SSL error with SpiderOak

[KRLS 0]

I have the same problem as in:

Which is: when I try to create a shared file or folder (requires login) i get the following error:

 

The solution proposed in the topic didn't work for me, maybe because its 8 years old and there is another module interfering with the bypass.

I've tried this:

 

 

Disabling all ESET modules don't allow me to log in /share files, Uninstalling ESET allowed me, so its clearly ESET blocking something.

For these tests spideroak has full in/out connections permissions on the firewall.

[Marcos 5,295]

Please carry on as follows:

1. Enable advanced logging under Help and support -> Technical support
2. Reproduce the issue
3. Stop logging
4. Collect logs with ESET Log Collector and upload the generated archive here (only the ESET staff can access attachments).

 

[KRLS 0]

Logging was active while I tried to generate a shared link from windows explorer an afterwards inside the spideroak client itself.

Diagnostics.zip eis_logs.zip

[Marcos 5,295]

In the logs I see only Firefox communicating via http/https. Could you try switching to interactive mode for a while and exclude the appropriate certificate when asked?

[KRLS 0]

Nothing pops up.

I deleted firefox.exe spideroak.exe, from the rules to force it pop up just in case:

 

Attatched video as proof.

When I try to generate the link nothing pops up with and without automatic rules on the list.

 

Firewall its allways in interactive btw (you can probably see that from the logs).

 

2022-06-14 12-47-50.zip

[Marcos 5,295]

I see that you have c:\program files\spideroakone\spideroakone.exe already excluded from protocol filtering. Since it didn't help, it's probably a different process that establishes SSL communication. The application is also excluded from SSL filtering.

Does the problem actually go away if you temporarily disable protocol filtering in the advanced setup?

[KRLS 0]

My apologies Marcos.

I tested everything last week and I didn't find the time to report/ try to solve it until yesterday. What changed? Look at the dates (dd/mm/yyyy). I think this image is self explanatory in many ways.

After removing all certificates/applications from the lists, all exclusions and activated interactive mode, this popped up:

Zero conf?

Just for the search engines:

SpiderOak is using the default Kubernetes Ingress Controller Fake Certificate for SpiderOakONE in the production version of the software.

Edited June 15, 2022 by KRLS

[Marcos 5,295]

Does it work if you exclude the certificate from scanning?

[itman 1,758]

7 hours ago, KRLS said:

SpiderOak is using the default Kubernetes Ingress Controller Fake Certificate for SpiderOakONE

The certificate is expired; 6/7/2022, and as the display shows invalid.

-EDIT- Also if Microsoft Security Center SmartScreen settings are set to default values, SmartScreen will block this app from executing due to the invalid certificate.

Edited June 15, 2022 by itman

[KRLS 0]

On 6/15/2022 at 5:50 PM, itman said:

The certificate is expired; 6/7/2022, and as the display shows invalid.

That is why It was working the week before I opened the topic and then stopped working. I wasn't aware of the cert, because the solution proposed in the "old" topic I mentioned (linked) excluded spideroak.exe to be analized by ESET.

When I triggered the interactive mode then ESET prompted about the certificate and I could see what was going on.

 

On 6/15/2022 at 10:40 AM, Marcos said:

Does it work if you exclude the certificate from scanning?

No because the problem was on their side, not on "your filter" blocking something.

All this coincidentally appeared in a period where they pulled out the client for downloading...

 

Now the problem is solved and I'm looking for another cloud provider.

Sorry for pointing ESET as the source of the problem and thank you for your time.