Zero-click spyware delivered through ads

blackbird9

blackbird9

According to this ads can now infect your machine with spyware without you ever clicking on them. Scary.
tech.slashdot.org

First-Ever Public Confirmation of 'Zero-Click' Spyware Delivered Via Targeted Ads - Slashdot

Citizen Lab says it has documented the first publicly confirmed case of zero-click mercenary spyware being delivered through targeted online ads, a technique it calls "AdFection." "There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint...
tech.slashdot.org

All the more reason to keep your ublock and noscript add-ons installed, update your hosts file and your pi-hole.
github.com

GitHub - StevenBlack/hosts: 🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.

🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories. - StevenBlack/hosts
github.com github.com
 
Detailed report here https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

The description of the 'real-time bidding auctions' architecture, almost seems purposefully designed to support the targetted sypware deployment.

"Beyond passive data harvesting, malicious parties can also exploit this infrastructure to target certain individuals based on user data included in ad auctions and then run malicious code on their devices. Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user. That code retrieves additional JavaScript code, which may, in turn, load further code, such as a browser exploit to install spyware. Since the code can contain identifiers for the user or their device, arbitrary JavaScript code can be sent precisely to a single user’s device. Our research in this report indicates that this architecture is indeed abused to facilitate the delivery of zero-click targeted spyware, and that the simple display of a targeted ad is enough for infection."

Reading that makes me wonder how many other ad platforms are being similarly abused, as yet undiscovered. I'm glad I've got ublock installed, it's not very nice. Yet another case for running a browser under a different unix uid from anything you want kept confidential. Though I guess it depends what browser exploit they are using to install the spyware, if they get root they can make it system-wide. Better hope those ad-blockers work correctly.
 
AdGuard, Pi Hole or Brave or some Chrome/Firefox plugin (hopefully not dodgy one) saving the day.
And ironically saving some advertisers too.
aos5qb.jpg
 
blackbird9 said:
Looks like they've been using 'Claude' to find all the bugs. 😂
Almost every line has 'use after free'... what a pile of crap!
Click to expand...
It reads like Ad for Rust :rolleyes:

I remember the times when Internet browsing was done from CDROM booted OS. Gonna return to tha. Re-flashing BIOS after use is next step, I guess.
 
DanielBowman said:
It reads like Ad for Rust :rolleyes:
Click to expand...
They must have had some pretty crappy programmers working on that chrome code to get all those use-after-free bugs, gotta say. It doesn't say much for those 'legendary' google interview questions as a way to filter out the brightest. Yeah, no wonder the bosses want Rust; if Rust is actually any better, when you get your code written by the same interchangable 'warm bodies'. So all that b0ll0cks about 'agile', 'stories', stand-up scrums, 'baby steps', all the rest of the BS, ends up with that huge long list of elementary bugs. And that's just one update, are all their updates all like that? Oh well, it's an easy target, I suppose.

Anyway, there's no shortage of browser exploits, sitting there waiting to be hacked; you can rely on that.
 
So I guess if you stick to a text-only browser like 'links', which doesn't have a javascript interpreter compiled into it, you're going to be pretty safe from this type of ad-hack. Of course you then have a lot of limitations on what you can do online.
 
blackbird9 said:
Yeah, no wonder the bosses want Rust; if Rust is actually any better, when you get your code written by the same interchangable 'warm bodies'.
Click to expand...
I guess with rust you shift the burden of evaluating a new hire to later, when he fails to create something due to the compiler barfing up all what he wrote. Then you can fire him for being bad.

Also, zero click attacks have been there before. If you can spare some time, watch this. It's well worth it, several 0-days burned in one hour of talk.
 
You must log in or register to reply here.
Back
Top