SATISH SHARMA - not just Rotigraphy.: A MAJOR NEW danger for internet users was revealed today. A “zero-click mercenary spyware” program has been deployed by an Israeli company,

https://x.com/NuryVittachi/status/2110941014731206850

A MAJOR NEW danger for internet users was revealed today. A “zero-click mercenary spyware” program has been deployed by an Israeli company, researchers at the University of Toronto warned.

It enables the hacking of your phone or computer using ads on your screen—without any need to trick you into clicking anything.

“This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads,” said the Canadian research group, known as Citizens' Lab.

It is already in wide use, with millions of cases, and has hit some well known organizations. 

“It was used to infect devices at Al Jazeera with Candiru’s spyware,” said the group. Candiru is a Tel Aviv company specializing in cyber-espionage. The United Nations was also targeted.

.

THROUGH A LOOPHOLE
How does it work? Most people think of ads as just pictures: but they also contain code designed for “targeted advertising” – and it is that invisible step that is taken advantage of by a firm called Discover-Tech.

The Israel firm has a software platform called Controlium which uses ads to harvest your identity and IP address. 

You can then be selected as a target for hacking, in which a mercenary spyware firm sends a malicious code containing spyware to your device, the researchers said in a lengthy report.

.

DATA GOES TO CYBER-ESPIONAGE FIRMS
The Tel Aviv company has relations with a number of cyber espionage groups. 

“Discover-Tech ads are used to infect and profile on behalf of mercenary spyware vendor Candiru,” the report said. 

“We also detail connections between Discover-Tech and another mercenary hacking company, Bindecy, as well as connections with Intelos, a mercenary ADINT firm.” (ADINT stands for advertising intelligence.)

The result is a new type of danger, which the researchers called “AdFection” – because you end up with a computer infected through ads.  

.

MILLIONS OF VICTIMS
While the process is promoted as an ad placement system, the hacking puts ordinary people in danger of industrial or other forms of espionage, researchers at Citizen Lab warned. 

Multiple screens at Al Jazeera were infected by spyware through the system, for example.

“Our research showed large-scale data collection from millions of devices involving Discover-Tech and Candiru,” the report said.

.

STEPS FOR PROTECTION
The Toronto watchdog group say that companies need to take a number of steps to protect themselves from espionage.

- Use ad-blocking software.

- Never click Yes to on-screen offers to give you “targeted ads”.

- Block such ads at your firm's gateway level if you can.

- Get your company cyber-security staff to watch specifically for “adfection” attacks.

- If you use advertising on site, try to limit the ads to those of trusted partners.

- Ad agencies must audit their list of groups whose ads they distribute. 

The researchers contacted Discover-Tech Ltd, Candiru (Integrity Labs), Bindecy, and others, before publishing the report for comment. None of them responded.

A link to the full report is supplied in the comments.
.
.