Senators Cite Report on Targeted Ads Delivering Spyware as Security Risk
Summary
A Citizen Lab–Confiant report says targeted ads in the AdFection technique delivered zero-click mercenary spyware, including Discover-Tech ads on government networks. Senators urged reform; ad groups disputed the report’s broader conclusions.
Key points
- A Citizen Lab–Confiant report describes AdFection, a technique in which targeted ads delivered zero-click mercenary spyware.
- The report says Discover-Tech ads received impressions on government networks and links the company to spyware firm Candiru.
- According to the report, Google, IAB Europe, Beeswax, Vungle and Eskimi took steps to remove Discover-Tech’s access to the advertising ecosystem.
- Sens. Ron Wyden and Cory Booker cited the findings in calls for stronger industry practices and privacy protections; legislation Wyden and Booker introduced in 2023 to restrict targeted advertising did not advance.
- The report calls for stronger partner vetting, audits, threat-data sharing and regulatory scrutiny of Discover-Tech and Candiru.
- Google said it blocked malicious ads and banned Discover-Tech after a joint investigation; IAB Europe disputed that the findings show the advertising infrastructure is broken.
Article Details
- Event Type
- Reporting on a Citizen Lab and Confiant investigation into AdFection, a technique in which targeted ads delivered zero-click mercenary spyware, and the resulting debate over advertising-industry security practices.
- Impact
- The report said spyware was delivered through Discover-Tech ads, which received impressions on government networks. It raised concerns about surveillance and location tracking and prompted calls for stronger ad-vendor security, scrutiny, and restrictions on targeted advertising. Google and several ad networks removed Discover-Tech’s access to the digital advertising ecosystem, according to the report.
People
Cory BookerU.S. senator who said the report underscored the need for stronger privacy protections against spyware and surveillance threats.Lauren WakefieldIAB Europe’s marketing and communications director; commented on the report’s findings and the advertising industry’s security practices.Ron WydenU.S. senator who called targeted ads on government devices a security risk and urged restrictions on advertising and mobile ad IDs.
Vendors
BeeswaxGoogle and IAB Europe, and the ad networks Beeswax, Vungle and Eskimi all took steps to remove Discover-Tech’s access to the digital advertising ecosystem, according to the report.ConfiantThe Citizen Lab at the University of Toronto, in partnership with the cybersecurity and ad-tech firm Confiant, last week published a report on AdFection, a technique whereby targeted ads were delivering zero-clickDiscover-TechAds from Discover-Tech, the company most linked to AdFection, got impressions on government networks.EskimiGoogle and IAB Europe, and the ad networks Beeswax, Vungle and Eskimi all took steps to remove Discover-Tech’s access to the digital advertising ecosystem, according to the report.GoogleDiscover-Tech appeared on lists of “certified” and “approved” vendors that Google and the advertising industry association IAB Europe maintained.MicrosoftA mix of other ad systems replied to The Citizen Lab, but some did not, including Microsoft, which owns the ad system Xandr.VungleGoogle and IAB Europe, and the ad networks Beeswax, Vungle and Eskimi all took steps to remove Discover-Tech’s access to the digital advertising ecosystem, according to the report.
Products
Industries
advertisingTwo senators say that revelations about online targeted advertising being used as a vector for spyware infections underscore the need for better security practices in the industry.GovernmentThe security threat of targeted online advertising to government devices is of particular concern to Wyden, with his letters to government agencies cited in the report.