This question already has an answer here:
- Kaspersky Antivirus “secure connection scan” as broken as Superfish? 1 answer
- How does ESET antivirus filter browser SSL/TLS traffic? 1 answer
- Why is 'avast! Web/Mail Shield Root' listed as CA for google.com? 3 answers
- Does a TLS interception proxy present the user's browser with the end server's certificate? 4 answers
I have installed antivirus and noticed that all
https sites I am visiting use the certificate of antivirus's manufacturer. It looks like man-in-the-middle attack and I understand why the antivirus's manufacturer do it: it is only way to check
https traffic and find threats.
But my knowledge is not enough to answer to next two questions:
What is the new certificate? It is the certificate which was generated in my computer when I was installing the antivirus ? Or it is the one certificate for all users of this antivirus ?
What are the new attack vectors with this substituted certificate ?