February 26, 2015 By Shane Schick 2 min read

Lenovo’s Superfish may have attracted extensive attention recently for potentially compromising PC security, but researchers say the PrivDog advertising software from Adtrustmedia demonstrates just how widespread such vulnerabilities have become.

Multiple Security Flaws

According to a warning issued by the Community Emergency Response Team, the Software Engineering Institute and Carnegie Mellon University, the PrivDog software offered by Adtrustmedia contains a flaw that could let cybercriminals bypass the certificate-based security of a connection to various websites and decrypt the traffic. The problem seems isolated to Version 3 of the advertising software, which is usually installed as a free, stand-alone application.

The concerns over PrivDog come just days after Lenovo was hit with criticism regarding its Superfish adware, preinstalled versions of which were breaking Secure Socket Layer (SSL) connectors — also known as HTTPS — on its popular desktop products.

In his blog, security researcher Hanno Böck described the risk around PrivDog as even worse. However, he acknowledged it was different because the product uses certificates signed by its root key to replace any other certificates it intercepts, whether they come from a trusted party or a cybercriminal.

Perhaps realizing the sensitivity around such threats, PrivDog has since published an advisory reassuring users that the number of those at risk is relatively low and that they will be automatically moved to a patched version.

Implications of Advertising Software Issues

Unfortunately, PrivDog may not be where this story ends. According to Ars Techinca, antivirus company Lavasoft uses similar interception technology in its Ad-Aware Web companion product.

Consumers will undoubtedly be somewhat ill at ease if they hear of these issues, particularly since they involve companies whose products are specifically intended to offer a better, safer browsing experience. In the case of PrivDog, the whole point of the advertising software is to replace potentially dangerous ads with those from more trusted sources. As PC World pointed out, many users spend time online assuming they are far more protected than they actually are, especially if their traffic is being manipulated or intercepted by those with credentials that have not been validated.

A story on Gigaom concluded that these potential threats, which are sometimes described as man-in-the-middle attacks, can be largely traced back to Komodia, an Israel-based company whose technology it described as “SSL-trashing spyware.” That may sound harsh, but all it will take is one large, well-executed data breach based on this technique for the trade-off between less-intrusive online ads and security risks to seem woefully high. Many people will likely uninstall anything remotely suspicious until the companies in question can prove they can truly fulfill their promise of a better browsing experience.

UPDATE, 3/5: This article previously referenced Comodo Group as the developer of PrivDog in error. The developer, owner and distributor of PrivDog is Adtrustmedia LLC.

More from

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today