Citizen Lab published the first public technical confirmation that mercenary spyware reached devices through targeted online advertising, a technique it calls AdFection.
Zoom in: Devices at the news network Al Jazeera were infected with spyware from Candiru, since rebranded as Integrity Labs, after an advertisement rendered on the device.
The backstory: An Israeli company called Discover-Tech bought the ads. It presents itself as a legitimate advertising firm and runs a platform, Controlium, that lets partners de-anonymise, fingerprint and automatically infect a device as the ad loads.
By the numbers: Analysis of four billion Discover-Tech bidding records showed its ads ran on almost 200,000 unique websites and Android and iOS apps across dozens of countries during a four-month period.
- The ads also covertly directed millions of devices to contact Candiru servers, which the researchers read as large-scale tracking and reconnaissance.
Between the lines: Online ad auctions run hundreds of billions of times a day, and an ad can carry code that executes inside the app or browser showing it. Those two facts are what the attack exploits.
- Discover-Tech appeared on certified and approved vendor lists kept by Google and the trade body IAB Europe, and served ads through Google, Yandex and Beeswax.
What's next: Google, IAB Europe, Beeswax, Vungle and Eskimi cut off Discover-Tech access after the disclosure. Citizen Lab called on regulators to investigate whether Discover-Tech and Candiru violated applicable laws.
Why it matters: Loading a normal webpage or opening an installed app was enough, so the usual advice about avoiding suspicious links does little here and the repair work sits with the advertising industry.
