0

So basically can they use some sort of man in the middle attack and decrypt and read my packets?

I use their own app to use their SSL proxy and i tried scanning it with Kaspersky and it found no malware, so am i fine? do i need to worry?

basically what I'm asking is can they even do any sort of man in the middle attack and decrypt my packets even when chrome says the https connection is secure?

and if they can, will my Kaspersky notice it and stop it? because i heard kaspersky does some tricky stuff with the https certificates (I'm using internet security version)

  • Check your browser. Usually the direction bar has a closed keylock when you are using https, click on it and confirm that the certificate issuer is the owner of the webpage, otherwise someone could be watching your connection. – YoMismo Jul 23 '18 at 7:31
  • @YoMismo so the proxy server cannot do any sort of man in the middle attack that changes the certificate issuer shown in my browser? – AlenT Jul 23 '18 at 8:14
1

Yes, they could. The attack is of medium sophistication and it requires, to go undetected, that they somehow installed a valid Root Certificate as trusted in your computer (and/or browser).

Once done, the request for the index page of the website would be sent via SSL CONNECT, and would go on un-intercepted. You would be connected with the destination website (same as not having a proxy at all, which is why a non-decrypting SSL proxy makes no sense unless you're just masquerading your IP), and the page would arrive signed with the appropriate, authentic certificate. So you would see the correct closed-lock symbol on the browser and so on and so forth.

Then that page will start loading javascript resources, images and CSS's. And possibly start running AJAX calls. All those calls might be intercepted by the proxy, and this time decrypted, the request going through with the proxy's certificate. Then the proxy reencrypts them with its own certificate, which is different from what it should be, but is signed by a trusted CA, so no alarm is raised; the SSL icon in the browser still refers to the main page, so you have no way of knowing that four fifths of the traffic - the important part - is being snooped.

You would need some utility such as Certificate Patrol for Firefox.

will my Kaspersky notice it and stop it? because i heard kaspersky does some tricky stuff with the https certificates

No, it won't. And the tricky stuff Kaspersky (or ESET, or...) does is exactly the above - it installs an invisible proxy plus a trusted certificate, so that it can decrypt your SSL communications and ensure there's no virus inside.

Otherwise, its Internet protection could never work with HTTPS.

  • Is there anything for chrome? – AlenT Jul 24 '18 at 5:02
  • also, is there any website that checks whether my SSL proxy is doing man in the middle attack or not? – AlenT Jul 24 '18 at 5:10
  • You can check it yourself. [Firefox] Visit a HTTPS website, click on the green lock icon in your address bar --> Click on ">" --> More Information --> View Certificate. [Chrome] F12 to open developer tools --> Security --> View certificate. If this certificate was issued by Kaspersky and not by an actual CA, your traffic is man-in-the-middled by (at least) your local Anti-Virus Software. – GxTruth Jul 24 '18 at 5:54
  • To spot the slightly more complex attack I described, you can try to pick one connection in the Network pane of webmaster tools and open the xhr call in another window. Not guaranteed to work, but this might show the real ssl cert without the attempt being picked up by the proxy. – LSerni Jul 24 '18 at 7:28
1

Usually an Anti-Virus Software will create and install a Root CA certificate at your computer, which is capable of creating arbitrary certificates. These will be considered "trusted" by your computer, as the CA which signed them is trusted (the Anti-Virus CA).

At the time of you requesting a website, this will usually happen.

  1. You request google.com
  2. Your AV software will proxy the request
  3. Your AV establishes the connection and validates the original google.com certificate
  4. Your AV gives a forged certificate (which is signed by said Root CA) to your browser
  5. Browser consideres is "trusted" as the root CA is trusted
  6. Your AV has the key(s) to the Root CA and its certificated so it can read and re-encrypt all traffic

Otherwise, your AV software would have to somehow manipulate your system in an even worse way, as it is not capable of decrypting the HTTPS content (only the browser can (and anybody ripping the keys from its RAM)). Chrome recently implemented measures against AV software manipulating its code, as AV software is known to implement their own little bugs while trying to protect you (it's software nonetheless and therefore has bugs and attack surface).

Is AV Software capable of spying at you? Absolutely. It runs as a very privileged process as thus can manipulate a lot of things.

Will it protect you? If it detected the malicious content, yes. However, AV software can fail at detecting attacks, especially new ones, so don't rely on it alone as safety measure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.