Lately a lot of attention has been payed to software like Superfish and Privdog
that intercepts TLS connections to be able to manipulate HTTPS traffic.
These programs had severe (technically different) vulnerabilities that
allowed attacks on HTTPS connections.
What these tools do is a widespread method. They install a root
certificate into the user's browser and then they perform a so-called
Man in the Middle attack. They present the user a certificate generated
on the fly and manage the connection to HTTPS servers themselves.
Superfish and Privdog did this in an obviously wrong way, Superfish by
using the same root certificate on all installations and Privdog by just
accepting every invalid certificate from web pages. What about other
software that also does MitM interception of HTTPS traffic?
Antivirus software intercepts your HTTPS traffic
Many Antivirus applications and other security products use similar
techniques to intercept HTTPS traffic. I had a closer look at three of
them: Avast, Kaspersky and ESET. Avast enables TLS interception by
default. By default Kaspersky intercepts connections to certain web
pages (e. g. banking), there is an option to enable interception by default. In ESET TLS interception is generally disabled by default and can be enabled with an option.
No comments:
Post a Comment