How does Avast's https scanning feature work? Is it basically a MITM attack? This feature was enabled in the 2015 version released a few days back

  • 1
    Without having tested it, I'd surmise it's a proxy, not an MiTM. – KnightOfNi Nov 7 '14 at 20:29
  • In case you don't want Avast to be able to see HTTPS content, you may disable this feature by going to Settings -> Active Protection -> Web Shield -> Customize -> Enable HTTP Scanning. – Juanal Apr 14 '15 at 1:41
  • I think this feature is useful when accessing less-trusted pages that use HTTPS. However, when this Avast feature is on you go to pages like PayPal: a) browsers indicate that the identity of the site couldn't be validated - this is due to the presence of Avast's certificate in the certificate path and b) Avast will be able to inspect that content - it depends on how you feel about that – Juanal Apr 14 '15 at 1:46
up vote 6 down vote accepted

They are using a local CA inserted into your trust store:

• HTTPS scanning Now, we are able to detect and decrypt TLS/SSL protected traffic in our Web-content filtering component. We are using our own generated certificates that are added into the Root Certificate store in Windows and also into major browsers. This feature will protect you against viruses coming through HTTPs traffic as well as adding compatibility for SPDY+HTTPS/ HTTP 2.0 traffic. You can tune/disable this feature in the settings section.

https://forum.avast.com/index.php?topic=156508.0

  • 3
    ...do they generate the certificates on the fly (implying there's a 'root' certificate in every installation) or a single wildcard certificate for every website? And for pre-registered HSTS? What can possibly go wrong?! (OMG!) – symcbean Nov 8 '14 at 1:03
  • @symcbean I guess they will be generating a CA cert on each computer they are installed, and child ones for each website. I suspect a worldwide-wildcard would have an higher risk of being rejected. Browsers do not seem to enforce HSTS when the root CA is locally trusted (in order to support deep packet injection at companies). Avast will surely also reconfigure the browsers when needed for supporting that feature. – Ángel Nov 8 '14 at 1:10
  • As far as I can see right now, every site has its own certificate. It shows up as each certificate has been issued by Avast. The Validity of the certificate matches the actual certificates validity. – jogabonito Nov 8 '14 at 9:13
  • 1
    oh, what could go wrong? – Umur Kontacı Nov 8 '14 at 14:49

To scan arbitrary HTTPS traffic, you have to do one of the following:

  1. You add a hook in the client SSL library so that you get the outgoing data right before it gets encrypted, and the incoming data just after it has been decrypted.

  2. You know the server's private key (and the server does not use a "DHE" cipher suite).

  3. You run a MitM, which implies generating a fake server certificate on-the-fly, by a CA that you control and that has been installed in the "trusted CA" store of the client.

The second solution is not feasible in general (you can do that when you control the servers, but not for all servers on the Internet). The third solution is what you do in corporations and big organizations where maintaining client-side SSL hooks is cumbersome and a huge logistics problem, while doing a one-time insert of an extra root CA is easy.

A locally installed antivirus has the choice. The "hook" option is cleaner, but is specific to a given SSL library; typically, IE and Firefox do not use the same SSL implementation at all, so if Avast uses the hook method then it must hook into both implementations. The MitM method is easier to apply system-wide, and is more resilient to software updates, but it can break some functionalities (e.g. client certificates). To know which method was applied, try to connect to various HTTPS sites, and have a look at their certificate chain; if all the chains go back to a single CA that looks Avastish, then that's the MitM method. If the chains go back to various existing root CA, then that's the hook method.

  • They are using using the Avast CA approach. All the sites I see are now verified by avast Web/Mail shield – jogabonito Nov 8 '14 at 4:37
  • what happens with certificate pinning? – that guy from over there Nov 9 '14 at 10:20
  • A tool that does a MitM can remove the Public-Key-Pins headers to prevent pinning from happening, or, alternatively, register its own fake certificates as pins. However, it can be expected that things will break for servers for which pinning was active before installation of Avast. Conceptually, Avast could try to empty the current cache of pinned keys upon installation (or deactivate pinning altogether), but I am not sure there is an API for that; I don't know if Avast bothers doing it. – Tom Leek Nov 9 '14 at 14:04

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.