2

The other day I send an email through Gmail in Firefox. Right after I clicked "Send" Avast popped up asking if I wanted to include their signature at the bottom of future emails. Surprised, I accepted and proceeded to send another email. I was shocked to see that it worked, it actually added their message "This email is virus-free".

Now, my question is, how is that possible? How can third-party software change email content I'm sending though Gmail with https encryption from Firefox?

Manuel Müller
  • 23
  • 2
  • 1
    Did you have a look at the extensions you have installed in the browser? There is probably something like [Avast Online Security browser extension](https://www.avast.com/faq.php?article=AVKB18). – Steffen Ullrich Aug 31 '17 at 10:44
  • An extension or even a program that tap on the browser can inject anything. Yes, whether a good watchdog or a trojan, this is the situation of good guy vs bad guy scenario. – mootmoot Aug 31 '17 at 11:11
  • 2
    Needless to say, an attacker can also add "This email is virus-free" to their mails. Hence, I'd recommend you consider stopping to use that feature. – Arminius Aug 31 '17 at 11:28
  • 1
    @SteffenUllrich No, I have 0 extensions installed. – Manuel Müller Aug 31 '17 at 12:06
  • 1
    @Arminius I fully agree, I just enabled it for testing, pretty useless "feature" – Manuel Müller Aug 31 '17 at 12:08
  • https://superuser.com/questions/1066611/how-does-avast-add-a-signature-into-my-webmail might help. Have you looked at the certificate chain you get in your browser when you connect to gmail? See also https://security.stackexchange.com/questions/73476/why-is-avast-web-mail-shield-root-listed-as-ca-for-google-com – Steffen Ullrich Aug 31 '17 at 12:40
  • @SteffenUllrich Thank you very much, that definitely helped. – Manuel Müller Aug 31 '17 at 13:58

1 Answers1

1

You should be aware that most of antiviruses have a full control about the flux of your Internet Browser.
FYI, they even create fake certificates, because they need to decipher the content before sending it to the browser.

Actually, when you install an anti-virus, it copies a top CA cert file into your certificates directory, so all the certificates the anti-virus will create will be accepted.

Sayardiss
  • 79
  • 3