No Online Advertising Could Be Spyware Entrance

Israeli advertising agencies suspected of distributing ads containing dangerous codes containing spyware. This system allows the perpetrator to collect and share information on the device automatically, even though the user does not click on the ad.

Citizen Lab, Toronto University's digital investigation unit, reveals how digital advertising ecosystems were used as a means of spreading spyware. They call this technique AdFection, an ad that automatically causes infection in the device when shown.

"Our investigation found that the assailant we call DARK CARTOGRAPHER used a Discover-Tech ad and a number of additional vendors to reveal the user's identity since at least 2019," wrote Citizen Lab in his report, Thursday (15 / 10).

Discover-Tech is an Israeli-based ad agency. The findings reveal that this agency is a cover to channel large-scale espionage devices by sending spy software when advertising is shown.

In addition to images or videos, online ads can also contain code running inside the application or browser that shows the ad. The killer used this gap to create a code that would exploit browser to install spyware on user devices.

Spyware is a kind of dangerous software that secretly monitors activity, steal personal data, and sends it to an unauthorized third party. The advertisements that Discover-Tech displayed are known to contain spyware Candiru affiliated with the spies of the Israeli government.

Citizen Lab says the Discover-Tech platform allows the killer to identify the identity of the device and IP addresses, so they can send spyware infections to targets automatically when advertising is broadcast.

It's a new attack technique that doesn't require any interaction from the victim or zero- click to spread spyware. The commercial from Discover-Tech has spread through over 75,000 Android and iOS applications, as well as over 120 thousand websites.

Some of the applications that show their advertisements are Yahoo Mail, Opera Mini, Duolingo, Ludo Star, while the sites that also show their ads are popular, like BBC, New York Times and IMDb.

However, not all of those sites became targets. They only send spyware if the ID or IP address devices match their intelligence targets.

The only victim called spyware infected in the report is a staff and internal network device in Al Jazeera, Qatar international media.

Furthermore, the AdFection case increased public concerns regarding cybersecurity and privacy in digital space. This findings reveal a lack of security tests in the advertising industry, demanding more strict regulation to ensure user security.

"This security risk suggests that there is an urgent need for public interest in reforming digital advertising," uncovering Citizen Lab.

In order to reduce the risk, Citizen Lab recommends security measures as the use of a trusted ad-blocking extension in a browser to reduce tracking, access browser that appreciates user privacy, reset ad IDs periodically and use the opt@@.