Tell HN: H&R Block tax software installs a TLS backdoor

153 points | by yifanlu 5 days ago

14 comments

  • minok1217 9 hours ago
    What exactly do you mean by “H&R Block Business 2025”, as such a version doesn’t exist. Is this a reference to the “H&R Block Premium & Business 2025” software? And is it the installed version, I assume, or the online version?

    Clarity really would help as Steve Gibson is flailing about wildly with this limited info and implying that all H&R Block 2025 tax software is affected

    • yifanlu 1 hour ago
      https://www.newegg.com/p/N82E16832732208

      ^ This software

      It installs two separate programs in the installer: H&R Block Premium + State 2025 and H&R Block Business 2025. The first one you can buy separately. The second can only be bought as part of a bundle like from Newegg. The only software I've tested to contain this issue is the Business version. The Premium + State one does NOT have it but I have not spent any time looking for other security issues so I cannot attest there is no other issue. I know it's confusing and that's why I've set up the website for people to easily test to see if they're vulnerable. (Also you can check the video to see both software get installed by the installer you download once you purchase the bundle.)

  • raw_anon_1111 5 days ago
    When will these companies learn?

    https://michael.team/zoom/

  • larrybud 2 days ago
    No evidence of this on my windows 11 system, but I'm running the personal HRB software, not business.

    Also, a internet search for "WK ATX ServerHost 2024" shows that this certificate is likely related to some other tax software from Walters Kluwer. See https://www.wolterskluwer.com/en/solutions/atx, https://files.cchsfs.com/doc/atx/2024/Help/Content/Both-SSou... and https://support.atxinc.com/

  • WarOnPrivacy 5 days ago

        "If you have an SSL error in your H&R Block Software, 
        here’s what you need to know."
    
    https://www.hrblock.com/tax-center/support/software/technica...
  • TheClassic 5 days ago
    I have the non-business edition installed and still get a privacy error attempting to load your page, so this seems specific to the business edition. Thanks for the heads up.
  • giantg2 3 days ago
    I'm wondering if download source matters. Seems like most are downloaded straight from their site, but curious if they still offer CDs or if sellers like Amazon have the direct installer downloads.
  • altairprime 5 days ago
    Curious: is it carrying a SHA-1 self-signature?
  • jwang987 2 days ago
    Users should not need to trust the software blindly, otherwise it's better just to use AI to file tax by yourself
  • musicale 5 days ago
    Welcome to CrapOS 26H1! We think you'll love it. Also, if you install tax software it might enable anyone to read all of your "encrypted" TLS connections regardless of what browser or app you might be using.

    Click "I AGREE" to accept this as part of our mandatory user abuse and subjugation agreement.

  • GoldenMonkey 4 days ago
    Aren't mac's more secure by default. Receive the warning using mac with h&r block 2025 installed.
    • snarkanon 4 days ago
      These stupid tax software companies' business editions seem to support only MS-Windows. No idea why, they already support macOS on other editions.

      Anyone know of any business editions available on macOS?

      • majorchord 4 days ago
        > No idea why

        Probably because business users on macs are a rounding error, no offense.

  • sloaken 5 days ago
    Thanks for the warning.
  • cochinescu 5 days ago
    [dead]