3

I realized the issue a MITM proxy can pose to my privacy and I started to dig into it more to see how to detect it as a client. Things I know to check so far are:

  • Checking who issues the certificate and see if it is a self-signed one installed in my own root certificate store.
  • Checking if I am being served web content from a local IP instead of the outside server IP and if the local IP is always the same.
  • Checking if my system proxy settings are configured to localhost.

My questions are:
Besides certificate pinning, what else can I check if all of the above is negative but I still have reason to believe I am being MITM proxified? Case in point: Avast claims they use a MITM proxy to scan all web traffic except white-listed URLs of some banks but I am not seeing any of the usual singes of MITM being active. I read somewhere that they could be reading directly from memory but that sounds expensive to implement and maintain if they already bundled a MITM proxy in their product and tell openly that they use it? Is there a way for a MITM to run without triggering any of the listed checks? Some kind of transparent MITM proxy for Windows machines?

1

Of those three points you mentioned, none of them can be used to reliably detect a Man-in-the-Middle attack.

Checking who issues the certificate and see if it is a self-signed one installed in my own root certificate store.

All of the root certificates are self-signed. That, and the fact that they are capable of being Certificate Authorities, is what makes them a root certificate.

What you can do, however, is compare your certificate store manually with a known good certificate store. Microsoft and Apple, for instance, publish which root certificates they trust by default. If your configuration varies inexplicably, it may be a sign of compromise.

Of course, in a company environment, your IT department is very likely to have their own CA, which they deployed on your machine. So check with them if you worry about a company computer being compromised.

Checking if I am being served web content from a local IP instead of the outside server IP and if the local IP is always the same.

If you are in a home network, you don't get the content directly from the web server, but instead have it routed to you over many network nodes. Each one of those, theoretically, could change the source IP address.

Imagine your home router was compromised and would conduct a Man-in-the-Middle attack. They could, theoretically, just change the destination of your IP packets and have them end up at the attacker. Upon replying, the router could then mangle the packets back, making them look as if they came from the correct source.

Of course, this would be noticeable, since if you use HTTPS, the attacker will likely not have a valid certificate for the site, unless they also have installed a compromised root certificate on your machine.

Checking if my system proxy settings are configured to localhost.

The system proxy settings are only relevant for applications that care about them. In fact, an application can simply decide not to use the system proxy settings. This is vital, because otherwise, proxies running on localhost would try to call themselves and end up in an endless loop.

Furthermore, a proxy configuration only instructs your computer to send all traffic to the proxy, expecting the proxy to take care of the responses. This is, in essence, the same job as a router. As such, if your traffic goes through a router, you can think of them as a "proxy" of sorts. Of course, that's not entirely true, but for the sake of brevity, it's close enough.

However, if you see a proxy configuration that you didn't put there, it can be a sign of compromise. It doesn't need to be to localhost, however.

How can I detect a proxy if the above things look normal?

You probably can't. If you are completely certain that no strange root certificates have been installed, then you likely are not being attacked with a Man-in-the-Middle attack. Or at least, you would know about it, as long as you use HTTPS. For plaintext communication, you have no way of knowing at all.

How can Avast use a Man-in-the-Middle Proxy to scan websites, even if I see no evidence of it?

A number of things may be possible:

  • Since you installed Avast, it may have installed a root certificate.
  • Since anti-virus software loves going really deep into the OS, it may have inserted a proxy system that every connection has to follow, even if not visible to the user.
  • Avast did indeed install a root certificate, I found it. The thing that confuses me about it is when I click on the padlock icon on different sites, it doesn't act like the MITM proxy certificates usually act. I don't see "Issued by: Avast..." on all of them. Could this still mean that they are generated locally and even the "Issued by" is copied over or spoofed? Where I could read more about proxy system implementations that are deeper than what Windows GUI sees? Not sure how to properly DDG this one. Thank you for your help. – miyagisan Aug 29 at 14:17
  • @miyagisan Can you perhaps add a screenshot to your question, showing the full certification path? – MechMK1 Aug 29 at 14:48
  • 1
    Here is a link with 3 images: imgur.com/a/hOpzyUx It shows how a popular mitmproxy.org works, that Avast did in fact install a root cert to scan HTTPS, and the last one shows certificate from this page that looks as if there is no MITM but we know that Avast should be. Confused. – miyagisan Aug 29 at 18:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.