cyber.hendryadrian.com
Security News · cyberscoop.com

Citizen Lab Details Zero-Click Spyware Delivered Through Targeted Ads

· Original article ↗

Summary

Citizen Lab says Discover-Tech ads delivered zero-click spyware linked to Candiru, targeting at least 45 Al Jazeera devices. Google and IAB Europe removed Discover-Tech from their vendor registries after the findings.

Key points

  • Citizen Lab says Discover-Tech ads covertly directed devices to contact Candiru servers, enabling spyware infection without a user clicking.
  • Researchers linked attacks targeting at least 45 Al Jazeera devices with high confidence to Candiru spyware.
  • Candiru spyware can remotely take over devices and access data, microphones, and cameras, according to the article.
  • Researchers found Discover-Tech ads on more than 120,000 websites and 70,000 mobile apps between March and June.
  • Citizen Lab says Discover-Tech’s Controlium platform can de-anonymize and fingerprint devices, then automatically infect them when an ad renders.
  • Google removed Discover-Tech from its vendor registries and ended its access to Google ad platforms; IAB Europe also removed it from its vendor list.
  • Citizen Lab could not attribute the AdFection attacks to a specific party. It says a separate actor, DARK CARTOGRAPHER, used Discover-Tech infrastructure to exploit mobile-carrier vulnerabilities.

Article Details

Event Type
Citizen Lab disclosed AdFection, a zero-click mercenary spyware delivery operation using targeted online advertising. Researchers linked the attacks with high confidence to Candiru spyware delivered through Discover-Tech ads, but could not attribute the attacks to a specific party.
Impact
Researchers said at least 45 devices at Al Jazeera were targeted and that Discover-Tech ads appeared on more than 120,000 websites and 70,000 mobile apps between March and June of the reported year. Candiru spyware can remotely take over devices, steal data, and access microphones and cameras. Google removed Discover-Tech from its vendor registries and ended its access to Google ad platforms; IAB Europe removed it from its global vendor list.

People

Jerome DanguChief technology officer and co-founder of Confiant; commented on surveillance risks in the digital advertising industry.Wolfie CristlSenior researcher at The Citizen Lab; discussed the failure of ad vendors to detect the operation.

Threat Actors

DARK CARTOGRAPHERName used by The Citizen Lab for a separate threat actor reportedly using Discover-Tech infrastructure to exploit vulnerabilities across mobile carriers and link device advertising IDs with phone numbers.

Malware

Candiruactuality it operates as a facilitator for multiple mercenary spyware partners, including the well-known Candiru.

Vendors

Discover-TechIt concluded that while the Israeli company Discover-Tech presents itself as a legitimate advertising firm, in actuality it operates as a facilitator for multiple mercenary spyware partners, including the well-knownGoogleThe likely goal, according to the researchers, is large-scale tracking and surveillance, enabled by accident by major industry players like Google.

Products

ControliumFurthermore, the report states, “Discover-Tech operates a platform called Controlium that enables its mercenary surveillance partners to de-anonymize, fingerprint, and automatically infect devices the moment an

Industries

MediaThe campaign led to the infection of devices at media outlet Al Jazeera, they said, but Discover-Tech’s ads have also appeared on many sensitive networks around the world, including at the U.S.online advertisingIt’s a discovery that the researchers said raises uncomfortable questions for regulators, whom The Citizen Lab said need to investigate Discover-Tech and levy sanctions, and for the online advertising industry.

Related Articles