About 30-50% of the times I run tails in a vm my avast pops up a notice on the host complaining about some problem with a certificate. The sites, however, do not seem to exist and the url looks more or less random. This never happens when I start another vm or during my normal PC usage only when I use tails(and then also not in each case). Imho this looks quite fishy. I'm wondering how it is even possible for avast to somehow analyse the traffic from the vm. Attached is an image of the report. 
Add a comment
|
2 Answers
The Tor client uses TLS to encrypt connections between clients and relays, as well as between relays. TLS was selected primarily because it is standardised, well analysed and offers reasonable security. An added benefit however is that TLS is used in HTTPS for encrypted web browsing so Tor traffic is tricky to distinguish from HTTPS. While many networks might be happy to censor Tor traffic, they will think twice before blocking all HTTPS. For this reason, Tor's use of TLS tries to emulate HTTPS web browsing.
Just like HTTPS web servers, Tor relays need to provide a certificate. For websites this certificate would contain the site's domain name and will be generally signed by a commercial certification authority (CA), who will charge for signing this certificate. Tor relays however might not have a domain name, and there is no need for a CA to sign the certificate because the Tor directory authorities already sign the relays' public keys which in turn sign the public key in the TLS certificate.
So Tor relays generate a certificate for a random domain name (to see how, look at the code in crypto_random_hostname). This domain name will be visible to anyone scanning your network traffic (it is not encrypted), and it looks like this is what Avast is doing. You are seeing a strange domain name for the certificate and because the certificate is not signed by any CA which Avast knows about, you are getting a warning message. Avast will not however be able to look inside the encrypted traffic because it does not have access to the keys of the web browser in the VM.
So although it looks fishy, this is just your Tor client communicating as normal. Avast is confusing Tor traffic with HTTPS, but that is exactly what Tor is trying to do. HTTPS traffic where the server certificate is not signed by a well-known CA may be indicative of a man in the middle attack, but it is perfectly OK for Tor traffic to not be signed by any CA. I don't know enough about Avast to suggest how to disable this behaviour, but it is safe to ignore it.
The vm is going to exist as a directory on your host machines hdd. So I imAgine avast is somehow configured to scan it. Not sure what kind of encryption your vm has but I wonder if that's messing with the site and cert info that avast is reading and you're getting false positives?
answered Oct 13, 2013 at 19:11
-
From the error message the submitted posted, it looks like this is a result of scanning the network not the filesystem of the VM (see my answer above) Commented Oct 14, 2013 at 18:04