Researchers at the University of Toronto have identified, for the first time, a spyware hack run simply through targeted ads—no clicking necessary.
The news: A joint report by the University of Toronto’s Citizen Lab and cybersecurity firm Confiant found that dozens of devices at Al Jazeera were compromised with mercenary spyware from Israeli spyware firm Candiru through malicious ads.
The ads themselves were purchased by Israel-based advertising company Discover-Tech, which runs a platform allowing spyware partners to identify and infect devices. The ad secretly directs the device to contact Candiru’s servers, most likely for “tracking and reconnaissance.”
The researchers said it’s the first confirmation of a “zero-click mercenary spyware attack” delivered through targeted ads, which they’re calling “AdFection.” Citizen Lab explains that the malware works by displaying ads across various platforms, from dating apps to articles on news sites, including CBC. Once a user is shown the ad, the user’s IP address is transmitted to Discover-Tech’s servers. If that user is then targeted for hacking, the device is sent malicious code that is executed by the user’s browser or app and placed onto their device, without the user ever clicking on it. The ads were shown on nearly 200,000 websites and apps in dozens of countries, the report said.
From the source: “The risk of having your device infected with spyware simply by using a website or app that displays ads is a nightmare scenario,” senior Citizen Lab researcher Wolfie Christl told WIRED.
The context: The Citizen Lab is a research unit at the University of Toronto’s Munk School of Global Affairs and Public Policy that investigates digital threats to democracy, human rights, and global security. Citizen Lab and Confiant said they shared these findings with ad vendors including Google and Beeswax, both of which removed Discover-Tech’s access to their digital ad marketplace.
Final thought: The worrying situation doesn’t stop there, the researchers said. A separate threat actor Citizen Lab is calling “Dark Cartographer” is using Discover-Tech’s infrastructure to exploit vulnerabilities across numerous mobile carriers, which will be the subject of a forthcoming report. The researchers called on cybersecurity agencies and other regulators in the US, Canada, and Europe to take action to detect and block this type of “AdFection” attack. Citizen Lab also detailed steps users can take to protect themselves, from setting up a security plan to using privacy-protecting web browsers.
Feature image courtesy Unsplash. Photo by Jonas Leupe.
The post U of T’s Citizen Lab exposes “nightmare” spyware hack that requires no clicks from users first appeared on BetaKit.