Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just noticed something weird in my browser: the certificate for www.google.com has been issued by avast! Web/Mail Shield Root. Should I be worried? I am using avast! Antivirus so it's probably a built-in feature, but I don't know why this is happening and what the benefits/risks are.

Screenshot of the certificate tree

share|improve this question
1  
Can you click on the "View Certificate" button and show those details? – user2813274 Nov 23 '14 at 16:25
1  
up vote 28 down vote accepted

The whole goal of HTTPS is to prevent eavesdropping so that anyone monitoring your web traffic can't see what you're sending. As useful as it is, HTTPS presents a bit of a problem to antivirus software because when you visit sites over an encrypted connection, your antivirus software cannot see what sites you're visiting or what files you're downloading, at least until the download finishes. This presents a risk because if you download a virus, the antivirus software won't know about it until the download is finished and the virus is already saved to your hard drive, allowing criminals to bypass the "live defense" features of AV by simply hosting the malware on an HTTPS site.

The solution that many antivirus programs use is to install its own SSL certificate as a root certificate so that it can essentially man-in-the-middle all HTTPS traffic to scan for malware. I'm guessing this is what avast! is doing.

Whether this behavior presents additional security issues is debatable but I don't think it's something you need to be deeply concerned about - after all, your own antivirus software is doing the man-in-the-middling, not a malicious party. If it worries, you, you can disable this behavior - go to Settings>Active Protection>Web Shield>click on "customize" and tick the box next to "Disable HTTPS scanning." If you do this, avast! won't be able to proactively block malware on HTTPS sites.

share|improve this answer
13  
If the AV is doing this for all HTTPS connections, regardless of certificate validity, then you definitely do have a problem. As long as everything is running through the SSL proxy, and the SSL proxy is trusted by the browser, you have no way of knowing when a site's certificate should really be trusted or not. – Iszi Nov 23 '14 at 19:23
4  
@iszi After installing avast myself I found that indeed this is the case, so it may definitely be safer to disable HTTPS scanning until avast fixes this. – tlng05 Dec 23 '14 at 19:08
3  
Is a unique key for the trusted CA Certificate installed on each system? If not, there's a security issue. – mc0e Feb 22 '15 at 16:34
4  
This is basically Superfish again. – Shadur Feb 26 '15 at 6:04
1  
@Shadur while it appears to do something similar to superfish, it is implemented in a manner that is MUCH more secure, mitigating most of the security risks. See my answer here: security.stackexchange.com/questions/82285/… – tlng05 Feb 26 '15 at 10:59

This is happening because as others described, the Mail/Web shield needs to be able to scan your web traffic before it is saved on your system / does any harm.

Scanning encrypted SSL/TLS sockets requires that Avast can decrypt the connection. There is no other way for Avast to decrypt the connection than to generate its own certificate with a known derived decryption key, then signing them with a custom Root Certificate from Avast installed on your system.

This completely compromises internet privacy. (1) Man-In-The-Middle attacks by any person exchanging the website's keys to their own so that they may tap in on your connection will go unnoticed by your browser. (2) Unsecure website certificates (maliciously exchanged, cracked or shared with third-parties) will be accepted by your browser and the whole concept of secure, encrypted and authenticated connections is ignored.

There is a checkbox in “preferences” in Avast that says “scan secured connections”. I recommend you to turn this off if you value internet privacy.

share|improve this answer

Comment to @user54791 and @iszi's comment:

Avast shields untrusted certificates with a certificate issued by a different issuer, called "avast! Web/Mail Shield Untrusted Root". As long as this issuer stays untrusted, there is still a security warning when a HTTPS connection with an untrusted certificate is accessed.

So there is no need to disable HTTPS scanning for that matter.

Avast's wrapper certificate for untrusted certificates

share|improve this answer

protected by Community Mar 14 '15 at 19:22

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.