SSL Comodo associated with SSL-Breaking, Ad-Hijacking "PrivDog" Malware

I was within minutes of purchasing a Comodo SSL certificate, when I just happened to come across this story which has broken over the past few days:

---

SSL-busting adware: US cyber-plod open fire on Comodo's PrivDog • The Register
Adware Privdog worse than Superfish - Hanno's blog
Lots more on Google News: https://www.google.com/search?hl=en....6.0.0.78.561.8.8.0...0.0...1ac.1.Ro4epXqyK60

Comodo's "Internet Security" software targeted for consumers prompts them to install PrivDog, which just happens to be created by Comodo CEO Melih Abdulhayaglu. As if these security issues weren't enough, PrivDog is a really offensive, ridiculous piece of software: it blocks ads on publisher's websites and replaces them with its own "trusted ads". In other words, it doesn't just block the ads that pay the bills for most Centminmod users, it hijacks them!

I know Comodo certificates are very popular, and I just want to make sure that the Centminmod community is aware of this. I want nothing to do with Comodo now, and certainly do not want to support them financially as they work to undermine my livelihood and the security of the Internet at large.

 

Comodo definitely distributes PrivDog in its security suite: Kenn White on Twitter: "@FiloSottile just confirmed: Comodo's firewall & AV (Internet Security 2014) installs Privdog by default. http://t.co/TrGbhbibng"

Regardless of whether the browser plugin was affected, PrivDog is still Comodo software: PrivDog - PD

I still can't believe a "security" company is distributing an ad-blocker which replaces ads on websites with their own banners. That is so wrong.

 

It doesn't really matter - PrivDog is Comodo's software, both the browser plugin and the standalone version.

"Blocking malicious ads" is just their pitch to get you to install it. They block all ads and then insert their own ads in their place, literally stealing ad revenue from web publishers like us - that's their business model. That thread - where people are reporting malicious ads delivered from PrivDog's own ad network - is clear proof the company has no interest in actually delivering "safe ads". They just want to get as large an install base as possible on a false premise and then leech away ad revenue like a parasite. It's disgusting.

Yes, malvertising is a huge issue that infuriates me because it's something that I've had to deal with as a web publisher for many years, but that is absolutely no justification for another company to hijack a website's source of revenue. This is borderline criminal and highly unethical; if someone were doing this to a business in the "real world", they'd be thrown in jail.

 

Yeah, they block all 3rd-party ad scripts which are not served by the site's domain, which would apply to AdSense and pretty much every other ad network out there. From the PrivDog FAQ:

Yeah, it's really unfortunate. I'm going to look at RapidSSL or GeoTrust QuickSSL now.

 

If they actually were interested in protecting users, they wouldn't be serving their own sketchy ads from "AdTrustNetwork"!

No, open-source non-profit software like AdBlock Plus just block ads. PrivDog blocks them and inserts their own ads in their place, profiting directly off the content and hard work of website owners and giving them nothing in return. That is very, very different.

 

It looks like Comodo is still up to their old tricks! Even Google had to get after them...

Google calls out Comodo's Chromodo Chrome-knockoff as insecure crapware • The Register

They also tried to bully Let's Encrypt by filing bogus trademark claims against them:
800-pound Comodo tries to trademark upstart rival’s “Let’s Encrypt” name | Ars Technica

I once again decided to avoid Comodo when renewing my certificate.

 

Yeah, I know, I went with RapidSSL (owned by GeoTrust) instead!