However, if PrivDog is installed, the program will take the attacker’s self-signed certificate and will create a copy signed with its own trusted root certificate, forcing the browser to accept it. In essence, the user’s traffic would be intercepted and decrypted by the local PrivDog proxy, but PrivDog’s connection to the real site would also be intercepted and decrypted by a hacker.
Bundled
PrivDog is bundled with some products from Comodo, like Comodo Internet Security as well as its Chromodo, Dragon and IceDragon browsers. However, it seems that these products include PrivDog version 2, which lacks the HTTPS proxy functionality, and thus does not expose users to man-in-the-middle attacks.
The PrivDog version that exposes users to man-in-the-middle attacks is version 3, which is available to download as a standalone application and which supports a large number of browsers including Google Chrome, Mozilla Firefox and Internet Explorer, according to security researcher Filippo Valsorda, who’s online HTTPS test was updated to account for it.
This “potential issue” only exists in PrivDog versions 3.0.96.0 and 3.0.97.0 that have never been distributed by Comodo and are not present in the company’s browsers, a Comodo representative said Monday via e-mail.
The PrivDog team at Adtrustmedia has published a security advisory that assigns a low threat level to the vulnerability. A maximum of 6,294 users in the USA and 57,568 users globally are potentially affected by the issue and they will be updated automatically to a patched version, the team said. The new version – 3.0.105.0 – is also available for download from the company’s site.
“As long as people use this practice of ‘breaking the chain of trust’ there are bound to be some who implement it utterly wrong,” said Amichai Shulman, CTO of security firm Imperva, via e-mail. “Superfish’s mistake was using the same root certificate across all deployments. PrivDog’s mistake is not validating certificates at all.”
Some people believe that the PrivDog vulnerability is even worse than the one introduced by Superfish.
“By comparison, the Superfish ‘man-in-the-middle’ process at least requires the name of the targeted website to be inserted into the certificates alternate name field,” said Mark James, a security specialist at antivirus firm Eset. “Although Superfish allows the possibility of massive exploitation with this flaw it is still marginally better than what PrivDog is doing.”
However, it’s not just Superfish or PrivDog that open such security holes on computers. Researchers determined that the Superfish vulnerability was actually in a third party software development kit from a company called Komodia. The same SDK is used in other products as well, including parental control applications, VPN clients and software from a security vendor called Lavasoft.
IDG News Service
Ltd
