I ran a netstat and noticed that my computer has an always-established connection with my anti-virus (Avast) over port 80. I haven't gone as far as to parse through it in Wireshark, so I can only assume that the connection is there to pass unknown hashes or files back up to their database for analysis.

My question is twofold:

  • What other types of information does Avast (or any anti-virus for that matter) collect from their users' machines?


  • Does this pose as a security risk? If someone malicious were monitoring my traffic, would they be able to glean anything of value? Also, if there were a malicious file on my computer, would they be able to modify that traffic before it got to the antivirus' servers to keep the antivirus from flagging that file?
  • 2
    your first question is one for Avast support, which makes the second unanswerable, unfortunately
    – schroeder
    Feb 12, 2016 at 18:03

2 Answers 2


Though it is over HTTP, and the ideal would be over HTTPS, any software providers communicate over HTTP and sign the communication. Let's take a step back and answer what SSL (and TLS) provides.

  • Encryption of content
  • Validation of non-tampering

To prevent tampering, may software providers digitally sign the content with a certificate or a GPG key and send it over HTTP.

The question then is why? Why not just use TLS? Oftentimes, this is because of network infrastructure can't support TLS or the mistaken belief that HTTPS is slower than HTTP.

What's the risk? Generally, if the content is properly signed (and validated), there isn't much risk. It's still not ideal, but the big part is repudiation of content.


In reference to your second question, it depends on the skill level of the attacker. If someone were able to monitor your traffic and potentially has a file on your computer, then they'd be able to do things like man in the middle attacks. There are several ways to bypass AV, and I wouldn't put full faith in any one software.

  • 1
    If you don't know what data is contained in the plaintext http requests, how do you know that it depends on the skill level of the attacker? If the data is useless, then regardless of the attacker's skill, it's still useless. Feb 12, 2016 at 20:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .