Citizen Lab researchers say Discover-Tech operates an advertising platform, Controlium, that can allow its users to “deanonymize, fingerprint, and automatically infect devices” once an ad appears. Overall, researchers estimate that millions of devices were directed to Candiru’s servers, where they may have been profiled. According to Citizen Lab researchers, by analyzing ad auction records publicly exposed on the Discover-Tech website, company-related ads with attacker script tags were served in more than 70,000 mobile apps and more than 120,000 websites between March and June of this year. According to researchers, several apps displayed more than 1 million Discover-Tech-related ads.
Not all of the company’s ads were necessarily used to potentially distribute spyware, but researchers say that in general they saw Discover-Tech ad impressions on government and national security networks around the world. These include NATO and UN networks, as well as legislative bodies in Europe, critical infrastructure providers in Australia, and armed forces and government agencies in Norway and Sweden.
Previous zero-click targeted ad campaigns distributing spyware have rarely surfaced publicly, but Citizen Lab researchers say it’s likely a symptom of an advertising infrastructure so widely trusted and integrated into every aspect of digital life without specific oversight.
“The Al Jazeera network logs were key to understanding the advertising nature of this attack,” says Marczak. “If a user’s personal device were targeted, for example while connected to their home Wi-Fi network or mobile data, there wouldn’t be the same level of network monitoring. So I think the lack of advance reporting is probably primarily a visibility issue: defenders need to be in the right place at the right time, looking at the right data.”
Speaking generally about the threats that can arise from the pervasiveness of the digital advertising ecosystem, Jason Kint, CEO of digital media trade organization Digital Content Next (WIRED parent Condé Nast is a member), says these types of attacks are both plausible and damaging.
“While rare and sophisticated, I wouldn’t be entirely surprised to learn more about zero-click attacks via ads,” Kint says. “Anything that goes directly against user expectations or diminishes trust in the open web is deeply concerning.”
Gn bussni
