Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
0 / 25
English
中文
An Israeli advertising agency has been serving millions of online adverts that allow “zero-click” spyware to be used against targets, researchers at a Canadian university have said.
（暂无翻译）
Citizen Lab, a digital investigations research unit at the University of Toronto, said it believed dozens of devices at the Qatari broadcaster Al Jazeera had been compromised by spyware delivered through ads run by Discover-Tech, which describes itself as a specialised digital advertising agency.
（暂无翻译）
According to Citizen Lab, Discover-Tech operates a software platform called Controlium that allows its clients to “mass-profile and deanonymise” internet users then covertly hack targets with third-party spyware. Unlike infections that rely on people interacting with links or files, the spyware requires no interaction from the victim to be installed, making it a new delivery technique, Citizen Lab says.
（暂无翻译） （暂无翻译）
The infections happen without a user’s knowledge, and in a matter of seconds, according to Citizen Lab.
（暂无翻译）
“[The online advertising] ecosystem is being weaponised at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware,” the report says.
（暂无翻译）
According to the report, Controlium is able to harvest a user’s identity and IP address when the user is shown a seemingly benign custom-created ad – for example, for a digital game or a telecoms service. If the user has been selected as a target for hacking, a mercenary spyware firm can then send a malicious code containing spyware to their device, the researchers say.
（暂无翻译） （暂无翻译）
They say that millions of users worldwide have been served ads by Discover-Tech since 2024, including in Yemen, Brazil, Mexico and Czechia.
（暂无翻译）
“It’s disastrous that major ad vendors and organisations apparently were neither able to detect nor prevent the company’s malicious advertising operations for years,” said Wolfie Christl, a researcher at Citizen Lab. “The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike.” According to Citizen Lab, Controlium acts as a “facilitator” for third-party spyware firms that have targeted “government officials, journalists, businesspeople, activists, academics and embassy workers”.
（暂无翻译） （暂无翻译）
Citizen Lab claims it can deliver spyware that can access everything on the device of a target, extracting messages, photos and emails, recording calls and secretly activating microphones. The full extent of the targeting allegedly enabled by Discover-Tech is unknown.
（暂无翻译） （暂无翻译）
Citizen Lab’s findings join mounting evidence that the opaque arrangements underpinning the world of online advertising can be leveraged for surveillance. “There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action,” said Bill Marczak, a researcher at Citizen Lab.
（暂无翻译） （暂无翻译）
Discover-Tech has been approached for comment.
（暂无翻译）
When a user navigates to a website that shows advertisements, their details become part of a split-second programmatic auction involving dozens or hundreds of companies.
（暂无翻译）
These companies bid automatically to place an ad in front of that user. These bids are based on the user’s profile, which can include information about their device and data compiled on them by tracking their activity across the web.
（暂无翻译） （暂无翻译）
For example, companies given the profile of a 35-year-old interested in sports betting and crypto might bid to show that individual an advertisement for an energy drink. There is little regulation on this automated online market, and there is growing evidence that it is being exploited by malevolent actors.
（暂无翻译） （暂无翻译）
Reuters has reported that billions of dollars’ worth of Meta’s ad revenue comes from ads for scams, illegal gambling, pornography and other banned content.
（暂无翻译）
In the US, ICE and other government agencies have bought software that uses ad tech data to track people’s movements. “Cybersecurity agencies, regulators and lawmakers in the US, Europe and other regions must urgently step in.
（暂无翻译） （暂无翻译）
They must investigate the involved companies and fix the systemic risks that enable malicious ad targeting,” said Christl.
（暂无翻译）
仅供学习使用，如有侵权请联系删除 · 查看原文