2 July 2014

Don't use ESET SSL protocol filtering

One of my clients recently received an email from a customer complaining that the client's SSL certificate was producing warnings in their antivirus software. Obviously concerned I checked the site and it's certificate only to find everything was fine. The certificate signing chain was properly signed by a valid certificate authority and the certificate was still in date.

Probing the customer further revealed that they only saw the warning when using their home machine with ESET antivirus installed. A quick search revealed a number of users having issues with the ESET SSL protocol checking / filtering feature showing false positives and this person who saw invalid certificate errors due to an error installing the ESET root certificate authority. Wait a minute, why would you need to install a new root certificate authority? And why, when it wasn't installed, would you see invalid certificate errors on all websites using SSL?

Well, for those who haven't realised yet, ESET SSL protocol checking installs a new root certificate authority that is used to intercept all secure connections on your computer and check the contents. It completely breaks the security offered by SSL by intercepting the connection and inspecting the contents.

This means that the proprietary ESET antivirus application is performing a man in the middle (MITM) attack on you, and has the ability to view and alter the contents of any secure web pages you visit, including any passwords you enter, any personal information that travels along the connection, any applications or files you download and so on.

ESET download page

Not only that, the ESET application downloads page (and the download itself) is served over unencrypted HTTP, meaning malicious actors can easily serve up modified and/or malicious versions of the ESET application without raising suspicion.

This is a little worrying for an application that will be installed with administrator privileges on your computer.

ESET advanced settings

Anyway, back to the SSL interception. After installation, visiting the advanced settings panel shows that SSL protocol interception is turned off by default. This is a good default setting and if you have ESET installed and have never changed this setting it's safer to leave it as it is (i.e. off).

If you turn it on, it will ask for administrator access to your machine. It doesn't say what this is for, but it is so it can install it's own certificate authority in all your browsers and the operating system itself.

ESET intercepting DuckDuckGo SSL

Once the option is switched on you can see the certificate intercepting all SSL websites you visit.

This is bad because not only has the ESET application got full access to your communications, it is giving you a false sense of security as the browser will show the SSL padlock and tell you the connection is fine.

Not only that, inspecting SSL negotiation with Wireshark shows the ESET application actually downgrades your SSL connection to TLSv1.0 even if your browser and the site you are visiting would normally use the much stronger TLSv1.1 or TLSv1.2.

You may remember that TLSv1.0 is vulnerable to the BEAST attack and should generally not be used.

Chrome connecting to Google.com with ESET enabled

The screenshot above shows the latest version of Chrome connecting to Google.com with ESET SSL protocol filtering turned on.

Chrome connecting to Google.com normally

And here is the same version of Chrome connecting to Google.com without ESET filtering.

Interestingly, I thought the interception would not work on Google's Chrome browser as it implements certificate pinning. This means it performs extra checks to make sure the browser will only connect to Google sites when they use an SSL certificate that has Google's own certificate authority in it's signing chain. However, it appears that Chrome will make exceptions for certificate authorities you have installed yourself.

So, should you use ESET SSL protocol filtering? In my opinion, no. Leave it switched off. It isn't worth giving a proprietary program access to view and alter all your secure communications on the off-chance it might catch a threat occasionally. It also results in false-positives, claiming that valid certificates have issues and should not be trusted. If you want to take advantage of the part of this feature that restricts using SSLv2, then there you should use your browser settings to do this instead of using ESET.

ESET themselves advise you switch the feature off, and provide instructions here.

4 Comments

Cris
2016-08-13 07:26

Thank you, very helpfull. I found out my comodo positive ssl suddenly change after i installed esset endpoint antivirus 6, i just coudnt understand why my ssl suddenly became esset ssl filter ca. I found your article and disable the ssl function on esset av and refresh my website and voila...everything back to normal comodo positive ssl. Thanx for sharing!

Aaron Lawrence
2016-10-13 11:39

All or most home security systems do this now, and its pretty essential since a large percentage of websites are served over HTTPS. protection that didnt cover HTTPS would not be useful to a typical non-technical user.

Kou
2017-02-10 01:45

There is a interesting study about the security impact of HTTPS interception in anti virus products.

Paul
2017-03-19 10:27

Yes, in fact there have recently been many cases proving that this practice is terrible for security. Cert have produced a report showing how damaging it is: https://www.us-cert.gov/ncas/alerts/TA17-075A


More on TLS/SSL interception:


And specifically on TLS/SSL interception by AV products:


Just because they're all doing it doesn't make it right!

Post a comment

(required)

(required)

(required, not published)

(optional)