Spyware Infected Al Jazeera Devices Through Targeted Ads, Citizen Lab Finds
Zero-Click Spyware Delivered via Targeted Ads: AdFection
Citizen Lab exposes AdFection, the first technical proof of zero-click mercenary spyware delivered via targeted ads. Israeli firm Discover-Tech, posing as a legitimate ad company, used its Controlium platform to fingerprint and automatically infect devices, including those at Al Jazeera, with Candiru spyware. Analysis of four billion bidding records shows ads reached nearly 200,000 apps and websites. Google, IAB Europe, and others have cut ties.
The malicious advertisements were purchased by Discover-Tech, an Israeli company that presents itself as a legitimate advertising company, but which we found operates as a facilitator for multiple mercenary spyware partners.
- Frieren
Ads providers should be held responsible for delivering malware. All the tracking (that includes fingerprinting for clients that do not want to be tracked) should also be illegal.
How is this acceptable for society goes beyond me. And then corporations blame individuals when they get scammed. It is your fault that we have all your information and leak it everywhere, when it is not just directly sold.
And add jail time to fines. Fines means nothing for the rich.
- Postosuchus
AdTech engineer here (some 13 years in the industry). A couple of notes:
- The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.
- To the point below that "ad providers should be held responsible." There is no such thing as "ad provider." The AdTech ecosystem is teeming with different niches and business models - see the famous LUMAscapes diagrams: https://lumapartners.com/lumascapes/ . The sheer volume of traffic makes it virtually impossible to vet even a fraction of it. Google has thrown a lot of compute power to pre-scan 3p creatives and even then bad actors can sneak through. Add to this a lot of sophistication on their side (from different landing pages based on the perception of the type of user to farming throw-away advertiser accounts aimed at running just one campaign like that to hijacking legit accounts through sophisticated technical and people engineering means). In the end, politicians full of indignation do what politicians always do - sue or fine Google and call it a victory, whereas the true bad actors just keep going.
- Ozzie_osman
Obviously not the first time an Israeli tech firm is responsible for these types of exploits, and at this point I'd go so far as saying that any Israeli-based tech company (especially cyber security ones, of which they have a strong industry) should be considered beholden to the government of Israel and hence, probably not trustworthy. How could you be sure whether they will act like a trustworthy independent entity, or compromise your data for the benefit of the state?
- ferguess_k
My question is, why is Israel so good at this? It seems to be at least the 4th cyber power of the world, after the US, Russia and China, if not actually on par or better.
I guess it is because it has been under the threat of larger enemies from its birth, so it must leverage whatever it has to survive. And once you grow an organization and let it loose, you don't have much control over it anymore, and it grows in the wild like a flower.
- bawolff
So reading the article, it feels a bit confusing what zero click exploit they are talking about. It sounds like they are talking about CVE-2021-21166, but if they really are talking about an exploit from 5 years ago, i feel like their intro paragraph is rather misleading.
- throw0101c
Actual report from Citizen Lab:
* https://citizenlab.ca/research/how-discover-tech-turned-targ...
- karim79
Y'all will be shocked at how much of the VPN space is owned/controlled by Israel.
- squidmaster
Israel has been a nexus of cybercrime for as long as they've been on the internet at all.
- bhouston
It is standard that companies within a country act in the interests of its security services. Israel has a lot of ad-tech companies and thus it makes sense that they are roped into serving Israel's security services.
It is no different that Israel's location tracking of StarLink terminals worldwide: https://www.newarab.com/news/israel-tech-firms-can-locate-an...
This is the same issue that the US government has with Chinese networking companies, it is too easy for the Chinese government to pressure these Chinese networking companies to put in back doors in the interests of national security. The US likely knows this because it pressures its own companies in similar ways.
- andunie
Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.
Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.