Please help us test a new feature on the release version of Kaspersky MR20.

[Dmitriy.Pisarets]

@harlan4096 said in Please help us test a new feature on the release version of Kaspersky MR20.:

KES 12.9 disabled

Hello! Feature is disabled as far as I know, but have no info about any plans for official releasing it.

[harlan4096]

@Dmitriy.Pisarets

I tried to enable manually again with new KES 12.9, but looks not working with this new version 🤔

This is a trick to check it:

"You can check using Process Explorer. Open Firefox/Edge/Chrome, open Process Explorer. Now in process explorer right click on the main firefox.exe (not any of the child process) and click on Properties, now go to the Environment section. Now look for SSLKEYLOGFILE. If you see it then it's doing what Avast does. If not then Kaspersky is using some other method.

Example: https://textslashplain.com/wp-content/uploads/2019/08/sslkeylogfileeb.png"

And KES 12.8 I got that Environment key in my Mozilla FireFox: https://malwaretips.com/attachments/1744304648433-png.288064/

But not now with KES 12.9 🤔

[harlan4096]

I'm testing SuperMITM with the last beta build of KPrem. 21.23, and with the current official release of KES 12.10:

https://malwaretips.com/threads/kaspersky-vpn-ksos-21-23-kes-12-11-betas.137071/post-1140870

[wbywby456456]

Is the testing still ongoing? I'm currently using KIS 21.24. The Kaspersky certificate issue persists in Firefox, but Edge browser functions normally.

[Dmitriy.Pisarets]

@wbywby456456 said in Please help us test a new feature on the release version of Kaspersky MR20.:

Is the testing still ongoing?

Hello! Are you talking about MITM feature or common beta testing?
If you have issues, you can report them with traces (or with screen recording, if it possible) here https://eap.kaspersky.com/category/1291/traffic-checking-av-web-mail

[wbywby456456]

@Dmitriy.Pisarets It is the SuperMITM feature in this post.

[harlan4096]

@wbywby456456

The testing continues, but You have to enable the SuperMITM in every beta manually, modifying the Windows Registry.

[wbywby456456]

@harlan4096
I enabled this feature through the registry, but after restarting my computer several times, I noticed that both Edge and Firefox browsers reverted to using Kaspersky's local certificate to detect encrypted traffic. My Kaspersky version is 21.24.8.522.

[harlan4096]

@wbywby456456

I have it enabled in official KES 12.12.0.522, to do so, I added the key here:

And the proof in Process Explorer -> FireFox (Environment tab in main process):

Try also re-enabling Self-Defense, after rebooting.

P.S.: another proof, the cert. of this site:

[wbywby456456]

@dmitriy.pisarets I followed the instructions in this post, but after restarting my computer several times, everything reverted back to the way it was before.I noticed that both Edge and Firefox browsers reverted to using Kaspersky's local certificate to detect encrypted traffic. My Kaspersky version is 21.24.8.522.

[harlan4096]

@wbywby456456

Please attach captures of Your Windows registry keys added...

[Dmitriy.Pisarets]

@wbywby456456 hello!
Can you please collect our traces and create a report on this forum?

steps:

1. turn on detailed traces (customer Service -> support tools)
2. set up SuperMITM feature
3. wait till it will roll back (restart your PC several times)
4. turn off traces
5. zip and upload traces to any fileshare service
6. send link to archive to me in private messages here.

You can create report here - https://eap.kaspersky.com/category/1291

Thank you in advance!

[wbywby456456]

@harlan4096
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.24\environment

[wbywby456456]

@Dmitriy.Pisarets I have sent you the attachment via private message as requested in this post. Please check your inbox.

[harlan4096]

@wbywby456456

I just created a small tutorial to enable SuperMITM in Kaspersky (Home Product), feel free to download this docx file from my personal MEGA cloud:

https://mega.nz/file/p14SwbSA#aZMwQcYkw-iALTdLeEMrivfBeaqBbybTlbHt1Q1UL6I

[wbywby456456]

@harlan4096 Thank you very much for your instruction. I will try it.

[wbywby456456]

@harlan4096 said:

SuperMITM

After adding the registry entry at HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\protected\KIS\environment and restarting, my Kaspersky mysteriously reactivated the SuperMITM feature.Thank you very much,I'll keep an eye on it to see if this function stops working after a couple of days.

[harlan4096]

@wbywby456456

Great! 👏

[harlan4096]

I think the steps in 1st post are a bit wrong, since they should say: key in ..\KIS\environment...

At 1st I also had the same issues until I found there was a 2nd \environment, and found adding there the key, it worked!

[wbywby456456]

@harlan4096 An even stranger thing happened today—after restarting my computer, I found that the SuperMITM feature in Edge had disappeared, while it still worked normally in Firefox. I'm wondering if this might be related to some browser add-on.