Targeted ads delivered 0-click exploits to install mercenary malware
Citizen Lab says Discover-Tech ads delivered Candiru zero-click exploits that installed mercenary spyware.
Citizen Lab reported the AdFection campaign, in which Discover-Tech served targeted ads that delivered zero-click exploits and installed mercenary spyware from Candiru, also known as Integrity Labs. Ad code contacted Candiru servers, which returned an exploit and payload when the ad rendered. Google, IAB Europe, Beeswax, Vungle, and Eskimi have since removed, paused, or blocked Discover-Tech. Impressions appeared on networks linked to NATO, the United Nations, European lawmaking bodies, Australian critical infrastructure, and Norwegian and Swedish government and military agencies. The report does not name the vulnerabilities or the final malware.
- AdFection used targeted ads to deliver zero-click exploits.
- Candiru, rebranded Integrity Labs, supplied the spyware.
- Google, IAB Europe, Beeswax, and others cut off Discover-Tech.
- Impressions reached NATO, UN, and other government-linked networks.
- The exploited flaws and final malware were not named.
Full article374 words · extracted from arstechnica.com · click to collapse
Among the major vendors that listed Discover-Tech as a “certified” or “verified” vendor were Google and the advertising industry association IAB Europe. The Israeli firm also used European General Data Protection Regulation (GDPR) consent frameworks to target users within the European Union. Discover-Tech has served ads through major networks such as Google, Yandex, and Beeswax.
Google and IAB Europe have since removed Discover-Tech from their ad vendor registries, and Google further terminated Discover-Tech’s access to its ad exchange platforms. Beeswax has removed Discover-Tech from its ad buying platform. Fellow ad platform Vungle (Liftoff) paused Discover-Tech’s access while conducting a review, and Eskimi blocked Discover-Tech’s accounts and domains.
Thursday’s report said that Discover-Tech ad impressions have appeared on government and national-security-linked networks throughout the world: NATO, United Nations networks, European lawmaking bodies, critical infrastructure providers in Australia, and armed forces and government agencies in Norway and Sweden.
“Discover-Tech’s mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report,” Citizen Lab said.
Messages sent to Discover-Tech and Candiru went unanswered.
The research lab said that the mercenary malware installed through AdFection was developed and distributed by Candiru (rebranded as “Integrity Labs”). Under the arrangement with Discover-Tech, targets with specific profiles of interest to the Candiru customers received ads that carried JavaScript or other code that connected to Candiru’s control servers. In response, those servers delivered an exploit that served the zero-click payload when the ad appeared on an individual’s device.
The research doesn’t describe the vulnerabilities exploited in the zero-click attacks or the final malware that was installed in them. It’s likely they were zero-days that have been fixed after Citizen Lab discovered the campaign. Citizen Lab didn’t immediately respond to questions.
Citizen Lab called on advertisers and government officials to take concrete action to proactively prevent campaigns like AdFection. Beyond that, users can reduce the risk of being infected by installing ad blockers, resetting mobile advertising ID in iOS and Android settings (it’s unclear why the researchers didn’t advise turning off personalized ads altogether), and installing ad-blocking software on home or office networks. As always, installing updates in a timely manner is also a must.
Text extracted automatically; images, tables and formatting may be missing. Original: