Simply viewing an advertisement on a website or in an app can now infect a device with spyware. That is the finding of the Citizen Lab, a research lab at the University of Toronto, which documented an attack on millions of devices that used online advertising as its delivery channel.
According to the researchers, the operation was run by Discover-Tech, an Israeli company that presented itself as an ordinary advertising business. It bought ad space through auctions on widely used websites and apps, including Duolingo, the BBC and the New York Times. When it won an auction, it displayed an apparently harmless ad that secretly carried code able to install a backdoor on the device.
The technique has been named "AdFection", and the Citizen Lab describes it as the first publicly confirmed case of zero-click mercenary spyware delivered through targeted advertising. The spyware, developed by Candiru, could give attackers access to passwords, emails and the details of internal systems. Candiru, which now operates as Integrity Labs, is already under US export controls over its "malicious cyber activities".
The best-documented case involves Al Jazeera. The researchers traced the path from the infected ad to the first contact between the devices and Candiru's servers, and then to the files installed to hijack the computers. Seeing the ad did not guarantee infection, but it exposed the device to the exploit. The Citizen Lab says at least 45 devices were infected, with high confidence. The same ads appeared on networks belonging to numerous defence forces, cyber agencies and international organisations, including NATO.
Profiling came first. Through advertising, the company could identify devices, track their web activity and locate them, enough to reveal a person's name or employer and to choose the targets of later attacks.
Australian organisations were also hit. The Citizen Lab highlights a "substantial cluster" of impressions on government, critical infrastructure, university and media networks, including the Australian Nuclear Science and Technology Organisation (ANSTO) and its Australian Synchrotron research campus. ANSTO said it had not identified any impact on its systems. The Australian Signals Directorate declined to comment.
Google removed Discover-Tech from its platform after the researchers shared their findings, and so did the industry body IAB Europe. The case raises a broader question: how a company gained the trust of major advertising players and used them to distribute its exploit without being caught. Researcher Diarmaid Harkin of Deakin University asks who will act as a watchdog for these systems.
No comments yet. Be the first!