33

I installed Kaspersky internet Security 2016 on my laptop; in Firefox and Edge the root issuer is Kaspersky Anti-Virus Personal Root Certificate. but in chrome the root issuer is GeoTrust. in my knowledge the Root CA certificate is self signed By Root. how Kaspersky changed the issuer name? also it changes the Certificate Hierarchy in Firefox the Hierarchy is :

Kaspersky Anti-Virus Personal Root Certificate
    www.google.com

but in chrome the Hierarchy is :

GeoTrust Global CA
    Google Internet Authority G2
        *.google.com

I check some another site but the all browser showed me an identical result? is this related to google chrome certificate pinning for some url?

Improve this question
8
  • 13
    It's because Google pins their certificate in Chrome
    – Neil McGuigan
    Commented Nov 3, 2015 at 19:12
  • 1
    My understanding is that Chrome, Edge, and IE use the built-in Windows certificate store, and that Firefox does not: wiki.mozilla.org/CA:AddRootToFirefox So, how is it that Edge is affected and not Firefox since Firefox uses its own proprietary store? PS, I know the OP already accepted an answer, but I'm not sure I agree fully that what was stated in the accepted answer is what is going on, because that would mean that Kaspersky would have had to manipulate the Windows store and the proprietary Firefox store as well.
    – Brad Bouchard
    Commented Nov 3, 2015 at 19:43
  • chrome uses certificate pinning. but IE , Firefox and edge doesn't @BradBouchard
    – Soheil Ghahremani
    Commented Nov 3, 2015 at 19:46
  • 1
    They may use cert pinning, but Chrome and Microsoft browsers still use the built in Windows store and Firefox does not. That would mean some sort of manipulation happened to Firefox's cert store in the process of Kaspersky being installed or configured.
    – Brad Bouchard
    Commented Nov 3, 2015 at 19:47
  • 1
    @SoheilGhahremani Precisely my point... if Firefox was fooled, then Kaspersky also inserted itself into the Firefox proprietary certificate store that they use for their browser, which is disturbing to me.
    – Brad Bouchard
    Commented Nov 3, 2015 at 19:50

3 Answers 3

Reset to default
66

This "Kaspersky Anti-Virus Personal Root Certificate" is the sign that your anti-virus is actively intercepting the connection, in effect running a Man-in-the-Middle attack. This can work because your anti-virus runs locally (on your computer) its own certification authority, and inserted the corresponding CA key in the "trusted store" used by your browsers (well, not all of them, since it apparently did not do the job for Chrome -- as was remarked by @Neil, Chrome does not liked to be fooled about Google's certificate). Thus, the anti-virus generates on-the-fly a fake certificate for Google, which fools your browsers. The certificate you see in Edge or Firefox is not the one that Google's server sent, but the imitation produced locally on your computer by Kaspersky.

Anti-virus software does such things in order to be able to inspect data as it flows through SSL, without having to hook deep inside the code of the browsers. This is an "honest MitM attack".

Improve this answer
10
  • in other words the antivirus knows symmetric key? how anti virus can do such thing? I thought only browser SSL engine knows that
    – Soheil Ghahremani
    Commented Nov 3, 2015 at 19:17
  • 13
    No, your browser sends data encrypted in a way the AV software can decrypt, the AV decrypts, checks, reencrypts with original certificate, sends to server, gets response (which it can decrypt), decrypts, checks, reencrypts with own certificate, sends to browser. Two distinct certificates in use, each encrypting the same data at different points.
    – Matthew
    Commented Nov 3, 2015 at 19:30
  • 19
    It is worth noting that this kind of mitm attack can introduce new security problems because the real certificate which is never seen by the browser still has to be validated.
    – kasperd
    Commented Nov 4, 2015 at 0:53
  • 3
    Why couldn't Kaspersky keep the original, encrypted copy of the data, simultaneously decrypt the data and inspect it and if everything is alright, pass along the untouched data? Seems like a cleaner way to do it but maybe I'm missing something.
    – isaacparrot
    Commented Nov 4, 2015 at 7:01
  • 5
    @ParrotMac: to do that, Kaspersky would have to read the symmetric key from the browser's memory, or patch the browser so it derives the same symmetric key as Kaspersky during its key exchange. They would be an even worse intrusion to the browser than installing a CA certificate to the keystore. That would be more akin to what a malware would do rather than a self-inflicted MiTM.
    – Lie Ryan
    Commented Nov 4, 2015 at 7:52
11

As pointed out in other answers, the reason why you see "Kaspersky Anti-Virus Personal Root Certificate" is because Kaspersky intercepts the connection, in order to scan for malware.

Now, the reason why it isn't the case for Google websites in Chrome is not related to certificate pinning:

Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites.

(From the Chromium Security FAQ).

No, the reason why it isn't the case is that Google websites use the QUIC protocol in Chrome, and Kaspersky does not intercept QUIC connections (yet).

Improve this answer
6

This is because Kaspersky installs a CA Certificate on your system and in commonly used browsers to be able to intercept SSL connections. This can be useful to detect malware.

The second hierarchy you quoted is the correct one.

Improve this answer
1
  • 4
    @IlmariKaronen if you remembered several year ago Someone!! hacked the DigiNotar (that was a Trusted CA) and issued several fake certificates that many of them were for google domains. that was a transparent MITM attack that only chrome could detect it
    – Soheil Ghahremani
    Commented Nov 3, 2015 at 20:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .