Of those three points you mentioned, none of them can be used to reliably detect a Man-in-the-Middle attack.
Checking who issues the certificate and see if it is a self-signed one installed in my own root certificate store.
All of the root certificates are self-signed. That, and the fact that they are capable of being Certificate Authorities, is what makes them a root certificate.
What you can do, however, is compare your certificate store manually with a known good certificate store. Microsoft and Apple, for instance, publish which root certificates they trust by default. If your configuration varies inexplicably, it may be a sign of compromise.
Of course, in a company environment, your IT department is very likely to have their own CA, which they deployed on your machine. So check with them if you worry about a company computer being compromised.
Checking if I am being served web content from a local IP instead of the outside server IP and if the local IP is always the same.
If you are in a home network, you don't get the content directly from the web server, but instead have it routed to you over many network nodes. Each one of those, theoretically, could change the source IP address.
Imagine your home router was compromised and would conduct a Man-in-the-Middle attack. They could, theoretically, just change the destination of your IP packets and have them end up at the attacker. Upon replying, the router could then mangle the packets back, making them look as if they came from the correct source.
Of course, this would be noticeable, since if you use HTTPS, the attacker will likely not have a valid certificate for the site, unless they also have installed a compromised root certificate on your machine.
Checking if my system proxy settings are configured to localhost.
The system proxy settings are only relevant for applications that care about them. In fact, an application can simply decide not to use the system proxy settings. This is vital, because otherwise, proxies running on
localhost would try to call themselves and end up in an endless loop.
Furthermore, a proxy configuration only instructs your computer to send all traffic to the proxy, expecting the proxy to take care of the responses. This is, in essence, the same job as a router. As such, if your traffic goes through a router, you can think of them as a "proxy" of sorts. Of course, that's not entirely true, but for the sake of brevity, it's close enough.
However, if you see a proxy configuration that you didn't put there, it can be a sign of compromise. It doesn't need to be to
How can I detect a proxy if the above things look normal?
You probably can't. If you are completely certain that no strange root certificates have been installed, then you likely are not being attacked with a Man-in-the-Middle attack. Or at least, you would know about it, as long as you use HTTPS. For plaintext communication, you have no way of knowing at all.
How can Avast use a Man-in-the-Middle Proxy to scan websites, even if I see no evidence of it?
A number of things may be possible:
- Since you installed Avast, it may have installed a root certificate.
- Since anti-virus software loves going really deep into the OS, it may have inserted a proxy system that every connection has to follow, even if not visible to the user.