Antivirus connects to their server over port 80

Question

I ran a netstat and noticed that my computer has an always-established connection with my anti-virus (Avast) over port 80. I haven't gone as far as to parse through it in Wireshark, so I can only assume that the connection is there to pass unknown hashes or files back up to their database for analysis.

My question is twofold:

• What other types of information does Avast (or any anti-virus for that matter) collect from their users' machines?

and

• Does this pose as a security risk? If someone malicious were monitoring my traffic, would they be able to glean anything of value? Also, if there were a malicious file on my computer, would they be able to modify that traffic before it got to the antivirus' servers to keep the antivirus from flagging that file?

Answer 1

Though it is over HTTP, and the ideal would be over HTTPS, any software providers communicate over HTTP and sign the communication. Let's take a step back and answer what SSL (and TLS) provides.

• Encryption of content
• Validation of non-tampering

To prevent tampering, may software providers digitally sign the content with a certificate or a GPG key and send it over HTTP.

The question then is why? Why not just use TLS? Oftentimes, this is because of network infrastructure can't support TLS or the mistaken belief that HTTPS is slower than HTTP.

What's the risk? Generally, if the content is properly signed (and validated), there isn't much risk. It's still not ideal, but the big part is repudiation of content.

Answer 2

In reference to your second question, it depends on the skill level of the attacker. If someone were able to monitor your traffic and potentially has a file on your computer, then they'd be able to do things like man in the middle attacks. There are several ways to bypass AV, and I wouldn't put full faith in any one software.