Zero-click spyware delivered through ads

blackbird9

blackbird9

According to this ads can now infect your machine with spyware without you ever clicking on them. Scary.
tech.slashdot.org

First-Ever Public Confirmation of 'Zero-Click' Spyware Delivered Via Targeted Ads - Slashdot

Citizen Lab says it has documented the first publicly confirmed case of zero-click mercenary spyware being delivered through targeted online ads, a technique it calls "AdFection." "There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint...
tech.slashdot.org

All the more reason to keep your ublock and noscript add-ons installed, update your hosts file and your pi-hole.
github.com

GitHub - StevenBlack/hosts: 🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.

🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories. - StevenBlack/hosts
github.com github.com
 
Detailed report here https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

The description of the 'real-time bidding auctions' architecture, almost seems purposefully designed to support the targetted sypware deployment.

"Beyond passive data harvesting, malicious parties can also exploit this infrastructure to target certain individuals based on user data included in ad auctions and then run malicious code on their devices. Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user. That code retrieves additional JavaScript code, which may, in turn, load further code, such as a browser exploit to install spyware. Since the code can contain identifiers for the user or their device, arbitrary JavaScript code can be sent precisely to a single user’s device. Our research in this report indicates that this architecture is indeed abused to facilitate the delivery of zero-click targeted spyware, and that the simple display of a targeted ad is enough for infection."

Reading that makes me wonder how many other ad platforms are being similarly abused, as yet undiscovered. I'm glad I've got ublock installed, it's not very nice. Yet another case for running a browser under a different unix uid from anything you want kept confidential. Though I guess it depends what browser exploit they are using to install the spyware, if they get root they can make it system-wide. Better hope those ad-blockers work correctly.
 
AdGuard, Pi Hole or Brave or some Chrome/Firefox plugin (hopefully not dodgy one) saving the day.
And ironically saving some advertisers too.
aos5qb.jpg
 
blackbird9 said:
Looks like they've been using 'Claude' to find all the bugs. 😂
Almost every line has 'use after free'... what a pile of crap!
Click to expand...
It reads like Ad for Rust :rolleyes:

I remember the times when Internet browsing was done from CDROM booted OS. Gonna return to tha. Re-flashing BIOS after use is next step, I guess.
 
DanielBowman said:
It reads like Ad for Rust :rolleyes:
Click to expand...
They must have had some pretty crappy programmers working on that chrome code to get all those use-after-free bugs, gotta say. It doesn't say much for those 'legendary' google interview questions as a way to filter out the brightest. Yeah, no wonder the bosses want Rust; if Rust is actually any better, when you get your code written by the same interchangable 'warm bodies'. So all that b0ll0cks about 'agile', 'stories', stand-up scrums, 'baby steps', all the rest of the BS, ends up with that huge long list of elementary bugs. And that's just one update, are all their updates all like that? Oh well, it's an easy target, I suppose.

Anyway, there's no shortage of browser exploits, sitting there waiting to be hacked; you can rely on that.
 
So I guess if you stick to a text-only browser like 'links', which doesn't have a javascript interpreter compiled into it, you're going to be pretty safe from this type of ad-hack. Of course you then have a lot of limitations on what you can do online.
 
blackbird9 said:
Yeah, no wonder the bosses want Rust; if Rust is actually any better, when you get your code written by the same interchangable 'warm bodies'.
Click to expand...
I guess with rust you shift the burden of evaluating a new hire to later, when he fails to create something due to the compiler barfing up all what he wrote. Then you can fire him for being bad.

Also, zero click attacks have been there before. If you can spare some time, watch this. It's well worth it, several 0-days burned in one hour of talk.
 
DanielBowman said:
It reads like Ad for Rust :rolleyes:
Click to expand...

github.com

GitHub - Speykious/cve-rs: Blazingly 🔥 fast 🚀 memory vulnerabilities, written in 100% safe Rust. 🦀

Blazingly 🔥 fast 🚀 memory vulnerabilities, written in 100% safe Rust. 🦀 - Speykious/cve-rs
github.com github.com

github.com

GitHub - DavisPL/rust-counterexamples: Examples violating memory safety in safe Rust.

Examples violating memory safety in safe Rust. Contribute to DavisPL/rust-counterexamples development by creating an account on GitHub.
github.com github.com
 
blackbird9 said:
So I guess if you stick to a text-only browser like 'links', which doesn't have a javascript interpreter compiled into it, you're going to be pretty safe from this type of ad-hack. Of course you then have a lot of limitations on what you can do online.
Click to expand...

Image parsing and other media handling problems, as Crivens has pointed out, will quickly catch up with you.
 
blackbird9 said:
So I guess if you stick to a text-only browser like 'links', which doesn't have a javascript interpreter compiled into it, you're going to be pretty safe from this type of ad-hack. Of course you then have a lot of limitations on what you can do online.
Click to expand...
Incompetence, fear of bricking decades old libraries and good old spooks planting backdoors in to everything.
This particular zero click was utilized by mercenary spyware company.il via some ad fixers.

Western governments can't (shall not) spy on it's citizens (spying on allies is also dodgy - see Obama vs Merkel), so they "ask" the other allies, which are more of a rogue state and a little bit of Tortuga.
But they have their own interests....political and/or criminal.
It's only a matter of time before the backdoors are in the hands of who knows who.
 
It's very nasty, even if it's not new. Yes I remember there was a case on smartphones where they said that just being called from the suspicious number was enough to infect the phone, even if the receiver never picked up. You're right, there have been similar types of things around for a while.
 
Just out of curiosity, i tried reading the forum using 'links' in text mode, no javascript support in this browser. I can read the forum ok, text only so no images. In fact links can be compiled with all image support off as well, graphics libraries excluded from the link list.

I tried making a post, but got an error "Oops! We ran into some problems" returned from the forum software. So javascript apears to be required to be able to post, unsurprisingly. It's still useful to be able to read the forum though, eg on a console when X is not available.

Running links in graphics mode (-g) on X looks a bit nicer, but works essentially the same. Links graphics mode doesn't work in a VC, sadly (on my system, the command hangs).
screenshot_2026-10-17_at_02:55:04.pngscreenshot_2026-10-17_at_02:50:31.png
 
cracauer@ said:
Image parsing and other media handling problems, as Crivens has pointed out, will quickly catch up with you.
Click to expand...
I'm sure there is no foolproof way to avoid this kind of attack on a desktop. The best you can do is things like ublock and a blocking hosts file, or pi-hole. It's really not very nice.
 
You must log in or register to reply here.
Back
Top