First-Ever Public Confirmation of 'Zero-Click' Spyware Delivered Via Targeted Ads (citizenlab.ca) 58
Citizen Lab says it has documented the first publicly confirmed case of zero-click mercenary spyware being delivered through targeted online ads, a technique it calls "AdFection." "There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action," said Bill Marczak, a researcher at Citizen Lab. The Guardian reports: Citizen Lab, a digital investigations research unit at the University of Toronto, said it believed dozens of devices at the Qatari broadcaster Al Jazeera had been compromised by spyware delivered through ads run by Discover-Tech, which describes itself as a specialised digital advertising agency. According to Citizen Lab, Discover-Tech operates a software platform called Controlium that allows its clients to "mass-profile and deanonymize" internet users then covertly hack targets with third-party spyware. Unlike infections that rely on people interacting with links or files, the spyware requires no interaction from the victim to be installed, making it a new delivery technique, Citizen Lab says. The infections happen without a user's knowledge, and in a matter of seconds, according to Citizen Lab.
"[The online advertising] ecosystem is being weaponized at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware," the report says. According to the report, Controlium is able to harvest a user's identity and IP address when the user is shown a seemingly benign custom-created ad -- for example, for a digital game or a telecoms service. If the user has been selected as a target for hacking, a mercenary spyware firm can then send a malicious code containing spyware to their device, the researchers say. They say that millions of users worldwide have been served ads by Discover-Tech since 2024, including in Yemen, Brazil, Mexico and Czechia. [...] The full extent of the targeting allegedly enabled by Discover-Tech is unknown. Citizen Lab's findings join mounting evidence that the opaque arrangements underpinning the world of online advertising can be leveraged for surveillance.
"[The online advertising] ecosystem is being weaponized at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware," the report says. According to the report, Controlium is able to harvest a user's identity and IP address when the user is shown a seemingly benign custom-created ad -- for example, for a digital game or a telecoms service. If the user has been selected as a target for hacking, a mercenary spyware firm can then send a malicious code containing spyware to their device, the researchers say. They say that millions of users worldwide have been served ads by Discover-Tech since 2024, including in Yemen, Brazil, Mexico and Czechia. [...] The full extent of the targeting allegedly enabled by Discover-Tech is unknown. Citizen Lab's findings join mounting evidence that the opaque arrangements underpinning the world of online advertising can be leveraged for surveillance.
Via Ads you say? (Score:2)
Were they Adobe or Auth0 ads?
Just wondering...
And this, kids... (Score:5, Insightful)
And this, kids, is why everyone should be running multiple layers of ad-blocking. Get your Pi-Hole set up. And stick to a browser that lets you have multiple ad-blocking extensions. And for the love of $DEITY, don't use Facebook, Instagram, etc. on your phone.
Re: (Score:2)
Re: (Score:2)
Re:And this, kids... (Score:5, Interesting)
I run Pi-Hole. When I'm not on my home network, I connect my device to it over OpenVPN and force the device to use my Pi-Hole as the DNS server---it's an OpenVPN option. So I have Pi-Hole protection wherever I am.
Re: (Score:2)
Re: (Score:3)
Its been years since I tried pi-hole. I had been using it but it seemed to block every CDN for every shopping site my ex-wife used. I turned it off so she could shop without headaches.
Re: (Score:2)
Huh, I haven't experienced any problems. I also set it up for my sister and she has whitelisted 8 domains (unnecessarily, IMO, since I doubt they were blocked, but she might have misinterpreted things.)
Re: (Score:2)
I didnt have any issues, but she really couldn't shop.
Probably worth taking another look.
Re:And this, kids... (Score:5, Informative)
Huge mistake says your credit card.
Re: (Score:2)
Its been years since I tried pi-hole. I had been using it but it seemed to block every CDN for every shopping site my ex-wife used. I turned it off so she could shop without headaches.
That's certainly not true in the default configuration. I'd suspect that you've selected an overly eager blocking list. The Web GUI should make it easy to find which list(s) have blocked a specific site.
We can either have an internet or digital... (Score:3)
We can't have both.
Re:We can either have an internet or digital... (Score:5, Insightful)
We can either have an internet or digital marketing.
We can't have both.
Hell to the no. Advertisers poisoned the well; they don't get to complain when I run the well water through a bunch of filters before ingesting it. Fuck them.
I'd be happy to pay to view some sites, but I can't trust them to keep my view ad-free, nor can I trust them to not monetize my data. Again, fuck them.
Adblocking is now good cyber security (Score:4, Insightful)
Re:Adblocking is now good cyber security (Score:5, Insightful)
"Is now good"
Adblocking always was good cybersecrity.
Ever since the first ad sites were happy to take anyone's money. And that included the malware vendors.
Now, it's even more a good idea.
Re: (Score:2)
The arrival of AI web-site-scrapers has driven everybody to Google security, who in turn, is re-building web-sites so that only their privacy-removing browser (Chrome), works.
Re: Adblocking is now good cyber security (Score:2)
Live your life in such a way that you get kicked off Facebook.
This has gotten MUCH easier of late. Lots of big reports even of big influencers getting booted, which is weird because those people produce a lot of traffic.
Re: (Score:2)
>The new Meta (Facebook/Instagram) web-site doesn't work with Firefox and other privacy-conscious browsers.
So the adblock is working, perfect !!
Re: (Score:1)
And use uBlockDNS. can use on 3 devices for free, and works like Pi-hole without having a dedicated hardware.
Re: (Score:2)
And use uBlockDNS.
"Not related to uBlock Origin." This is an important point which is plastered all over their page, because I absolutely checked them out thinking this was a service by uBlock Origin.
But ads make the internet free! (Score:4, Interesting)
For those sites that insist ads are the reason their sites are free, I say this. I will unblock your ads if you accept all risk & responsibility for ads on your site.
Advertisers are the enemy of the Internet (Score:3)
All web browsers should have universal ad blocking built-in and turned on by default. The parasites will of course complain, but we don't need them. (I don't want to hear "but my web site won't survive without advertising"-- I've been running sites since they were a thing and I've never allowed advertising, so I don't want to hear any whining about how it can't be done.) We need to permanently blacklist all advertiser domains on sight, and we probably need to block advertiser networks.
And the thing is: it didn't need to turn out like this. If advertisers had just behaved like responsible grown-ups then we could have grudgingly tolerated their worthless presence and just ignored them. But they couldn't do that; they had to turn their entire ecosystem into a massive assault on security and privacy.
Well, screw them.
Re:Advertisers are the enemy of the Internet (Score:5, Insightful)
Advertisers are not the enemy of the internet. They are the enemy of human civilization. They are the enemy of sanity. They are the enemy of all that is decent and moral in the world.
Re: (Score:2)
Aren't you a sock puppet of the r(etarded)silvergun(shooting blanks) bot and its communist masters?
Re: (Score:3)
Come on, quit holding back - tell us how you really feel.
Re: (Score:2)
Yes, absolutely. Advertising is unethical. It is psychological coercion designed to make people buy stuff they normally wouldn't think they need.
The only ethical ads are PSAs that impart helpful and useful information, but they're not really advertising in the commercial sense.
Eventually browsers need to block all third party. (Score:4, Insightful)
Zero-click you say? Is that via javascript or webapp?
And yes, I realize the originating domain also can't be trusted
Where do we go from here? (Score:2)
-1 click? into the complex number system? 3i - 2 clicks?
Guess the country (Score:2, Troll)
"The malicious advertisements were purchased by Discover-Tech, an Israeli company that presents itself as a legitimate advertising company, but which we found operates as a facilitator for multiple mercenary spyware partners"
Re: (Score:2)
No, but *do* blame the Israeli government and their supporters.
This!! (Score:2)
Your comment is 100% on target. Jews is too generic and we actually have Jews that are also against what Israeli Government and radicals are doing.
You the good example of those 2 Israeli that produced a movie showing all the abuse Israeli troops do in Gaza and West-bank. Then the radicals and the government are removing their citizenship as retaliation!!
As we have many Muslin that do not support Hamas actions. Many pay with their lives
So we have to clearly stop being generic and point the fingers correctly:
Re: (Score:2)
Re: (Score:2)
While i do also agree that Israel accidentally created Hamas in the attempt to sabotage the Palestine Liberation Organization, one thing is resist, the other is revenge.
I know the hate both side have is big and long, but neither side can be excused from plain killing non-fighting civilians.
Both sides must learn that this will never be solved by force and each time one side decides to avenge their dead with even more dead is just creating more problems and causing more dead in the future.
Re: (Score:2)
But there is really no "both sides" when one dictates all the other's leaders and living conditions, down to deciding that an area that formerly had two million people who were ethnically cleansed out of the surrounding areas and cordoned into a camp with limited freedom of movement and nothing akin to what we enjoy (in theory) with the bill of rights.
I understand that you don't necessarily disagree with any of these points individually, but I think we wouldn't be "both sides"-ing segregation in the jim cro
Re: (Score:2)
Re: (Score:2)
i do agree with you, Israel is still stealing land, trying to control everything and killing Palestinians, while the reverse is limited resistance in comparison (~75k vs 1.5-2k).
But Hamas actions just gave the excuses for a radical government to kill and steal more land. That is the perfect example of violence bringing even more violence and problems!
And Israeli should not celebrating, all their actions is again rising the hate on the Palestinian side and sooner or later Israel will pay for it... the way fo
basic h4xorz (Score:4, Interesting)
"The combination of the COM persistence hijack, the use of a distinctive 48-byte repeating XOR obfuscation technique with a “dummy” null terminator, and the specific hardcoded network connectivity check leads us to conclude with high confidence that this sample is a newer version of the Candiru attack chain that we captured in 2021." .dll files. They're probably AdFected.
As long as you're not an enemy of Israel, this attack is not aimed at you. For everyone else: delete your Windows
So the the exact arc of iframes rise and fall? (Score:1)
You NoScript guys ... (Score:2)
Shout out to the few folks here who remind us that they block just about everything on the web that could cause problems - the only ones of us who are probably safe.
I bet a few don't even allow stylesheets.
Re: (Score:1)
This is likely a framework issue, UB, so almost a feature and with multiple use vectors. Unrelated:: There is a new unstable Ultima Online client being publicly tested so maybe look for the gears of this zero click thing just in case.
Re: (Score:2)
Re: (Score:2)
NoScript is pretty much the only thing that makes the modern web usable. It's not just the malware and trackers that get blocked. All the flashing advertisements, annoying animations, autoplaying videos, loud music, all gone.
The rare times I have to browse without NoScript, I'm amazed at what a pile of garbage the web has turned into, and I wonder how anyone puts up with it.
Don't You Dare (Score:3)
Don't you dare try to tell me that running arbitrary code from every single fucking website on my computer "sandboxed" has a plainly obvious and major inherent risk to it.
Don't you dare.
No mention of what country this is from (Score:5, Interesting)
Interesting how the entire summary leaves out what country this company is from. Are we now protecting these genocidal criminals?
The country is Israel.
Re: (Score:2)
your sacred land is for those who deserve it to the eyes of God. With the radical Jews and Israeli government actions, they and you also are totally unworthy of the land. Stop following false Gods and leaders and use your own brain instead.
First ever?! (Score:2)
Years ago I caught Facebook serving Malware Ads (Score:2)
15+ years ago I was using Facebook when my AV software triggered an alert on a file in my browser cache. After investigating I found a Facebook ad in my cache containing embedded malware (I don't recall the details, but it was some flavor of .png/.jpg arbitrary code execution exploit). Luckily my system wasn't vulnerable to the exploit the attackers were trying to use. I immediately reported the incident to Facebook's security team, but they never followed up with me.
This is why I started using an adblocke
But how is infection prsisted to the machine? (Score:2)
I did actually Read The Flamin' Article to try to find out, just how an ad can persist itself to the user's computer.
Closest I could find is this vague and brief line :-
"Both samples use a COM hijack for persistence, though make use of different DLLs."
Either they don't know how it works, or, they know it doesn't and a core tenet of their article, infecting devices - "We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware" - is baseless. If thei