Advice Request Malwarebyte root certificate?

[Mystic]

Hello,

Does MB use root certificate to monitor and scan traffic in its Web protection components? In other words, does MB do man-in-the-middle to intercept traffic?

 

[n8chavez]

Hello,

Does MB use root certificate to monitor and scan traffic in its Web protection components? In other words, does MB do man-in-the-middle to intercept traffic?

Yes it does, if you have web protection enabled. If not, then no it does not. But it needs that in order to scan encrypted traffic. What do you mean by "do" MitM attacks. Can it detect them? Yes, it can. How well is a different conversation.

 

[Mystic]

Yes it does, if you have web protection enabled. If not, then no it does not. But it needs that in order to scan encrypted traffic. What do you mean by "do" MitM attacks. Can it detect them? Yes, it can. How well is a different conversation.

Now most major security vendors use a root certificate to scan encrypted connection and that can decrease security as they break encryption. It is sad to know that MB, too, does the same.

What I mean by MitM is that the way those security vendors scan the encrypted traffic is that they do this kind of attack to scan the traffic.

You any vendors who do not install root certificates?

 

[Scirious]

You any vendors who do not install root certificates?

If I'm not mistaken F-Secure doesn't install a root certificate.

 

[Mystic]

If I'm not mistaken F-Secure doesn't install a root certificate.

Yes I confirm that neither F-Secure nor Emsisoft installs a root certificate.

 

[Anthony Qian]

I don't think MB uses MITM to intercept encrypted traffic. It uses a web browser plug-in to achieve that.

Other vendors that do not use MITM to scan encrypted traffic include F-Secure, Norton, McAfee, and Microsoft.

 

[Nightwalker]

Hello,

Does MB use root certificate to monitor and scan traffic in its Web protection components? In other words, does MB do man-in-the-middle to intercept traffic?

No, it doesnt, it protects the system intercepting DNS queries, it doesnt break SSL like other solutions.

More info here:

Explained: the Malwarebytes Website Protection module | Malwarebytes Labs

Learn about the strengths and possible improvements of the Malicious Website Protection module that comes with Malwarebytes Premium.

www.malwarebytes.com

 

[Mystic]

No, it doesnt, it protects the system intercepting DNS queries, it doesnt break SSL like other solutions.

More info here:

Explained: the Malwarebytes Website Protection module | Malwarebytes Labs

Learn about the strengths and possible improvements of the Malicious Website Protection module that comes with Malwarebytes Premium.

www.malwarebytes.com

So it seems that I have got things mixed up. According to this link, MB installs a root certificate and I thought that was for Web protection.

 

[n8chavez]

Really? This says otherwise, that Malwarebytes certainly install a certificate as root. Maybe things have changed?

 

[Nightwalker]

I installed Malwarebytes Premium 4 to check and it seems it actually installs a certificate (image below), but it seems to be different from what some security solutions do like Kaspersky.

Gonna check with Pbust to see how it interfers with SSL/TLS.

I use Malwarebytes and the web filter functionality puzzles me. As far as my research has found, antivirus engines typically use a proxy to intercept web requests which typically there would be evidence in the certificate used to encrypt the connection (ie the issuer certificate), however Malwarebytes is able to intercept web requests and doesn't show a custom certificate.

This has me confused cause my research so far has shown:

1. You have to use your own CA and certificates in order to decrypt the web traffic
2. You have to add it to your system and browser's trust stores for certificates

Malwarebytes however, doesn't appear to do any of the things above and is still able to intercept both SSL and non-SSL traffic. It intercepts traffic from every program.

I am mainly wondering how they do this? Presumably they use Windows Filtering Platform in order to do this, but in what way do they use it? I'd imagine there has to be some sort of configuration change, or something of the like in order to do this?

I wasn't sure whether or not to ask this on StackOverflow since it is to do with specific software and how it works, rather than specifically with coding.

How does Malwarebytes intercept web traffic?

I use Malwarebytes and the web filter functionality puzzles me. As far as my research has found, antivirus engines typically use a proxy to intercept web requests which typically there would be evi...

security.stackexchange.com

 

[Local Host]

If I'm not mistaken F-Secure doesn't install a root certificate.

F-Secure does install root certificate unless you use Anti-Virus version hidden around the website.

 

[upnorth]

F-Secure does install root certificate unless you use Anti-Virus version hidden around the website.

I'm curious, where exactly did you find that root certificate as I personal can't?

 

[SeriousHoax]

I installed Malwarebytes Premium 4 to check and it seems it actually installs a certificate (image below), but it seems to be different from what some security solutions do like Kaspersky.

Gonna check with Pbust to see how it interfers with SSL/TLS.

How does Malwarebytes intercept web traffic?

I use Malwarebytes and the web filter functionality puzzles me. As far as my research has found, antivirus engines typically use a proxy to intercept web requests which typically there would be evi...

security.stackexchange.com

Can you try this? Make sure Kaspersky's HTTPS scanning is off (Since it seems you have it installed) and Malwarebytes web shield is on.
Now open a browser like Edge/Firefox. Open Process Explorer, right-click on the main browser process, eg: firefox.exe. (not the other child process) then go to Properties, click on Environment and check if you see anything like "SSLKEYLOGFILE".

 

[Nightwalker]

Can you try this? Make sure Kaspersky's HTTPS scanning is off (Since it seems you have it installed) and Malwarebytes web shield is on.
Now open a browser like Edge/Firefox. Open Process Explorer, right-click on the main browser process, eg: firefox.exe. (not the other child process) then go to Properties, click on Environment and check if you see anything like "SSLKEYLOGFILE".

I tried Malwarebytes with F-Secure installed and there is no "SSLKEYLOGFILE".

 

[SeriousHoax]

I tried Malwarebytes with F-Secure installed and there is no "SSLKEYLOGFILE".

Okay in that case, looks like they don't do any HTTPS scanning.