AdFection: Online Advertising Used for Zero-Click Spyware Attacks

• Researchers at the University of Toronto’s Citizen Lab have uncovered "AdFection," a technique where mobile devices are compromised by simply rendering a malicious advertisement, requiring no user click.
• The investigation identifies the Israeli firm Discover-Tech Ltd. as a critical link between the digital advertising ecosystem and the state-sponsored spyware industry, specifically involving the firm Candiru.
• Known targets of these zero-click attacks include journalists at Al Jazeera, as well as devices connected to NATO, various defense ministries, and critical infrastructure networks globally.

Mechanism of the Attack

• Discover-Tech exploited the "Real-Time Bidding" (RTB) system to track specific devices via advertising IDs and IP addresses.
• Through a platform called "Controlium," clients could target specific individuals to receive malicious code injected via standard ad delivery pipelines.
• The attack succeeds because online advertisements often execute code, allowing for immediate infection without the victim ever interacting with the ad.

Scope and Ecosystem Exploitation

• The study analyzed logs from approximately 3.8 billion ad-space bids. Popular applications identified include Wetter Online, Grindr, Badoo, Duolingo, and Viber.
• Discover-Tech held "certified" status with major players like Google and IAB Europe, which provided a veneer of legitimacy and facilitated access to user data until the company was removed following the discovery.
• Data indicates significant targeting activity in nations including Montenegro, Yemen, Armenia, Latvia, and the Seychelles when weighted by population.

Security Recommendations and Policy

• Security experts, including co-author Wolfie Christl, advocate that ad-blocking is now mandatory for IT security, as users have no reliable way to manually identify malicious ads.
• The researchers call for urgent regulatory intervention, including sanctions against spyware providers and the companies that facilitate these attacks.
• Infrastructure providers such as Google and ad-industry bodies are urged to implement rigorous screening for ad content and better transparency regarding their certified partners.