Slashdot Mirror
Advertising Tool PrivDog Compromises HTTPS Security
itwbennett writes: New cases of insecure HTTPS traffic interception are coming to light as researchers probe software programs for implementations that could enable malicious attacks. The latest software to open a man-in-the-middle hole on users' PCs is a new version of PrivDog, an advertising product with ties to security vendor Comodo. PrivDog is marketed as a solution to protect users against malicious advertising without completely blocking ads. The program is designed to replace potentially bad ads with safer ones that are reviewed by a compliance team from a company called Adtrustmedia. However, according to people who recently looked at PrivDog's HTTPS interception functionality, consumers might actually lose when it comes to their system's security if they use the product.
Don't block advertising, they deserve to earn money from their work!
Yeah, right...
Comodo, not to be confused with the similarly named Komodia from yesterday, are the world biggest issuer of SSL certificates. TLS hands trust over to a third party, and in this case that third party is Comodo.
People wonder how come NSA/GCHQ are able to intercept HTTPS connections so easily and in bulk. The answer is simple, the certificate authorities sign their keys as valid. Making ALL https sessions vulnerable to a man-in-the-middle attack.
We need to remove the whole signing process and replace it with *time*. The one thing an attacker cannot do is go back in time and change a key exchanged in the past. So we need to constantly be handing out public keys, and each and every end slot needs to store and track these public keys, warning us when they change. That way an attacker needs to man-in-the-middle *EVERY* communication, *ALL* the time, via *EVERY* route, and if they tried to use different keys per user then they'd need to perfectly identify every user. Which is impossible.
Likewise if they used one public key per site, then they'd need to identify every sysadmin for the site, who would notice their keys are intercepted. They'd need to provide uninterrupted keys for just those users.
We need to remove the certificate authorities, because they are the weak link in secure comms.
...insecure HTTPS traffic interception ... an advertising product with ties to security vendor Comodo...
Comodo is a vendor that I [currently] rely upon for my PC firewall and my SSL certificates.
.
So, on one hand, I'm looking to Comodo to help me secure my computers and usage of my computers.
And on the other hand, Comodo is looking to install HTTPS traffic interceptors on my computers that increase the security vulnerability of my computers?
What frigging kind of security company is Comodo? Is Comodo a security company at all?
Does this run on linux / FreeBSD ? i'd like to try it
also anything which allows ads are too.
Please don't dilute serious concerns with this hyperbole.
Their product is designed to replace ads... with OTHER ads, provided by themselves. And it's not hard to imagine that cash considerations are involved with making those choices.
Even if you set aside the security implications - that is pretty much exactly the sort of sleazy behavior that has gotten quite a few companies into trouble in the past.
#DeleteChrome
"The program is designed to replace potentially bad ads with safer ones" Why would anyone choose this? I mean is this an opt-in thing, or do they just force it on you? I can't imagine anyone cognitively choosing a product that replaces ads with other ads, when there are other products already on the market that replace ads with no ads instead.
Not very secure, is it? Better make that a small s
This stuff is a placebo, at best.
“He’s not deformed, he’s just drunk!”
Anyone smart enough to write an HTTPS proxy able to dynamically create and sign certs surely must have known enough about underlying technology to recognize and comprehend importance of validating trust chain. How does someone innocently "overlook" this in either design or test? Simply MUST have occurred to someone.
"Adware is malware with better lawyers"
said @axeexcess on the Twitter
It's clear advertisement companies have declared war on us, and think any and all means are permissable. No other mindset can explain these actions. If these people would not consider us enemies, they could not possibly look at themselves in a mirror.
So when will Firefox ship with ABE (or some other fork, don't use the original AdBlock, it has been sold to an advertisement company) and default to having it enabled?
I mean, aside from the hacking and privacy issues, every time I see the Internet on a browser without ad blocker, I can't believe people endure this crap.
Assorted stuff I do sometimes: Lemuria.org
Snowden of course used PGP which uses the web of trust system, it works enough to protect Greenwald and Snowden from NSA snooping.
To be fair, Snowden and Greenwald met in person and verified their key fingerprints. While useful in many situations, the WoT was not really a factor there.
Now there's a big frickin' lie ... Adtrustmedia is like "MRE" (meal ready to eat) ... it's three lies in one.
There simply is no entity involved in advertising who you should be trusting.
Assume they're all greedy sociopaths, and just save yourself the time.
This is precisely why I feel no guilt about blocking ads ... because I think the players are shady, and are sure as hell not entitled to all of the tracking information they shove into a web page.
Your average web page is like walking into WalMart and having the greeter put a dozen tags on your ear like a cow. It's just riddled with crap, cookies, tracking beacons, junk scripts, Flash, and who knows what the hell else.
A 'compliance team' is marketing speak, for marketing assholes maximizing their cut.
Lost at C:>. Found at C.
Shoot Hairyfeet is a big proponent of them and I used to use both too.
Wow.
I hope MS decertifies all Comodo certificates. I expect a big lawsuit from this and perhaps Commodo disabling Microsofts root certificates in return. Fun times.
Another lawsuit coming up.
http://saveie6.com/
So much for websites crying about AdBlock stealing food from their children's mouths.
Now AdBlock prevents shitbirds like this from benefiting from attempting to steal food from webmaster's children. Which makes it more better, right?
I would welcome AdBlock having some sort of micropayment sponsor system baked in where I could choose to support sites whose content I value. Twenty years of the web, and still nobody's figured how to make that shit work. Is Ted Nelson even still alive?
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
How about a three strikes law? They're really popular these days.
If your page causes three waves of infections, you're no longer allowed to be on the internet. Forever.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
You can change your key, but everyone is made AWARE the key has changed and you have to INFORM them why it changed and for what reason and they have to accept it or not.
Or, someone else changes the key, MITM's the site, injects a brief explanation of why the key was changed into a banner on the page (oh, but you have to accept the new key in order to see that, assuming the site uses SSL everywhere as it should) or spoofs an email with the explanation, or spoofs a social media campaign with the explanation, whatever.
Maybe they target an individual user, that user gets the spoofed email and sees the spoofed tweets, and accepts the new key. Company would never be the wiser, since no fake notices would go out publicly, and the user, well...
This would work for you, this would work for me, hell it'd work for a handful of people here, because we know to spend longer than the time it takes to click "OK" to investigate these things. The real problem with your solution is that 99.999% of users either don't know to do that, or simply don't think it's a big enough deal to warrant actually doing it. You think it'd be a better situation based on your experience with a few competent and security-minded people, but the reality is we're the minority and the situation would end up much worse as a result.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.