4 ms·
Avast installs its own kernel drivers (on windows at least) so it already has access to everything in userland without requiring a special API. The MITM part w
by Laforet 11y ago
Avast installs its own kernel drivers (on windows at least) so it already has access to everything in userland without requiring a special API.
The MITM part was probably added for performance reasons or perhaps out of sheer laziness judging from how they managed to mess up certificate validation. Although this seems to be a common issue with web filters in AV/DPI products.
It is also worth noting that certificate pinning in Chrome was deliberately weakened to accept a self signed CA certificate in order to maintain compatibility with the aforementioned corporate web filters. DropBox, in contrast, has strict pinning policies that it is essentially MITM-resistant without compromising the client first.
- mschuster91 11y ago> Avast installs its own kernel drivers (on windows at least) so it already has access to everything in userland without requiring a special API. Yeah but at the kernel level the packets are still encrypted, the encryption happens in userland. AV kernel drivers exist to prevent or harden against tampering, as well as disk access filtering.
- mentat 11y agoKernel level drivers have access to user space memory and can see the unencrypted data easily.
- mschuster91 11y agoYeah but they have to find the data first. Given that Chrome with 10 tabs easily eats 2GB of RAM, not an easy task imho.
- leereeves 11y agoAnd they'd have to be updated for every build of Chrome.
- Laforet 11y agoTrue, hence I wrote "for performance reasons or perhaps out of sheer laziness". There are better ways to handle it but they are not always the easiest.
- lazaroclapp 11y agoYou could just intercept the syscalls responsible for writing to the filesystem or executing programs, which I believe is standard AV practice. That way you have two points were you can check a file for viruses, regardless of where it comes from: when it is first written to disk and when it's loaded into memory but hasn't started executing. No need to grab it at the network level at all. It is more likely than the MiTM attack is being added in order to try to catch the traffic generated by an already installed piece of malware. Think a metamorphic trojan who talks to its command and control servers via HTTPS (maybe through a known social networking site). In such case, being able to decrypt the traffic might allow heuristic detection of a piece of malware that would normally avoid file-signature detection.
- munin 11y agoWindows doesn't allow you to "just intercept syscalls" and hasn't for about eight years.
- mschuster91 11y agoHuh? Process Monitor works just fine for me... at least for read-only interception. Don't know if blocking/rewriting syscalls works, though.
- munin 11y agoprocess monitor doesn't work by intercepting system calls, there's a specific API. it's co-operative.
- mschuster91 11y ago#TIL, thanks. I had always thought it operated like strace.
- jb613 11y agointercepting the win32 calls that make the syscall is often enough
- mentat 11y agoCryptographic data has specific signatures. It really wouldn't be that hard to find. I bet there are off the shelf solutions already. As I remember it Heartbleed key finding used this.
- ryan-c 11y ago> It is also worth noting that certificate pinning in Chrome was deliberately weakened to accept a self signed CA certificate in order to maintain compatibility with the aforementioned corporate web filters. All major browsers (including firefox) allow MitM for a user installed CA. This is not Chrome-specific.
- hueving 11y agoDo the other browsers support certificate pinning though?
- ryan-c 11y agoFirefox does. IE will eventually and it will also ignore errors caused by user install certs when it does (no, I don't have a source on this, but I am very confident that it will).
- magicalist 11y agoFirefox does. http://caniuse.com/#feat=publickeypinning http://caniuse.com/#feat=publickeypinning
- revelation 11y agoDropbox is a self-contained program, why would it use the public CA infrastructure in any case? Only negatives all around.
- giovannibajo1 11y agoBecause they might want their API to be accessible from JS (maybe through CORS) and that's only possible if you go through a CA.
- Swannie 11y agoBecause running your own CA, on the internet, with correct support for revocation, and correctly securing it, is not easy.