Is it safe to use Tor with Malwarebytes Anti-Exploit?

Question

I have Malwarebytes Anti-Exploit on my system. Is it safe to use it with Tor?

Answer 1

Alright this was going to be a comment but no one has really addressed this and it's a pet peeve of mine, so...

Generally speaking anti-virus protects you from known threats, they provide signature based, heuristic and now even sandboxed execution to try to uncover "malicious" behaviour in applications. These aren't difficult to bypass and infact there is a market in simple commercial products that can take a bit of known malware and transform it and pack it such that it will be "Fully Undetectable". (As an aside, if you want to actually improve resistance to exploitation on Windows, consider Microsofts own product "EMET" which is, in all honesty, probably better designed and engineered.)

So, the possible security issues aside, issue two is that files that it scans could potentially be fed back to the antivirus company. You are the product, their threat intelligence comes from watching their users get attacked then retroactively trying to fix it, from their EULA:

7. Privacy Policy.

By entering into this Agreement you agree to the terms of Malwarebytes' privacy policy, which can be found at https://www.malwarebytes.com/privacy/ (as may be updated from time to time, the "Privacy Policy"). More information concerning what data is collected and used by Malwarebytes and how it is used is available in the Privacy Policy. Without limiting the Privacy Policy, you agree that Malwarebytes may track certain data it obtains from your Device, including data about any malicious software, exploits or other threats flagged by the Software (including but not limited to potential sources of such threats, such as payload files, file format and recent URL's visited), data about your license, data about what version of the Software you are using and what operating conditions it runs under and data concerning your geographic location. This information is collected and used for the purpose of tracking malicious software, exploits and other threats, and evaluating and improving Malwarebytes' products and services. We may share data relating to malicious software, exploits or other threats flagged by the Software with third parties. In the event that any user who operates the Software as permitted under this Agreement (including, if you are a Malwarebytes for Business customer, your Authorized Users) makes a complaint or claim based on the tracking or collection of data in accordance with this Section 6, you agree that you are solely responsible for addressing any such complaints or claims.

So they may be watching everything you are doing on Tor Browser and recording it and sharing it with Third Parties. But who are these third parties?

From their Privacy Policy:

Governmental; Law Enforcement

We may disclose PII to government agencies, law enforcement officials, and private parties as we, in our sole discretion, believe necessary: (1) to satisfy or comply with any applicable law, regulation or legal process; (2) to respond to lawful requests, including subpoenas, warrants or court orders; (3) to protect our property, rights and safety and the rights, property and safety of third parties or the public in general; and (4) to prevent or stop activity we consider to be illegal or unethical.

So they'll sell you out to governmental agencies and law enforcement if they don't like the cut of your jib.

As a hypothetical, lets say I am some government or law enforcment agency. I want to catch you out so I embed some content into a webpage that matches a signature in a bunch of virus products, then your antivirus captures it when you visit it or I trick you into visiting it (spear-phishing). It then logs it, submits it to them and we collect who received our payload from the AV vendor. Dox'd.

Also note that, for example Trend Micro have a "Memorandum of Understanding" with the UKs National Crime Agency, about which Trend Micro say:

The NCA will not only be able to draw on the expertise of Trend Micro’s global, 1,200-strong TrendLabs team, but the power of the cloud-based Smart Protection Network, which analyses over 15TB of threat data, identifying and blocking more than 250 million threats each day.

This is likely equivalent to the "threat data" that Malwarebytes outlines in their EULA.

Is it safe to use anti-virus with Tor Browser? Only if the anti-virus vendor thinks what you're doing is "ethical" (apparently they've no sense of irony...).