No click required: How the ad industry became a pipeline for mercenary spyware

That ad you just scrolled past on your phone but barely spared a look or click? It could be tracking your movements and collecting your data, without you having to do a thing.

This “zero-click mercenary spyware,” dubbed “AdFection,” is increasingly exploiting a sprawling online advertising ecosystem ripe for abuse, according to researchers at The Citizen Lab. One top actor in the space, Discover-Tech, runs the Controlium platform that allows cyber criminals to “precisely profile and de-anonymize” millions of users, fingerprint them, and automatically infect their devices when an ad is displayed.

Troublingly, Discover-Tech is successfully masquerading as a legitimate ad company across the online ad sales environment, the researchers said, listed as a “certified” and “approved” vendor by the likes of Google and IAB Europe.

Over a four-month period, the company’s ads were shown on nearly 200,000 unique websites and in Android/iOS apps in dozens of countries. Furthermore, its ads have been presented through major networks like Google, Yandex, and Beeswax, and it even exploited the European General Data Protection Regulation (GDPR) consent frameworks to target victims in the EU.

The Citizen Lab researchers disclosed their findings to Google, IAB Europe, Beeswax, Vungle (Liftoff), and Eskimi, all of whom took action to disconnect Discover-Tech’s access to the digital advertising ecosystem.

“Discover-Tech’s mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse,” the researchers warned.

How AdFection exploits a largely unprotected system

The online ad market operates largely via real-time bidding (RTB), auctions hosted by ad exchanges. Run by companies like Google, these take place “hundreds of billions” times a day, the researchers explained. When an ad box pops up on an app or website on a user’s device, it immediately triggers a bid request; advertisers then submit their offers, and the exchange grants a winner the ability to push their ad to the user within split seconds. These ads can contain images, video, and, most importantly to cybercriminals, code.

Demand-side platforms (DSPs) and supply-side platforms (SSPs) act as intermediaries in the process, and data about specific users and devices is shared across the exchanges so advertisers can decide whether they want to show specific ads to a specific individual, based on device identifiers and characteristics such as a user’s precise location, cookie ID, mobile ad ID, or IP address.

“The auction system is designed to enable targeting single individuals,” the researchers explained. “The totality of information gleaned from ad auctions is quite valuable.” Companies with access to auction data can track users without their knowledge, across cellular, Wi-Fi, and virtual private networks (VPNs).

Discover-Tech has effectively infiltrated and connected the spyware industry to this online ecosystem, which includes infamous Israeli mercenary spyware vendor Candiru. Its partners can deliver ads to “mass-profile unwitting phone users,” and silently infect the devices of select targets, according to the researchers.

When Discover-Tech wins a bid, one of its ads is pushed to a website or app that is open on a user’s device. Sometimes this is seen by the user; other times is merely renders in the background.

Many of these ads have been shown to devices on national security-sensitive networks, in security organizations including NATO, networks associated with critical infrastructure, and media organizations around the world. Using AdFection, Candiru’s spyware infected devices at international news network Al Jazeera.

The researchers emphasized that a Discover-Tech ad impression does not mean that a device has been infected with spyware. However, the fact that the company has been able to bid on and show ads across sprawling ad networks highlights a “systemic risk” warranting “urgent investigation.”

Lack of vetting

Discover-Tech’s ads carried no exploit at all, noted Frank Dickson of Dickson Research. “The ad was clean; that is the frightening part. Nobody clicked anything.”

Instead, each ad called home with the device’s advertising ID and IP address. In almost every case, the server sent back nothing, Dickson emphasized; only chosen targets received malicious code.

“Third-party verification scanners saw a harmless banner, because for nearly every viewer, it was one,” he said. This is exactly how tags slipped past verification.

Also alarming is the reach: Discover-Tech’s ads displayed in 75,373 apps and 120,768 websites over the course of four months, and had impressions on networks belonging to NATO, Intel, Microsoft, and Apple. While the report emphasizes that an impression is not an infection, the company’s targeting clearly reached enterprise networks, Dickson said.

Just as troublingly is the badge: Discover-Tech was listed as a certified or approved vendor for years. The report said that vetting often amounted to self-attestation, a box checked on a form. “A certification is only as good as the vetting behind it,” Dickson said.

Steps enterprises should take now

On managed browsers, ad blockers are necessary, but they’re not wholly sufficient, Dickson said. Many Discover-Tech bids were for ads inside mobile apps, typically overlooked by browser extensions. But clearly, desktops are at play too; Candiru targeted Al Jazeera’s Windows software.

Dickson advised enterprises to:

• Push a vetted ad-blocking extension to managed browsers through policy rather than leaving it to users to install it.
• Favor browsers with built-in tracking protection.
• Block ad and tracking domains at the DNS or secure web gateway layer; this reaches in-app ads on managed phones.
• Disable advertising identifiers on corporate mobile devices through mobile device management (MDM) and restrict ad-supported consumer apps on devices holding sensitive data.
• Turn on Apple’s Lockdown Mode for high-risk executives, journalists, and any users traveling to sensitive locations.
• Keep browsers and operating systems patched “The ad is only the delivery truck; the exploit still needs a flaw,” he pointed out.
• Watch traffic tied to ad impressions for odd follow-on requests.
• Finally, search domain name system (DNS) and proxy logs for the domains published in the report.

The advertising ID in particular deserves a hard look, Dickson pointed out. The Citizen Lab report says that blocking advertising identifiers alone would have stopped this attack method.

Troublingly, he noted, many enterprises spend fortunes managing their users’ identities, then let corporate phones hand that persistent identifier to anonymous auctions that run hundreds of billions of times a day.

“Every ad is someone else’s code running on your device,” Dickson said. “Treat the ad network like any other untrusted vendor.”