3 ms·
>They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. That's the odd part of this.
by downandout 12y ago
>They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate.
That's the odd part of this. Browser plugins can modify the DOM (insert ads, change search results, etc) without proxying anything. So why do it? I wonder if they were fishing for an NSA contract to further monetize the installs.
- icebraining 12y agoThe proxy works for all browsers with a single codebase.
- pixl97 12y agoBrowser plugins are easy to wipe out. When dealing with a rather persistent malware a few months ago, it had inserted a legacy policy for a proxy in the Windows registry in a place not commonly checked by malware scanners. You turn off the proxy settings, but at every reboot it would come back and nothing seemed to catch it at the time. Malware can inject things in to the local group policy and other places that are not commonly checked, such as the root cert store, making them very likely to be missed by tech support.