5 ms·

Can anyone tell me how kaspersky is injecting a script into an HTTPS site? From the screenshot in the article, there doesn't appear to be a kaspersky browser e

Can anyone tell me how kaspersky is injecting a script into an HTTPS site? From the screenshot in the article, there doesn't appear to be a kaspersky browser extension in use. I guess it would have to be a MITM of some sort. Either by installing a cert or by getting the TLS keys from the browser, I suppose?

verytrivial 7y ago
This was my immediate thought. Where is rewrite happening? All the options seems icky.
- chmod775 7y ago
  I think AV vendors used to do browser addons to provide some functionality. But since browser extensions in all popular browser are now effectively neutered versions of their former selves, they are probably resorting to stuff like this. It can be hard to even get a browser addon installed as a third party program without resorting to hacks (thanks to browsers having taken measures after the toolbar hell).
- GordonS 7y ago
  Windows AV software is notoriously "icky". Microsoft had been making a effort to push AV vendors towards more"official" means of real-time hooking, but many still use DLL injection, kernel hooking etc.
tempay 7y ago
Many antivirus applications install a local certificate authority so they can MITM HTTPS. From my experience most fail to check the original CA meaning anyone can intercept your traffic...
- vbezhenar 7y ago
  They should generate that certificate along with private key on your local machine, so it does not allow anyone else to intercept your traffic. Even seemingly harmless applications can do that. For example Blizzard Battle.net Launcher (used for all games) does that.
  - tempay 7y ago
    The issue is that you must check the external connection, i.e. <-2-> in: User <-1-> antivirus <-2-> Site If not a hostile actor can inject themselves in a way which is completely invisible to the user: User <-1-> antivirus <-2-> Hostile <-3-> Site Actually checking <-2-> is tricky but many antivirus tools don't even try.[1] [1] https://news.ycombinator.com/item?id=10727431 https://news.ycombinator.com/item?id=10727431
    - vbezhenar 7y ago
      Well, if antivirus does MITM and does not check website certificate properly, it's seriously broken. I expected that any MITM proxy properly validates server certificate.

verytrivial 7y ago

This was my immediate thought. Where is rewrite happening? All the options seems icky.

chmod775 7y ago
I think AV vendors used to do browser addons to provide some functionality. But since browser extensions in all popular browser are now effectively neutered versions of their former selves, they are probably resorting to stuff like this. It can be hard to even get a browser addon installed as a third party program without resorting to hacks (thanks to browsers having taken measures after the toolbar hell).
GordonS 7y ago
Windows AV software is notoriously "icky". Microsoft had been making a effort to push AV vendors towards more"official" means of real-time hooking, but many still use DLL injection, kernel hooking etc.

tempay 7y ago

Many antivirus applications install a local certificate authority so they can MITM HTTPS. From my experience most fail to check the original CA meaning anyone can intercept your traffic...

vbezhenar 7y ago
They should generate that certificate along with private key on your local machine, so it does not allow anyone else to intercept your traffic. Even seemingly harmless applications can do that. For example Blizzard Battle.net Launcher (used for all games) does that.
- tempay 7y ago
  The issue is that you must check the external connection, i.e. <-2-> in: User <-1-> antivirus <-2-> Site If not a hostile actor can inject themselves in a way which is completely invisible to the user: User <-1-> antivirus <-2-> Hostile <-3-> Site Actually checking <-2-> is tricky but many antivirus tools don't even try.[1] [1] https://news.ycombinator.com/item?id=10727431 https://news.ycombinator.com/item?id=10727431
  - vbezhenar 7y ago
    Well, if antivirus does MITM and does not check website certificate properly, it's seriously broken. I expected that any MITM proxy properly validates server certificate.