Eset not working with VPN extensions

[User13 0]

Hi,

   When I use my adguard vpn extension in firefox the “web protection” is not working as expected.

1-      It allows to download malwares

2-      eset warning page is missing

I’ve tested that with both adguard and ivacy VPN add-ons same issue.

 

[itman 1,659]

You will have to provide specifics of malware not being blocked when a browser VPN extension is in effect. For example, Eset detects the malware w/o the extension in use, but it does not when the extension is in use.

[User13 0]

It’s been detected by real time protection not web protection.

For example:

Go to https://www.eicar.org/download-anti-malware-testfile/

Try downloading the zip EICAR when vpn active, the archive should be scanned by web protection but not the real time, the download completed without notification.

(Clear your browsing cash) repeat the above but the vpn off a notification should be appear.

This also happened for infected JS after they downloaded the real time detected them.

 

In the other point https://rank.egybest.club/tv

Alert of (Potentially unwanted content found) should ask the user if you want to ignore or go back, but not with vpn active.

[Minimalist 16]

I tested with VPN enabled (system wide VPN not extension) and web protection works OK for me.

Maybe extension is encrypting network traffic which is not decrypted by Eset, so content is scanned only after it's downloaded?

[Marcos 5,074]

Do you use Firefox as a browser? What OS?

[itman 1,659]

Here's my take on what is going on when these VPN browser extensions are used.

Eset Web protection feature monitors HTTP/HTTPS network traffic since this is the protocol used by browsers. I strongly suspect that these VPN extensions are using a different protocol to download files. One possibility is secure FTP.

Now Eset Web protection will detect and monitor port redirects from 80/443. However, I assume the original port has to be one of the aforementioned.

A network traffic monitor has to be deployed to determine exactly how these browser VPN extensions download files.

[SeriousHoax 83]

I saw Bitdefender's web protection doesn't work at all in Firefox when Windscribe extension is enabled. No issue on Chromium browsers. I told Bitdefender about it, and they had no intention to do anything about it. 

I'm wondering if these two things are similar. 

[itman 1,659]

This might be it:

• Impossible detection: AdGuard VPN tunnel uses HTTPS/2 protocol, which makes it virtually impossible to flag and block. This makes it ideal for anything from unblocking Netflix or bypassing restrictive firewalls, especially in censorship-heavy countries like China.
• Future-proofing: The company is planning a switch to HTTPS/3 and QUIC in the future for even better server communication.

https://vpnoverview.com/vpn-reviews/adguard-vpn/

I don't believe Eset supports HTTPS/2 yet? And most definitely, not HTTPS/3 and QUIC.

Edited November 9, 2022 by itman

[User13 0]

The strange thing the VPN app working fine with eset but not the extension.

I’ve also tested with Kaspersky both app and extension work.

 

@Marcos

 

Yes, I use Firefox 106, I also test the chrome 107, same result.

Windows 11 22H2 OS.

[itman 1,659]

With the Adguard VPN extension enabled, go to this web site: https://www.amtso.org/security-features-check/ and perform all the tests given there. Eset should detect on all of the tests.

The issue here might be restricted to only archive downloads.

[User13 0]

I did the test here AMTSO Security Features Check Tools - AMTSO It’s working like you said.

But here Download Anti Malware Testfile – Eicar when I disabled the real time and keep web protection sometimes eicar.com downloaded or I need to refresh the page to download.

Still eset alert page is missing and for sure web protection not working as without VPN.

[itman 1,659]

2 hours ago, User13 said:

But here Download Anti Malware Testfile – Eicar when I disabled the real time and keep web protection sometimes eicar.com downloaded

Never ever disable Eset real-time protection to perform testing.

Eset is an integrated product and uses all its all its components in various combinations in malware detection. In this case, Web access protection will interface with real-time protection for malware sigs., blacklists, etc.. Finally when you disable Eset's real-time protection, Windows Defender on Win 10/11 should immediate start up and set itself as Windows real-time protection. Eset Web access protection is designed to interface with Eset real-time protection; not WD real-time protection. Bottom line - you were actually testing WD's web access protection which in reality, doesn't exist.

Edited November 10, 2022 by itman