Kaspersky and MalwareTips

[SeriousHoax]

I have already decided to ditch Kaspersky and to revert back to Microsoft defender.
Only Avast-AVG can scan https and QUIC without inserting their certificate.

Kaspersky was experimenting with the same method used by Avast-AVG in their last beta but didn't push this change to the final version. Maybe they'll test again in the next beta.
I asked ESET if they would consider the same method and Marcos from ESET forum told me,

There has already been an internal discussion about this, and the cons substantially outweigh the benefits. We've also tested one of the mentioned AVs, and as we assumed, a malicious connection was not blocked, just reported while with ESET, it would have been blocked. This topic is still open, and if there is a way to perform SSL filtering differently without any negative effects on security, we will definitely consider it.

I don't know how much truth is in that but I'm pretty sure that there must be some considerable downsides. Otherwise, everyone else would've opted for that method a long time ago.

 

[Parkinsond]

But this particular thing is not a good reason to drop Bitdefender tbh because it can still block malicious connections. So, skipping decryption of traffic on those websites is not an issue.

How it is possible to block malicious connections without scanning encrypted https traffic?

 

[SeriousHoax]

How it is possible to block malicious connections without scanning encrypted https traffic?

The process of decrypting secured HTTPS traffic to scan the whole content loaded by a website is known as HTTPS/SSL scanning by AV vendors. Even without decryption, any attempt to visit a known malicious/phishing host can still be blocked by those AVs.
Decryption is mainly useful if a compromised websites HTML contains malicious code which you can't see without the AV being the Man in the Middle. But I'm sure most websites you visit regularly are not compromised with malware. So, it's not the most useful feature in most situations and can be disabled if you're not a super-risky user. Disabling it also increases browsing speed.

 

[Minimalist]

This is correct and this is something Bitdefender also do. Even in some pirated sports streaming sites that I often visit are not SSL scanned because of this reason.
BTW, ESET does HTTPS scanning on MalwareTips for me on MS Edge but doesn't do on Firefox.
For Edge, if I clean cookies, cache, reopen the browser and visit MT then on first visit HTTPS scanning is not performed but for all subsequent visits there is always ESET's certificate on Edge. This exact behavior at least on Edge is not new. I have been seeing this for many years.
On Firefox the QUIC version of MT is loaded while on Edge it's TLS 1.3 (excluding first visit). In Chromium browsers, using self-signing certificate to filter QUIC traffic is not allowed yet, so it has to be either forced to load TLS 1.3 or no HTTPS scanning on the site. On Firefox, filtering QUIC with self-signing certificate is allowed. Maybe this is where the difference is coming from. But I can't tell for sure why.
Kaspersky cannot filter QUIC at all, so they force downgrade everything to TLS 1.3 on all browsers.

I've made some additional tests and disabled QUIC in Firefox and disabled whitelisting and now all websites have their conneection decrypted by ESET. So it seems that it doesn't handle that protocol the same way as TLS. Although they have option to disable/enable HTTP/3 traffic scanning.

 

[Parkinsond]

I've made some additional tests and disabled QUIC in Firefox and disabled whitelisting and now all websites have their conneection decrypted by ESET. So it seems that it doesn't handle that protocol the same way as TLS. Although they have option to disable/enable HTTP/3 traffic scanning.

Only Avast-AVG can handle QUIC

 

[Minimalist]

The process of decrypting secured HTTPS traffic to scan the whole content loaded by a website is known as HTTPS/SSL scanning by AV vendors. Even without decryption, any attempt to visit a known malicious/phishing host can still be blocked by those AVs.
Decryption is mainly useful if a compromised websites HTML contains malicious code which you can't see without the AV being the Man in the Middle. But I'm sure most websites you visit regularly are not compromised with malware. So, it's not the most useful feature in most situations and can be disabled if you're not a super-risky user. Disabling it also increases browsing speed.

That's true and it can (probably slightly) affect protection at least for ESET.
If I have traffic scanning enabled it can find some "suspicious" website objects that are not "detected" if scanning is disabled. One such example is on their welivesecurity website as shown below. Files are sent for analysis only if traffic scanning is enabled. ( I know that those are harmless: probably just configuration files posted in text that trigger that behaviour).

 

[SeriousHoax]

I've made some additional tests and disabled QUIC in Firefox and disabled whitelisting and now all websites have their conneection decrypted by ESET. So it seems that it doesn't handle that protocol the same way as TLS. Although they have option to disable/enable HTTP/3 traffic scanning.

Good find. Only ESET would know the exact reason.

Only Avast-AVG can handle QUIC

ESET added QUIC filtering support last year.

 

[SeriousHoax]

That's true and it can (probably slightly) affect protection at least for ESET.
If I have traffic scanning enabled it can find some "suspicious" website objects that are not "detected" if scanning is disabled. One such example is on their welivesecurity website as hown below. Files are sent for analysis only if traffic scanning is enabled. ( I know that those are harmless: probably just configuration files posted in text that trigger that behaviour).

View attachment 288450

Yeah, true. This happens sometimes. It happens most of the time when I update something in my GitHub and if I open those in raw format then ESET sends them to LiveGrid.

 

[Parkinsond]

Good find. Only ESET would know the exact reason.

ESET added QUIC filtering support last year.
View attachment 288451

Do ESET scan QUIC without inserting their certificate like AVAST?

 

[SeriousHoax]

Do ESET scan QUIC without inserting their certificate like AVAST?

No. I already shared their response regarding this in a comment above

https://malwaretips.com/threads/kaspersky-and-MalwareTips.135734/post-1124828

 

[Szellem]

No. I already shared their response regarding this in a comment above

https://malwaretips.com/threads/kaspersky-and-MalwareTips.135734/post-1124828

So you are using ESET? If so, why?

 

[Parkinsond]

Tried to add exclusion of Facebook, Twitter, Youtube and others.
It worked for all, but Youtube.
Kaspersky behavior regarding encrypted connection scan is a little bit inconsistent.