UPDATED 23:42 EDT / FEBRUARY 22 2015

NEWS

Comodo accused of shipping adware that’s worse than Superfish, breaks HTTPS security

privdogOnline security firm Comodo Group Inc. has been accused of shipping adware that is “worse than Superfish,” another form of adware that Lenovo was slammed for shipping with laptops February 19th.

Comodo bundles adware from AdTrustMedia called “Privdog” with its security products, including the Comodo Dragon browser, antivirus and firewall products. The company claims that Privdog is a privacy tool that “protects your privacy while browsing the web and more!,” from “malvertising” that is “undermining trust on the web.”

It does this by “only display[ing] ads from a trusted source,” according to Comodo, and in this case the only trusted source is…you guessed it, AdTrustMedia. Who owns AdTrustMedia? Well the founder of AdTrustMedia is also the CEO of  Comodo.

Users report that with the software installed, ads on all sites are automatically replaced with AdTrustMedia units in a near perfect takeover of all advertising on the given computer.

It’s extraordinarily poor form for a security company that brags on its front page that it is now “the largest trust provider in the world” (we’re not sure if this is confirmed by third party or it’s a self proclaimed title), but it gets worse than a simple case of a scumbag company pushing adware cloaked as something else.

Johannes Bock claims on his blog that Privdog does something that’s worse than Superfish: it breaks HTTPS by allowing through any sort of certificate, signed or not. In his words:

While Superfish uses the same certificate and key on all hosts PrivDog recreates a key/cert on every installation. However here comes the big flaw: PrivDog will intercept every certificate and replace it with one signed by its root key. And that means also certificates that weren’t valid in the first place. It will turn your Browser into one that just accepts every HTTPS certificate out there, whether it’s been signed by a certificate authority or not.

He goes on to note that “this makes this case especially interesting because Comodo itself is a certificate authority. It should be their job to protect HTTPS, not break it.”

It’s a very good point: how can we trust a company that talks about trust, provides HTTPS certificates, and then bundles malicious adware pretending to be a privacy tool that actually breaks HTTPs security by allowing any and every HTTPS certificate through onto a computer?

You can argue either way whether Privdog is worse than Superfish; it is worse in how it breaks HTTPS, but likewise much of the outrage around Superfish is that it came preinstalled, and that users weren’t given a choice. Either way Comodo is doing serious damage here and they need to answer the allegation at hand.


A message from John Furrier, co-founder of SiliconANGLE:

Your vote of support is important to us and it helps us keep the content FREE.

One click below supports our mission to provide free, deep, and relevant content.  

Join our community on YouTube

Join the community that includes more than 15,000 #CubeAlumni experts, including Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger, and many more luminaries and experts.

“TheCUBE is an important partner to the industry. You guys really are a part of our events and we really appreciate you coming and I know people appreciate the content you create as well” – Andy Jassy

THANK YOU