19 ms·
Kaspersky: SSL interception differentiates certificates with a 32bit hash
- TempleOS 10y agoI get a random number and use it to select a random page in a book. God controls random numbers and will speak if you hold up your end of the conversation with delightful witty charming conversation. You knwo it is God. I know it is God. You are fighting God. I am amused. Yer fucked, obviously.
- staticassertion 10y agoAV = Trashfire. If there were actual repercussions for writing code irresponsibly, even their billions in revenue wouldn't keep them from bankruptcy. Time and time again we see these ridiculous vulnerabilities but nothing changes. AV insists on massively increasing system attack surface under the guise of security.
- PaulHoule 10y agoTo be fair, Kaspersky has always been less bad than the others.
- to3m 10y agoI've found this too. I've been using Kaspersky for a few years (most of the contracts I've had for contract work have specified they want an AV program running), and I have to say it's been much less painful than the McAfee and Norton shit I used as a FTE. If anything, it seems to go nuts a bit less often than the Windows 10 AV, which will quite often sit there occupying 100% of 1 core for a while... though Kaspersky is so invasive that (even ignoring issues like the one the link...) I'm still happier without it.
- astrodust 10y agoIt's security theatre for your computer. It's truly astonishing how little these programs do and how much they do wrong.
- pgrote 10y agoSo what should a non-technical Windows user use on a daily basis to protect their PCs?
- tptacek 10y agoMicrosoft's own antivirus.
- staticassertion 10y agoIf you want an AV, MSE has the lowest attack surface impact. It has always been good at implementing security mitigation techniques (whereas other vendors are atrocious here) and it's not very invasive. For security as a whole, I would suggest a good adblocker, keeping your system up to date, keeping your browser and plugins up to date, and I'd suggest Chrome although maybe that's controversial.
- dEnigma 10y agoWhenever I set up a Windows PC for a family member or non-technical friend, I just make sure Windows Defender is running, set everything that is installed to auto-update and install an adblocker. Also, I check every once in a while if the auto-updates are working correctly because in my experience they will inevitably and inexplicably stop working at some point :)
- therein 10y ago> I check every once in a while if the auto-updates are working correctly because in my experience they will inevitably and inexplicably stop working at some point I think Windows 10 tries REALLY hard to make sure that doesn't happen.
- dom0 10y agoBesides the obvious badness of the overall system described, things like > The cache is a binary tree, and as new leaf certificates and keys are generated, they're inserted using the first 32 bits of MD5(serialNumber||issuer) as the key. You know. That's not a mistake. That's what a consciously designed-in vulnerability to enable taking over the system looks like.
- jamesrom 10y agoAlmost certainly. Kaspersky are a global cybersecurity provider. There is no room for Hanlon's razor here. This was malice, not stupidity.
- tptacek 10y agoNobody who has done software security work for the security product industry agrees with you. For a variety of reasons, these products are typically several degrees worse than the median technology product.
- astrodust 10y agoA briefcase full of cash could easily get a "bug" like this introduced into a security package. I'm not saying this is the case, but given the current climate, it's hard to say it isn't.
- tptacek 10y agoYou can say that about any kind of product that everyone deploys. All software has bugs, most bugs are exploitable. So, no, it's easy to say that it isn't.
- astrodust 10y agoThis bug is so shockingly stupid you have to wonder if it's malice or staggering incompetence, so either we must admit that Kapersky has no business staying in business, or they're willing to overlook little "mistakes" like this.
- itissid 10y agoTrying to understand this: Is it that Kasperkey thinks its certs are more secure? Which I suppose would be the whole point behind this WPF driver?
- idlewords 10y agoIt wants to look at the contents of every connection in order to hunt for malware.
- gertef 10y agosort of like following ones own footprints.
- scott_s 10y agoNo, my understanding was in order to inspect network traffic for malware, it's essentially doing a man-in-the-middle using its own certificates.
- okdana 10y agoI'm not familiar with WFP (or Windows in general really), so i can't comment on the use of that particular technology, but the fundamental idea here is to man-in-the-middle the user's TLS connections so that the product can inspect or manipulate the data within. Presumably in this case it's for anti-virus purposes, but the same technology is used by schools and businesses to filter pornography, piracy, gaming, phishing, and other 'undesirable' Web sites, to shape bandwidth, and to log Web activity. The firewall/software generates a root certificate so that it can sign and serve 'fake' leaf (site) certificates on the fly. Because the root certificate is self-signed, however, most browsers/whatever won't automatically trust it, which is why the user/admin has to add the root certificate to each affected machine's browser or OS certificate trust store.
- grandalf 10y agoI wonder why nobody assumes Kaspersky might be working at the direction of Putin.
- gizmodo59 10y agoNot sure if this is sarcasm, but its not adding much to the discussion IMHO.
- grandalf 10y agoIt wasn't, but I am apparently naive.
- tptacek 10y agoKaspersky's connections with the Russian government are discussed all the time in the industry.
- grandalf 10y agoThere would seem to be significant benefits to maintaining a white hat presence while gaining access to thousands of machines and maintaining a body knowledge about the latest threats/techniques. Do you have any thoughts on the validity of the speculation?
- gertef 10y agoNo idea if Kapersky is a black hat in white haberdashery, but the behavior you describe is 100% Kremlin modus operandi. That's how they do propaganda too -- a bunch of real news with some fake news mixed in. It's a good idea for any propaganda outfit.
- staticassertion 10y agoPeople have been assuming this for years.
- supergirl 10y agoContrary to what the west media wants you to think, not every russian in the world is working for putin to fulfil his evil masterplan
- nxc18 10y agoI don't understand how these antivirus vendors are still in business. Even when they do have marginally better detection rates than the built in solution, the licensing, annoying popups, system slowdown, and security-defeating 'features' make them a losing proposition. Pre-bundled and even purchased AV is so dramatically deleterious to PC performance that MS should kill it as public service. It gives the entire ecosystem a bad reputation and nowadays is completely unnecessary.
- Nadya 10y agoAntivirus are just another attack vector - and due to their often escalated privileges running on a machine, they are a very attractive attack vector. Not to mention the pitiful detection rate (<50%~ for nearly any antivirus software) makes them nearly useless: once you're pwned, you're pwned.
- btown 10y ago"Microsoft takes its users' security seriously, and it recognizes that third-party antivirus vendors can exacerbate the problem by providing additional vulnerabilities that can be exploited by attackers. Ironically, non-Microsoft software you buy to keep you safe can make you even more vulnerable. To mitigate this, Microsoft is launching a site for white hat penetration testers to report vulnerabilities in antivirus software to a Windows security team, as well as the antivirus vendor itself. If no fix is pushed within 10 business days by the vendor, or a shorter period (at the discretion of the security team) for high-impact vulnerabilities, a subsequent update to Windows Defender will mark that antivirus vendor as insecure, and will provide users the option to disable or uninstall the antivirus software. Vendors requiring additional time to push fixes (for vulnerabilities which have not been exploited in the wild) may purchase a limited reprieve from Microsoft, revenue from which will be used to justify and support this service, as well as to incentivize vulnerability reporters." Bam.
- tedunangst 10y agoBut muh antitrust!
- tptacek 10y agoAn even dumber TLS bug in the same software: https://bugs.chromium.org/p/project-zero/issues/detail?id=989 https://bugs.chromium.org/p/project-zero/issues/detail?id=98...
- mixedbit 10y agoThis puts in perspective the Eugene Kaspersky's recent rant about Microsoft making AV vendors life harder: https://eugene.kaspersky.com/2016/11/10/thats-it-ive-had-enough/ https://eugene.kaspersky.com/2016/11/10/thats-it-ive-had-eno... Maybe Microsoft is actually improving the Windows users experience. Discussion on HN: https://news.ycombinator.com/item?id=12929230 https://news.ycombinator.com/item?id=12929230
- Analemma_ 10y agoThere's no "maybe" about it: there are a lot of security professionals, including ones with no great love for Microsoft and their past anticompetitive practices, who are longing for the day when MS announces that third-party AV software is malware and takes action accordingly. I for one would be spitting on their grave if and when it happens.
- currysausage 10y agoIs there a convenient way to check whether your Windows 10 and Firefox certificate stores contain anything that Microsoft and Mozilla didn't suppose to be there?
- Crosseye_Jack 10y agoRCC from https://www.trustprobe.com/fs1/apps.html https://www.trustprobe.com/fs1/apps.html does iirc. It's been a while since I've used the tool and I'm not on my PC to check.
- currysausage 10y agoThat's exactly what I had been looking for. Thank you so much!
- winteriscoming 10y agoJust yesterday I had posted a similar thread where an AV was MITMing traffic between the browser https://news.ycombinator.com/item?id=13307096 https://news.ycombinator.com/item?id=13307096. I'm still curious why this practice is allowed and these CAs are still trusted by browsers and such.
- fencepost 10y agoBecause the AV is doing it to check for malicious content being downloaded via a secure connection - content that may be exploiting security holes that have not been patched yet, or which have been patched but the user hasn't updated. It's not at all uncommon for me to be asked to look at a PC and find it has an old version of Firefox and the only user is running as a non-admin, or even more commonly to find all those nice little buttons in the system tray advising about updates to Adobe Reader, Java, and maybe a few drivers. Many things that would take advantage of those would need to be written to disk and the AV could presumably catch them then, but how about JavaScript exploits? And how does the browser respond to writing things to disk (presumably having exclusive write access) then losing access to them? There's a juggling act going on there, and I suspect it's a lot easier for an AV vendor to capture and review the network traffic as a single point of contact rather than trying to work with multiple browser and other software vendors to make sure that their software interoperates correctly with the AV.
- alarak 10y agoSomething similar is done by my organisation with the firewall(Fortinet/Fortiguard). We are forced to install a certificate as a trusted authority in the system store. So as the link says if we check the issuer it shows issued by FortiGate CA. This is very annoying and needs to stop.