An Israeli company that presents itself as a legitimate digital advertising business is helping spyware vendors use targeted online ads to deliver surveillance malware to individuals and entities worldwide, researchers are warning.
The technique, dubbed “AdFection” by researchers at the University of Toronto’s Citizen Lab, can enable infections without victims clicking links or taking any other action, essentially turning routine ad impressions into potential launchpads for covert cyberattacks.
In a recent report, the researchers detailed how an ad-tech company called Discover-Tech allegedly used the AdFection technique to help spyware vendor Candiru infect at least 45 devices belonging to personnel at international news organization Al-Jazeera. Candiru, which now calls itself Integrity Labs, is a company that the US Department of Commerce previously placed in its Entity List of individuals and organizations subject to export restrictions for providing foreign governments with spyware to target individuals.
The AdFection Cyberattack Chain
Citizen Lab has a long record of investigating the abuse of commercial spyware by government agencies around the world. In 2016 for instance, it reported on how the NSO Group had been quietly exploiting three zero-day vulnerabilities in Apple’s iOS software to deliver its Pegasus spyware on devices belonging to select journalists and activists. More recently, Citizen Lab reported zero-click attacks that delivered Pegasus spyware to human rights workers in Mexico and a commercial spyware tool dubbed Paragon to spy on prominent journalists.
According to Citizen Lab, Discover-Tech’s AdFection technique moves on from prior attack types in that it relies on a real-time bidding process that determines which ads users see on websites and in mobile apps. These auctions take place in milliseconds as a page or app loads, and can expose information about users and their devices, including IP addresses, mobile advertising IDs, and cookies. Advertisers typically use these identifiers to target individuals with tailored ads that often can also execute code of their own within a browser or app. The capabilities create a pathway for surveillance operators to identify devices of interest, gather information about their users, and deliver spyware when a targeted ad is displayed, Citizen Lab said.
The AdFection attack chain begins with Display-Tech winning one of these bids, then pushing an ad out to a website or an app that might be open on a user’s device. When the ad renders, a tag embedded inside it, contacts a Discover-Tech-controlled server, and supplies identifying information about the device. The server checks whether the device matches specific targeting criteria and returns JavaScript if it does, or an empty response if it doesn’t. Citizen Lab was unable to recover the JavaScript itself, but network logs that Al Jazeera supplied showed infected devices contacting Discover-Tech infrastructure, then Candiru validator servers, and ultimately a Candiru command-and-control server.
Discover-Tech’s Controlium platform lets customers configure campaigns to target specific devices using IP addresses, cookies, and mobile advertising IDs, Citizen Lab said. Citizen Lab’s analysis showed that over a four-month period alone, Discover-Tech served targeted ads to almost 200,000 unique websites and Android/iOS applications across dozens of countries. Citizen Lab said it found Discover-Tech served ads on devices associated with a wide range of government, military, critical infrastructure, media, and multilateral agencies across multiple countries.
The ad impressions by themselves do not confirm targeting or infection, Citizen Lab stressed. But it does highlight “the systemic risk posed by AdFection and the advertising ecosystem and warrants urgent investigation to determine whether any users on these networks were infected with spyware.”
Ad Impressions Become Enabler of Mass Spying
Citizen Lab also linked Discover-Tech to other surveillance players, including mercenary hacking firm Bindecy and advertising-intelligence company Intelos, but said its strongest technical evidence of spyware infections delivered through targeted ads involved Candiru.
In addition, Citizen Lab plans to describe in a forthcoming report how another threat actor, which it tracks as Dark Cartographer, is using Discover-Tech’s infrastructure to exploit weaknesses in mobile carrier systems to link device advertising IDs with phone numbers. The exploits involve WebRTC IP leaks, mobile-carrier HTTP header enrichment and so-called zero-click login mechanisms. The researchers found indications of Dark Cartographer exploitation across mobile providers in more than 30 countries.
“Discover-Tech operates a platform called Controlium that enables its mercenary partners to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered — a form of zero-click attack,” Citizen Lab researchers wrote.
The company’s “mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report,” they noted.
Google, the Interactive Advertising Bureau (IAB) Europe and ad-tech platforms Beeswax, Vungle (Liftoff), and Eskimi have taken steps to cut off Discover-Tech’s access to the digital advertising ecosystem following Citizen Lab’s disclosures, the report noted. Google, which collaborated with Citizen Lab, has terminated the company’s access to its ad exchange platforms. IAB Europe has removed Discover-Tech from its vendor registries, Beeswax has removed it from its ad-buying platform, Eskimi has blocked the company’s accounts and domains, and Vungle has paused Discover-Tech access while it conducts a review.
The Online Ad Industry’s Role
Citizen Lab described its findings as the first technical evidence of malicious actors delivering mercenary spyware through targeted ads, without any user interaction. The researchers noted how Discover-Tech may have profiled millions of devices in its effort to help spyware operators identify potential surveillance targets.
The report also raised broader concerns about the advertising industry’s role in enabling surveillance.
Citizen Lab noted how Discover-Tech had been embedded in the digital advertising ecosystem for years despite its known links to the spyware industry. The researchers called for stronger safeguards across the advertising industry and recommended that organizations consider blocking targeted ads at their network gateways to reduce exposure to AdFection attacks. Citizen Lab also recommended that government agencies mandatorily deploy ad-blocking software for all government-owned devices and disable unique advertising IDs on all government mobile devices.
