Among the major vendors that listed Discover-Tech as a “certified” or “verified” vendor were Google and advertising industry association IAB Europe. The Israeli company also used the consent frameworks of the European General Data Protection Regulation (GDPR) to target users within the European Union. Discover-Tech ran ads on major networks such as Google, Yandex and Beeswax.
Google and IAB Europe have since removed Discover-Tech from their ad provider registries, and Google has further terminated Discover-Tech’s access to its ad exchange platforms. Beeswax has removed Discover-Tech from its ad buying platform. Advertising platform Vungle (Liftoff) suspended Discover-Tech’s access while it conducted a review, and Eskimi blocked Discover-Tech’s accounts and domains.
Thursday’s report said Discover-Tech ad impressions appeared on government and national security networks around the world: NATO, United Nations networks, European legislative bodies, critical infrastructure providers in Australia, and armed forces and government agencies in Norway and Sweden.
“The massive abuses, privacy violations, and facilitation of mercenary spyware attacks by Discover-Tech illustrate structural flaws in the online advertising system, which failed to detect or prevent the abuses documented in this report,” Citizen Lab said.
The research lab said the mercenary malware installed via AdFection was developed and distributed by Candiru (renamed “Integrity Labs”). Under the agreement with Discover-Tech, targets with specific profiles of interest to Candiru customers received advertisements containing JavaScript or other code connected to Candiru’s control servers. In response, these servers delivered an exploit that delivered the zero-click payload when the ad appeared on an individual’s device.
The research does not describe the vulnerabilities exploited in zero-click attacks or the final malware installed there. It is likely that these are zero days that were fixed after Citizen Lab discovered the campaign. Citizen Lab did not immediately respond to questions.
Messages sent to Discover-Tech and Candiru went unanswered.
Citizen Lab called on advertisers and government officials to take concrete steps to proactively prevent campaigns like AdFection. Beyond that, users can reduce the risk of infection by installing ad blockers, resetting the mobile advertising ID in iOS and Android settings (it’s unclear why researchers didn’t advise turning off personalized ads completely), and installing ad-blocking software on home or work networks. As always, installing updates timely is also a must.
Gn bussni
