2

I use Malwarebytes and the web filter functionality puzzles me. As far as my research has found, antivirus engines typically use a proxy to intercept web requests which typically there would be evidence in the certificate used to encrypt the connection (ie the issuer certificate), however Malwarebytes is able to intercept web requests and doesn't show a custom certificate.

This has me confused cause my research so far has shown:

  1. You have to use your own CA and certificates in order to decrypt the web traffic
  2. You have to add it to your system and browser's trust stores for certificates

Malwarebytes however, doesn't appear to do any of the things above and is still able to intercept both SSL and non-SSL traffic. It intercepts traffic from every program.

I am mainly wondering how they do this? Presumably they use Windows Filtering Platform in order to do this, but in what way do they use it? I'd imagine there has to be some sort of configuration change, or something of the like in order to do this?

I wasn't sure whether or not to ask this on StackOverflow since it is to do with specific software and how it works, rather than specifically with coding.

-1

I don't know the actual answer, but my guess would be that it's installing an API hook in Windows that intercepts the data prior to it hitting encryption.

[HTTP request]->[MBAM]->[TLS Encryption]->[Network]

If you're saying it didn't automatically add a trusted cert to your system's store, then that's the second easiest method that I can think about.

  • I don't know the actual answer Then your answer might be better suited as a comment, not an answer. – Kevin Voorn Jan 4 at 23:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.