<!– –>
A group of cybersecurity researchers unveiled evidence showing that an Israeli spyware operation was able to infect targeted devices, including those of journalists, simply by displaying ads without the users having to click on a link.
Listen To This Story
It is a new age for the predators of the internet. Gone are the days of having to ensnare naive web surfers via suspicious (but tantalizing) links they have to click on. Now cybercriminals are able to infect phones and computers with malware just by showing their users one of the most common features of internet browsing, an advertisement.
In a groundbreaking report released this week, the Canadian cybersecurity research group The Citizen Lab said it had proof that an Israeli company, posing as an advertising firm, was able to spy on dozens of Al Jazeera journalists solely using targeted ads, an unprecedented form of cyberattack they termed “AdFection.”
The news should worry everyone with an internet connection. According to the report, not only was the firm, Discover-Tech, able to hack into and spy on the devices of a number of journalists, but it was also able to profile millions of people by de-anonymizing and “fingerprinting” their devices — thereby allowing their activity to be tracked over time.
Discover-Tech uses this identifying information to decide whom to infect with spyware. And once infected, the firm and its partners have access to virtually anything on a device — files, browsing history, location information, and messages. It can even capture recordings of a user’s screen and turn on their webcam and microphone, Citizen Lab said.
Al Jazeera, the Qatar-based news organization, condemned the targeted surveillance of its journalists in a statement and called for those responsible to be held accountable.
But it will be a long road to achieve that accountability. As it stands, the capabilities of this technology are outpacing regulations that could rein it in, and the industry leaders who might create guardrails are failing to take adequate precautions.
“The AdFection attacks and espionage described in this report impact millions of people in dozens of countries,” the cybersecurity group said. “Existing laws and self-regulation by the industry failed to catch or prevent them.”
While big platforms like Google dropped Discover-Tech as a vendor once alerted to its malfeasance, Citizen Lab said it was concerned about an industrywide tendency towards lax vetting processes to begin with.
“[The advertising] industry appears to perform no meaningful due diligence on participating vendors, instead improperly relying on self-attestation where vendors check a box on an online form,” it stated. “This process allows widespread privacy abuses, including failing to prevent mass espionage via targeted ads.”
Citizen Lab cautioned that the task of regulation is complicated by Discover-Tech’s global presence. The firm was able to show ads — which could be for items as innocuous as a fitness watch or running shoes — on hundreds of thousands of websites across 228 countries.
Worryingly, this included devices connected to “national-security-sensitive” networks across the world — including the Pentagon, the International Atomic Energy Agency, and NATO.
While Discover-Tech ads being shown on a device connected to one of these networks doesn’t necessarily mean that device was targeted, Citizen Lab said that “the fact that Discover-Tech was able to bid on and show ads on these networks highlights the systemic risk posed by AdFection.”
The cybersecurity researchers encouraged investigations as a starting point for regulation, both to determine whether breaches had already occurred and to help officials gain an understanding of the risks ahead. They also emphasized the need for privacy regulations to be tightened, third party audits to be standard practice, and for existing laws to be far more rigorously enforced around the world.
Ultimately, Citizen Lab emphasized that use of a trusted ad-blocker — for governments and individuals — is a “cybersecurity best practice.”
——————————————————-
Click Here For The Original Source.
