Zero-click spyware threat: How everyday ads could put users at risk
Israeli firm used Google and Comcast ad networks to spy on users
In a major update, an Israeli company, DiscoverTech, has been involved in secretly helping spyware developers place their hacking software on popular websites.
The findings published by Citizen Lab on Thursday mark the first time cybersecurity experts have shown how online ad platforms are so pervasive across the internet that they are inescapable and can be used for malvertising to hack visitors' devices without their knowledge.
A spyware expert at the digital rights nonprofit Access, Natalia Krapiva said: “Any time we browse the internet or open an app, all the data on our device can be hacked by malicious actors without us even knowing.”
“States and tech companies whose infrastructure is used to conduct these attacks need to take urgent technical, legal and regulatory measures.”
The report is a collaboration between Confiant-a US ad security company and the Citizen Lab where the University of Toronto studies spyware computer programs. Spyware is designed to secretly infect devices and harvest data to help hack the devices of targeted individuals.
Meanwhile, spyware companies often market their products as indispensable assets for governments to enforce national security even as the tech has repeatedly been used to crack down on journalists, and political opponents.
The malicious code used to hack Al Jazeera computers was specifically effective because it was “ no-click” spyware-meaning that a victim did not need to download a file or click a link to be infected but simply needed an exposed computer and served the ad.
The report further underlined that Confiant detected DiscoverTech ads deployed across critical government infrastructure like those of the US Defense Department and the Dutch Economic Affairs Ministry, though it highlighted that the inclusion of the ads does not imply those organizations were compromised in malicious campaigns.
A Citizen Lab researcher behind the report, Wolfie Christl, said it vindicates years of cybersecurity warnings that the murky online advertising industry can be a vector for hackers to target victims and that most people should consider ad-blocking software to be a central cybersecurity tool.
