Scan https or not ?

[JB007]

Hello,
I read a lot about the effectiveness or the dangerousness of scanning encrypted connections but after the detection I face here Q&A - HEUR:Trojan-PSW.Script.Generic , and the conclusion of @SeriousHoax (post #36), I'm wondering if this scanning of https is simply fundamental ?

 

[oldschool]

Count my "No" vote. I didn't like it when using Bitdefender because it blocked legitimate sites. OTOH, Edge Chromium warned in the address bar about the script you encountered in the referenced thread but I'm not clear on the process that generated the alert.

Smartscreen doesn't scan HTTPS but rather lets the page load and then blocks, etc.,

 

[TairikuOkami]

So the question is: Disable SSL or not? I think, that the answer is pretty obvious. Crippling SSL and allowing MITM because ...? Not worth it in my book.

Dear Software Vendors: Please Stop Trying to Intercept Your Customers’ Encrypted Traffic

Over the past week many more details have emerged about the HTTPS-breaking Superfish software that Lenovo pre-installed on its laptops for several months. As is often the case with breaking security incidents, most of what we know has come from security engineers volunteering their time to study...

www.eff.org

It causes issues and they even had to include it in FAQ. The message is clear: The connection is not protected, since AV replaces it with its own fake certificate.

Invalid Security Certificate Error when using Kaspersky, AVAST, or other Security Apps

Overview If you use anti-virus software, you may see an error message about an invalid security certificate when you're setting up an account or when you're fetching mail from an account. The issu...

support.postbox-inc.com

Messages "Certificate verification problem detected" and "Cannot guarantee authenticity of the domain to which encrypted connection is established" when trying to open a website

Overview of settings and features available in a Kaspersky application and guides on how to use them.

support.kaspersky.com

 

[ForgottenSeer 72227]

Interesting discussion!

Count me as a No also. I am of the opinion that HTTPS was always designed to be a secure connection between you and the server with no one (good, or bad) in between. While I understand what the good guys are trying to do, it still defeats the purpose of how HTTPS was designed to work. If anything, there are plenty of examples of where this MITM scanning has caused more issues than what it's worth IMO. How many times is the solution from AV companies to disable HTTPS scanning if people are running in to browser/surfing issues? I see it quite often, which to me just proves the point that it causes more harm than it prevents.

 

[Gandalf_The_Grey]

I'm not completely sure, is there an option to vote that?
If you see how well Kaspersky is doing in protection it's user through https scanning it's tempting to say yes.
It was Kaspersky through HTTPS scanning and Netcraft by extension who blocked the skimmer script.
Now that the skimmer script is removed Kaspersky allows the site but the site is still on the blacklist of Netcraft.
In this example the approach from Kaspersky is the best.
But as general principle I'm against crippling SSL and allowing MITM.
So still not sure...

 

[blackice]

So the question is: Disable SSL or not? I think, that the answer is pretty obvious. Crippling SSL and allowing MITM because ...? Not worth it in my book.

Dear Software Vendors: Please Stop Trying to Intercept Your Customers’ Encrypted Traffic

Over the past week many more details have emerged about the HTTPS-breaking Superfish software that Lenovo pre-installed on its laptops for several months. As is often the case with breaking security incidents, most of what we know has come from security engineers volunteering their time to study...

www.eff.org

It causes issues and they even had to include it in FAQ. The message is clear: The connection is not protected, since AV replaces it with its own fake certificate.

Invalid Security Certificate Error when using Kaspersky, AVAST, or other Security Apps

Overview If you use anti-virus software, you may see an error message about an invalid security certificate when you're setting up an account or when you're fetching mail from an account. The issu...

support.postbox-inc.com

Messages "Certificate verification problem detected" and "Cannot guarantee authenticity of the domain to which encrypted connection is established" when trying to open a website

Overview of settings and features available in a Kaspersky application and guides on how to use them.

support.kaspersky.com

A lot of the critics of these security vendors don’t even know how they currently work. ESET for example flags potential MITM certificate errors. I still lean towards not using it, but I believe the threat is overblown by privacy gurus.

 

[SeriousHoax]

I share the same view as Gandalf_The_Grey. In general I'm against the principle of HTTPS scanning and allowing MITM because it's kind of security through obscurity but seeing it's advantages tempting me to accept it. So, it's tricky to simply say Yes or No on this. It's nice to have this feature but it's not a must have feature. Kaspersky, Avast, ESET, Bitdefender they're doing this for more than 4-5 years now but many other reputable AVs haven't implemented this. Norton is one of many great products which doesn't have this feature but they're doing just fine without it. Emsisoft is reluctant to ever do this. One thing to remember is that, whether your AV does SSL scanning or not, if a malware touches your hard drive it should be detected. So, in normal day to day browsing for an average user SSL scanning won't be very beneficial. In terms of security regarding SSL scanning, AVs have become better at it and the last time vulnerability regarding this was discovered in 2017 and since then nothing worrying has happened.
So, I think in general users can avoid SSL scanning by AVs but if the AV they use have this option then enabling it for online purchasing, transaction might provide a bit extra protection. But in your worst day this can actually be the total opposite but that would be extremely rare.
I think it's more important to invest in security products, extensions that are good at detecting phishing and malicious websites.

 

[TairikuOkami]

The problem is also, that AVs fails to properly implement it, obviously, since they breaking the way https is supposed to work.
For example Kaspersky 2020 still struggles and some users have to deal with webpages that fail to load properly or at all.

In terms of security regarding SSL scanning, AVs have become better at it and the last time vulnerability regarding this was discovered in 2017

This one is pretty fresh and only recently "fixed".

Kaspersky Internet Security 2019 Patch F replaced the timestamp in the links by a randomly generated GUID. This makes sure that the links aren’t predictable, so the attack no longer works. It doesn’t fully address the clickjacking scenario however, which is probably why Kaspersky Internet Security 2020 for a while stopped displaying certificate warning pages altogether. Instead, there was a message displayed outside the browser. Probably a good choice, but this change was reverted for some reason.

Interestingly, I’ve since looked at Avast/AVG products which also break up HTTPS connections. These managed to do it without replacing browser’s certificate warning pages however. Their approach: don’t touch connections with invalid certificates, let the browser reject them instead. Also, when replacing valid certificates by their own, keep certificate subject unchanged so that name mismatches will be flagged by the browser. Maybe Kaspersky could consider that approach as well?

Assorted Kaspersky vulnerabilities

More vulnerabilities in Kaspersky software: websites removing Chrome extensions, user tracking with unique identifiers and predictable links.

palant.de

Kaspersky in the Middle – what could possibly go wrong?

Despite many warnings, Kaspersky products will still snoop inside HTTPS connections. This weakens security considerably, with some fallout presented here.

palant.de

 

[bayasdev]

KIS 2020 HTTPS Scanning is broken af (go to badssl.com and check by yourself) and it makes browsing extremely slow in certain websites, so I'm against that. Also you can't install uBlock development build if FF detects a MITM.

 

[SeriousHoax]

@TairikuOkami Thanks for the links. I actually read those article at the time publishing but totally forgot. Judging from past incidents, Kaspersky has been the worst at dealing with their HTTPS scanning and also their injecting of script into web pages. Like @BlackIce mentioned above comparatively ESET has been better at this and by default they also don't do SSL scanning on some trusted sites like google, bing, etc.
@geminis I've noticed the slowdowns sometimes but I thought it's because of my internet connection or placebo effect because I was expecting some slowdowns. Thanks for the heads up. Didn't know about the badssl.com either.

 

[blackice]

@TairikuOkami Thanks for the links. I actually read those article at the time publishing but totally forgot. Judging from past incidents, Kaspersky has been the worst at dealing with their HTTPS scanning and also their injecting of script into web pages. Like @BlackIce mentioned above comparatively ESET has been better at this and by default they also don't do SSL scanning on some trusted sites like google, bing, etc.
@geminis I've noticed the slowdowns sometimes but I thought it's because of my internet connection or placebo effect because I was expecting some slowdowns. Thanks for the heads up. Didn't know about the badssl.com either.

Yeah I think ESET doesn’t scan anything with an EV Certificate.

 

[Gandalf_The_Grey]

Yeah I think ESET doesn’t scan anything with an EV Certificate.

On Kaspersky it's an option to exclude sites with an EV certificate.
However with Ziggo Safe Online / F-Secure Safe all is good on on badssl.com, but it's web protection is good but not in the same league as Kaspersky.

 

[bayasdev]

@geminis I've noticed the slowdowns sometimes but I thought it's because of my internet connection or placebo effect because I was expecting some slowdowns. Thanks for the heads up. Didn't know about the badssl.com either.

I have a 70 mbps connection, disabling HTTPS scanning makes websites load instantly. So I guess the problem was Kaspersky itself.

 

[notabot]

My view is: don't scan it, unless it's for parental control reasons (if DoH becomes the norm, it will soon be the only way to filter web traffic).

 

[fabiobr]

The problem is also, that AVs fails to properly implement it, obviously, since they breaking the way https is supposed to work.
For example Kaspersky 2020 still struggles and some users have to deal with webpages that fail to load properly or at all.

This one is pretty fresh and only recently "fixed".

Assorted Kaspersky vulnerabilities

More vulnerabilities in Kaspersky software: websites removing Chrome extensions, user tracking with unique identifiers and predictable links.

palant.de

Kaspersky in the Middle – what could possibly go wrong?

Despite many warnings, Kaspersky products will still snoop inside HTTPS connections. This weakens security considerably, with some fallout presented here.

palant.de

"2019-11-15: Evaluated the fixes and notified Kaspersky about extension uninstall being still possible to trigger via Man-in-the-Middle attack.
2019-11-22: Kaspersky notifies me about the remaining attack surface being removed in the patch supposed to become available by 2019-11-28."

They provided these patches? Is patch F (2020)? Otherwise, they're still vulnerable.

 

[ForgottenSeer 823865]

1- The problem isn't if it is required or not for increasing security (it probably does), but how it is done, and at the moment few do it properly.

2- also by allowing such feature, you put your trust on the AV vendor the same way you put your trust on a VPN.

 

[blackice]

1- The problem isn't if it is required or not for increasing security (it probably does), but how it is done, and at the moment few do it properly.

2- also by allowing such feature, you put your trust on the AV vendor the same way you put your trust on a VPN.

If you have an AV on your machine I hope to God you already trust them Https scanning or not.

 

[ForgottenSeer 823865]

If you have an AV on your machine I hope to God you already trust them Https scanning or not.

You will find it funny but many here don't trust their AVs. Some uses AVs but still add other apps on top just because "in case of"

 

[Threadripper]

Solutions like Malwarebytes and Emsisoft use DNS blocking, which is how it should be done. No software should ever MiTM HTTPS connections, there's so much that could go wrong.

 

[blackice]

Solutions like Malwarebytes and Emsisoft use DNS blocking, which is how it should be done. No software should ever MiTM HTTPS connections, there's so much that could go wrong.

The problem with DNS scanning is with DoT and DoH, it becomes very difficult for whole home or enterprise solutions to block bad sites via DNS. Such as at the router level, which is currently very easy to do but soon will not be.