How does Avast's https scanning feature work? Is it basically a MITM attack? This feature was enabled in the 2015 version released a few days back
They are using a local CA inserted into your trust store:
• HTTPS scanning Now, we are able to detect and decrypt TLS/SSL protected traffic in our Web-content filtering component. We are using our own generated certificates that are added into the Root Certificate store in Windows and also into major browsers. This feature will protect you against viruses coming through HTTPs traffic as well as adding compatibility for SPDY+HTTPS/ HTTP 2.0 traffic. You can tune/disable this feature in the settings section.
To scan arbitrary HTTPS traffic, you have to do one of the following:
You add a hook in the client SSL library so that you get the outgoing data right before it gets encrypted, and the incoming data just after it has been decrypted.
You know the server's private key (and the server does not use a "DHE" cipher suite).
You run a MitM, which implies generating a fake server certificate on-the-fly, by a CA that you control and that has been installed in the "trusted CA" store of the client.
The second solution is not feasible in general (you can do that when you control the servers, but not for all servers on the Internet). The third solution is what you do in corporations and big organizations where maintaining client-side SSL hooks is cumbersome and a huge logistics problem, while doing a one-time insert of an extra root CA is easy.
A locally installed antivirus has the choice. The "hook" option is cleaner, but is specific to a given SSL library; typically, IE and Firefox do not use the same SSL implementation at all, so if Avast uses the hook method then it must hook into both implementations. The MitM method is easier to apply system-wide, and is more resilient to software updates, but it can break some functionalities (e.g. client certificates). To know which method was applied, try to connect to various HTTPS sites, and have a look at their certificate chain; if all the chains go back to a single CA that looks Avastish, then that's the MitM method. If the chains go back to various existing root CA, then that's the hook method.