Zero-click spyware delivered through ads

blackbird9

blackbird9

According to this ads can now infect your machine with spyware without you ever clicking on them. Scary.
tech.slashdot.org

First-Ever Public Confirmation of 'Zero-Click' Spyware Delivered Via Targeted Ads - Slashdot

Citizen Lab says it has documented the first publicly confirmed case of zero-click mercenary spyware being delivered through targeted online ads, a technique it calls "AdFection." "There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint...
tech.slashdot.org

All the more reason to keep your ublock and noscript add-ons installed, update your hosts file and your pi-hole.
github.com

GitHub - StevenBlack/hosts: 🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.

🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories. - StevenBlack/hosts
github.com github.com
 
Detailed report here https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

The description of the 'real-time bidding auctions' architecture, almost seems designed to support the targetted sypware deployment.

"Beyond passive data harvesting, malicious parties can also exploit this infrastructure to target certain individuals based on user data included in ad auctions and then run malicious code on their devices. Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user. That code retrieves additional JavaScript code, which may, in turn, load further code, such as a browser exploit to install spyware. Since the code can contain identifiers for the user or their device, arbitrary JavaScript code can be sent precisely to a single user’s device. Our research in this report indicates that this architecture is indeed abused to facilitate the delivery of zero-click targeted spyware, and that the simple display of a targeted ad is enough for infection."

Reading that makes me wonder how many other ad platforms are being similarly abused, as yet undiscovered. I'm glad I've got ublock installed, it's not very nice. Yet another case for running a browser under a different unix uid from anything you want kept confidential. Though I guess it depends what browser exploit they are using to install the spyware, if they get root they can make it system-wide. Better hope those ad-blockers work correctly.
 
AdGuard, Pi Hole or Brave or some Chrome/Firefox plugin (hopefully not dodgy one) saving the day.
And ironically saving some advertisers too.
aos5qb.jpg
 
You must log in or register to reply here.
Back
Top