February 26, 2015 By Shane Schick 2 min read

Lenovo’s Superfish may have attracted extensive attention recently for potentially compromising PC security, but researchers say the PrivDog advertising software from Adtrustmedia demonstrates just how widespread such vulnerabilities have become.

Multiple Security Flaws

According to a warning issued by the Community Emergency Response Team, the Software Engineering Institute and Carnegie Mellon University, the PrivDog software offered by Adtrustmedia contains a flaw that could let cybercriminals bypass the certificate-based security of a connection to various websites and decrypt the traffic. The problem seems isolated to Version 3 of the advertising software, which is usually installed as a free, stand-alone application.

The concerns over PrivDog come just days after Lenovo was hit with criticism regarding its Superfish adware, preinstalled versions of which were breaking Secure Socket Layer (SSL) connectors — also known as HTTPS — on its popular desktop products.

In his blog, security researcher Hanno Böck described the risk around PrivDog as even worse. However, he acknowledged it was different because the product uses certificates signed by its root key to replace any other certificates it intercepts, whether they come from a trusted party or a cybercriminal.

Perhaps realizing the sensitivity around such threats, PrivDog has since published an advisory reassuring users that the number of those at risk is relatively low and that they will be automatically moved to a patched version.

Implications of Advertising Software Issues

Unfortunately, PrivDog may not be where this story ends. According to Ars Techinca, antivirus company Lavasoft uses similar interception technology in its Ad-Aware Web companion product.

Consumers will undoubtedly be somewhat ill at ease if they hear of these issues, particularly since they involve companies whose products are specifically intended to offer a better, safer browsing experience. In the case of PrivDog, the whole point of the advertising software is to replace potentially dangerous ads with those from more trusted sources. As PC World pointed out, many users spend time online assuming they are far more protected than they actually are, especially if their traffic is being manipulated or intercepted by those with credentials that have not been validated.

A story on Gigaom concluded that these potential threats, which are sometimes described as man-in-the-middle attacks, can be largely traced back to Komodia, an Israel-based company whose technology it described as “SSL-trashing spyware.” That may sound harsh, but all it will take is one large, well-executed data breach based on this technique for the trade-off between less-intrusive online ads and security risks to seem woefully high. Many people will likely uninstall anything remotely suspicious until the companies in question can prove they can truly fulfill their promise of a better browsing experience.

UPDATE, 3/5: This article previously referenced Comodo Group as the developer of PrivDog in error. The developer, owner and distributor of PrivDog is Adtrustmedia LLC.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today