The ABC has wiped staff devices that were exposed to a new, sophisticated cyber attack carried out as part of a broader campaign to track and even hack into networks of some of Australia's most high-profile and sensitive organisations.
It can be revealed the ABC is among more than two dozen Australian government, critical infrastructure, universities and media organisations that researchers claim were targeted by an Israel-based company abusing the online advertising system.
The public broadcaster confirmed a "small number" of devices had been exposed but said so far it had not identified any impact from the attack discovered by researchers at The Citizen Lab.
"The ABC is aware of the Citizen Lab report that describes exposure to advertising that may contain spyware. There is no evidence of a resulting compromise," a spokesperson said.
'No evidence' ABC impacted by cyber attack
The ABC attack was part of a bigger campaign, dubbed "Adfection", revealed by Citizen researchers last week.
The Canadian-based group found evidence that company Discover-Tech exploited digital advertising technology from major platforms like those run by Google to deliver spyware that could infect devices merely by viewing an online advertisement and without clicking.
Researchers were able to confirm Discover-Tech's technique was used to infect devices at international news network Al Jazeera with spyware from another Israeli company, Candiru.
A spokesperson for the ABC confirmed that this had included the public broadcaster but had found no evidence so far of any adverse impact.
"Our review found that ads from this network were shown on a small number of ABC devices. We have found no evidence that any staff member has been identified or tracked," they said.
"For the small number of ABC devices identified, we have found no signs of compromise, and are wiping any still in service as a precaution. We take the privacy of staff and the protection of journalists' sources seriously."
New method of cyber attack exploits known risks of online advertising
Even if this infection is unsuccessful, researchers said, the same method also allowed the attackers to profile tens of millions of devices that were shown these malicious advertisements — measured by "impressions" — potentially giving information about their identities and online habits.
University of Queensland Professor Nicholas Carah, whose research focuses on digital advertising, said the attack was proof of the well-known risks about online advertising technology.
"On one level, it's horrifically surprisingly, but on another level it's like, well, yeah of course, online advertising is really useful infrastructure for doing something like this," he said.
Professor Nicholas Carah says the attack is proof of the risks about online advertising technology. (ABC News: Mark Leonardi)
Professor Carah said the report showed how bad actors could exploit existing characteristics of online advertising technology to thwart protections that were supposed to stop tracking for nefarious purposes.
"You can get an [internet protocol] address, or a mobile, then, hey, presto, you're able to identify those individuals," he said.
Greens leader and digital rights spokesperson David Shoebridge said the report's contents were alarming.
"When foreign zero-click adtech is aimed at our public broadcaster, and other sensitive government agencies, that of course raises serious questions about foreign interference," he said, adding that this shows the need for privacy reform and to include advertising in the government's proposed digital duty of care.
Australian government, critical infrastructure and media organisations targeted
While there were devices targeted across the world using Discover-Tech's techniques, Citizen Lab researchers noted a "substantial cluster of impressions in Australia, including on government and private-sector networks associated with critical infrastructure".
The researchers did not know who Discover-Lab or Candiru were carrying out the attacks on behalf of, if anyone.
The report singled out Australia's nuclear science agency, ANSTO, as being a hot spot in their data for the number of malicious ads shown. It did not specify the other organisations.
An ANSTO spokesperson told the ABC earlier this week it had not identified any impacts.
Australia's cybersecurity agency, the Australian Signals Directorate, declined to comment.
Researchers also claimed three Australian media organisations had seemingly been targets.
Media organisations and journalists are common targets for commercial spyware operations, alongside politicians, dissidents and human rights groups.
"The use of spyware against journalists is on the rise," international group Reporters Without Borders wrote late last year.
"Digital attacks often go unnoticed, so it is vital that journalists regularly check if their devices are compromised."