Avast/AVG AntiTrack certificate bug – The vulnerability opened up PCs to browser hijacking and more

guest · Mar 10, 2020

Avast AntiTrack certificate bug allowed others to snoop on your online activities
March 10, 2020
https://www.zdnet.com/article/avast...ed-others-to-snoop-on-your-online-activities/

A vulnerability impacting Avast and AVG AntiTrack privacy software opened up user PCs to Man-in-The-Middle (MiTM) attacks, browser session hijack, and data theft.

Disclosed by David Eade on March 9, the security researcher said the security flaw, tracked as CVE-2020-8987, is a certification validation issue that affects Avast AntiTrack before 1.5.1.172 and AVG AntiTrack before 2.0.0.178.
Attackers do not need local access to trigger the vulnerability, and no special software configuration needs to be in place.
Click to expand...

The first issue has been caused by a failure to check the validity of certificates presented to end servers. In these cases, self-signed, malicious certificates may be missed, permitting attackers to launch MiTM attacks.

The second security problem outlined by the researcher is how Avast AntiTrack downgrades browser security protocols to TLS 1.0.
The third problem is a failure for AntiTrack to honor browser cipher suites or Forward Secrecy, a means to ensure session keys are not compromised.

"The consequences are hard to overstate," Eade says. "A remote attacker running a malicious proxy could capture their victim's HTTPS traffic and record credentials for later re-use. If a site needs two-factor authentication (such as a one-time password), then the attacker can still hijack a live session by cloning session cookies after the victim logs in."
Click to expand...

Avast thanked the researcher for his findings, saying that the vulnerability has now been patched in Avast AntiTrack version 1.5.1.172 and AVG AntiTrack version 2.0.0.178. The update has now been pushed out to users.
Click to expand...

Log in or Sign up

Avast/AVG AntiTrack certificate bug – The vulnerability opened up PCs to browser hijacking and more

guest Guest

Log in or Sign up

Avast/AVG AntiTrack certificate bug – The vulnerability opened up PCs to browser hijacking and more

guest Guest

Useful Searches