Governments have found a new way to spy on targets: turning online advertising into a covert route for planting surveillance software on their devices, in what researchers describe as a first-of-its-kind discovery, reports The Independent.
The technique, dubbed “adfection” by researchers at Citizen Lab, a digital rights project at the University of Toronto, exploits the automated system that runs billions of ad auctions every day across the internet.
When a user visits a website, ad space is sold to the highest bidder in a split-second process.
Attackers can hijack this system to deliver what appear to be ordinary ads but are in fact malicious code capable of installing surveillance software -- without any click from the victim, according to the report.
Because ad networks gather detailed data on users to help marketers reach their audience, the same targeting tools can be weaponised to identify and zero in on specific individuals, Citizen Lab warned.
The Toronto-based researchers said the technique was used to plant spyware on devices at Al Jazeera, the Qatari news network.
They cautioned, however, that such attacks are likely already far more widespread than the single documented case suggests, The Independent said.
Citizen Lab called on cybersecurity agencies and regulators to assess the national security risks posed by the current online advertising ecosystem, and urged IT administrators and everyday users to remain alert to the threat.
Because ad networks gather detailed data on users to help marketers reach their audience, the same targeting tools can be weaponised to identify and zero in on specific individuals, Citizen Lab warned.
The Toronto-based researchers said the technique was used to plant spyware on devices at Al Jazeera, the Qatari news network.
They cautioned, however, that such attacks are likely already far more widespread than the single documented case suggests, it added.
Citizen Lab called on cybersecurity agencies and regulators to assess the national security risks posed by the current online advertising ecosystem, and urged IT administrators and everyday users to remain alert to the threat.