February 26, 2015 By Shane Schick 2 min read

Lenovo’s Superfish may have attracted extensive attention recently for potentially compromising PC security, but researchers say the PrivDog advertising software from Adtrustmedia demonstrates just how widespread such vulnerabilities have become.

Multiple Security Flaws

According to a warning issued by the Community Emergency Response Team, the Software Engineering Institute and Carnegie Mellon University, the PrivDog software offered by Adtrustmedia contains a flaw that could let cybercriminals bypass the certificate-based security of a connection to various websites and decrypt the traffic. The problem seems isolated to Version 3 of the advertising software, which is usually installed as a free, stand-alone application.

The concerns over PrivDog come just days after Lenovo was hit with criticism regarding its Superfish adware, preinstalled versions of which were breaking Secure Socket Layer (SSL) connectors — also known as HTTPS — on its popular desktop products.

In his blog, security researcher Hanno Böck described the risk around PrivDog as even worse. However, he acknowledged it was different because the product uses certificates signed by its root key to replace any other certificates it intercepts, whether they come from a trusted party or a cybercriminal.

Perhaps realizing the sensitivity around such threats, PrivDog has since published an advisory reassuring users that the number of those at risk is relatively low and that they will be automatically moved to a patched version.

Implications of Advertising Software Issues

Unfortunately, PrivDog may not be where this story ends. According to Ars Techinca, antivirus company Lavasoft uses similar interception technology in its Ad-Aware Web companion product.

Consumers will undoubtedly be somewhat ill at ease if they hear of these issues, particularly since they involve companies whose products are specifically intended to offer a better, safer browsing experience. In the case of PrivDog, the whole point of the advertising software is to replace potentially dangerous ads with those from more trusted sources. As PC World pointed out, many users spend time online assuming they are far more protected than they actually are, especially if their traffic is being manipulated or intercepted by those with credentials that have not been validated.

A story on Gigaom concluded that these potential threats, which are sometimes described as man-in-the-middle attacks, can be largely traced back to Komodia, an Israel-based company whose technology it described as “SSL-trashing spyware.” That may sound harsh, but all it will take is one large, well-executed data breach based on this technique for the trade-off between less-intrusive online ads and security risks to seem woefully high. Many people will likely uninstall anything remotely suspicious until the companies in question can prove they can truly fulfill their promise of a better browsing experience.

UPDATE, 3/5: This article previously referenced Comodo Group as the developer of PrivDog in error. The developer, owner and distributor of PrivDog is Adtrustmedia LLC.

More from

When you shouldn’t patch: Managing your risk factors

4 min read - Look at any article with advice about best practices for cybersecurity, and about third or fourth on that list, you’ll find something about applying patches and updates quickly and regularly. Patching for known vulnerabilities is about as standard as it gets for good cybersecurity hygiene, right up there with using multi-factor authentication and thinking before you click on links in emails from unknown senders.So imagine my surprise when attending Qualys QSC24 in San Diego to hear a number of conference…

The straight and narrow — How to keep ML and AI training on track

3 min read - Artificial intelligence (AI) and machine learning (ML) have entered the enterprise environment.According to the IBM AI in Action 2024 Report, two broad groups are onboarding AI: Leaders and learners. Leaders are seeing quantifiable results, with two-thirds reporting 25% (or greater) boosts to revenue growth. Learners, meanwhile, say they're following an AI roadmap (72%), but just 40% say their C-suite fully understands the value of AI investment.One thing they have in common? Challenges with data security. Despite their success with AI…

Reducing ransomware recovery costs in education

4 min read - 2024 continued the trend of ransomware attacks in the education sector making headlines. The year opened with Freehold Township School District in New Jersey canceling classes due to a ransomware attack. Students at New Mexico Highlands University missed classes for several days while employees experienced disruption of their paychecks after a ransomware attack. The attack on the Alabama Department of Education served as a reminder that all school systems are vulnerable.Ransomware attacks in education decreasingThe year closes with some positive news…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today