Lenovo’s Superfish may have attracted extensive attention recently for potentially compromising PC security, but researchers say the PrivDog advertising software from Adtrustmedia demonstrates just how widespread such vulnerabilities have become.
Multiple Security Flaws
According to a warning issued by the Community Emergency Response Team, the Software Engineering Institute and Carnegie Mellon University, the PrivDog software offered by Adtrustmedia contains a flaw that could let cybercriminals bypass the certificate-based security of a connection to various websites and decrypt the traffic. The problem seems isolated to Version 3 of the advertising software, which is usually installed as a free, stand-alone application.
The concerns over PrivDog come just days after Lenovo was hit with criticism regarding its Superfish adware, preinstalled versions of which were breaking Secure Socket Layer (SSL) connectors — also known as HTTPS — on its popular desktop products.
In his blog, security researcher Hanno Böck described the risk around PrivDog as even worse. However, he acknowledged it was different because the product uses certificates signed by its root key to replace any other certificates it intercepts, whether they come from a trusted party or a cybercriminal.
Perhaps realizing the sensitivity around such threats, PrivDog has since published an advisory reassuring users that the number of those at risk is relatively low and that they will be automatically moved to a patched version.
Implications of Advertising Software Issues
Unfortunately, PrivDog may not be where this story ends. According to Ars Techinca, antivirus company Lavasoft uses similar interception technology in its Ad-Aware Web companion product.
Consumers will undoubtedly be somewhat ill at ease if they hear of these issues, particularly since they involve companies whose products are specifically intended to offer a better, safer browsing experience. In the case of PrivDog, the whole point of the advertising software is to replace potentially dangerous ads with those from more trusted sources. As PC World pointed out, many users spend time online assuming they are far more protected than they actually are, especially if their traffic is being manipulated or intercepted by those with credentials that have not been validated.
A story on Gigaom concluded that these potential threats, which are sometimes described as man-in-the-middle attacks, can be largely traced back to Komodia, an Israel-based company whose technology it described as “SSL-trashing spyware.” That may sound harsh, but all it will take is one large, well-executed data breach based on this technique for the trade-off between less-intrusive online ads and security risks to seem woefully high. Many people will likely uninstall anything remotely suspicious until the companies in question can prove they can truly fulfill their promise of a better browsing experience.
UPDATE, 3/5: This article previously referenced Comodo Group as the developer of PrivDog in error. The developer, owner and distributor of PrivDog is Adtrustmedia LLC.