot every response from the browser, or read RAM during decryption, or replace your browser with a fake version that captures data, or any number of things. And it can upload it to some remote server if it wants to. It would be incredibly easy to get your bank password without this MITM: just start keylogging when an outgoing connection to example.com is established, wait for an email[TAB], and capture/upload all keystrokes until ENTER is pressed.

The only real problem here is not checking the validity certs. (Which is an incredibly serious problem.)

[ Parent | on HN ]
Re:Avast’s man in the middle by venomsnake on Sunday December 13, 2015 @03:23PM (#10727754)
> The only real problem here is not checking the validity certs. (Which is an incredibly serious problem.)

There are other problems. I am not sure where the third party doctrine will stand, but you are trusting all of your secure connections to a third party with full consent.

If avast get subpoenaed and their software has called home, which any antivirus does - they must collect new samples all the time - this could spell trouble.

[ Parent | on HN ]
Re:Avast’s man in the middle by fidget on Sunday December 13, 2015 @03:29PM (#10727779)
It wouldn't be particuarly hard for avast to operate this system without having the key for the CA leaving your machine.
[ Parent | on HN ]
Re:Avast’s man in the middle by venomsnake on Sunday December 13, 2015 @03:33PM (#10727800)
That won't help when they send part of the plaintext home. Which any antivirus program does from time to time
[ Parent | on HN ]
Re:Avast’s man in the middle by muteh on Sunday December 13, 2015 @03:33PM (#10727797)
It might not be hard for them to do it, but how is the end user meant to know to ask if they do?
[ Parent | on HN ]