Windows Firefox 65 rollout halted by Mozilla: AV clash stopped users browsing
Users of Firefox 65, released by Mozilla last week, were immediately hit by 'Your connection is not secure' messages when visiting popular sites.
Security
The issue mostly affected Firefox 65 users running AVG or Avast antivirus. The message appeared when users visited an HTTPS website and stated the 'Certificate is not trusted because the issuer is unknown' and that 'The server might not be sending the inappropriate intermediate certificates'.
The problem, reported on Mozilla's bug report page and first spotted by Techdows, is due to the HTTPS-filtering feature in Avast and AVG antivirus. Avast owns AVG. The bug prevented users from visiting any HTTPS site with Firefox 65.
To limit the impact on users, Mozilla decided to temporarily halt all automatic updates on Windows. In the meantime, Avast, which owns AVG, released a new virus engine update that completely disabled Firefox HTTPS filtering in Avast and AVG products. HTTPS filtering remains enabled on other browsers.
HTTPS filtering by antivirus vendors is a slightly controversial feature that's designed to inspect web content for malware in encrypted HTTPS traffic, but in the process it undermines the security and privacy afforded by HTTPS.
SEE: Cybersecurity in an IoT and mobile world (ZDNet special report) | Download the report as a PDF (TechRepublic)
Avast and other antivirus firms do this by removing a site's Transport Layer Security (TLS) certificate and adding their own self-generated certificate. This certificate is signed by Avast's trusted root authority and added to the root certificate store in Windows and in major browsers.
The method used is technically a man-in-the-middle (MitM) attack, which has drawn criticism from Google, Mozilla and others for creating more security risks for users.
Avast has previously argued that its MitM technique is necessary and that its method is different to a malicious MITM.
More HTTPS certificate troubles for antivirus products could be on the way in Firefox 66, which is gaining a new feature that will detect and warn users when a third-party app is conducting an MitM attack.
A new error message, 'MOZILLA_PKIX_ERROR_MITM_DETECTED', will be displayed if Firefox detects that something on the user's system or network is intercepting the connection and injecting certificates in a way that is not trusted by Firefox. Chrome already has a similar feature.
Previous and related coverage
Firefox will soon warn users of software that performs MitM attacks
Starting with version 66, Firefox will let you know when antivirus products, malware, or your ISP are tapping into your HTTPs traffic.
Microsoft guy: Mozilla should give up on Firefox and go with Chromium too
Microsoft engineer wants Mozilla to climb down from its "philosophical ivory tower", stop making a browser that few use, and become a research organization.
Mozilla: Firefox 69 will disable Adobe Flash plugin by default
Browser makers this year will be disabling Flash with its long history of security problems.
Mozilla: Firefox will start alerting you to recently breached sites
Mozilla brings Firefox Monitor to Firefox on the desktop.
Mozilla publishes official Firefox anti-tracking policy
Mozilla devs detail what types of websites and abusive user-tracking practices they intend to block in future Firefox versions.
Google and Mozilla's message to AV and security firms: Stop trashing HTTPS
Researchers call out antivirus and security appliance vendors for dangerous SSL inspection practices.
Your best bet for tracking protection in Firefox is this one-two punch TechRepublic
Jack Wallen outlines what he believes is the ideal combination to prevent browser tracking in Firefox.
Firefox fans reject advice to join forces with Chrome CNET
Debate: Does Mozilla have more influence as a Chrome rival or ally?