Findings revealed by the Citizen Lab team at the University of Toronto have shown that automated auction systems used in internet advertising can be turned into tools for cyber-surveillance operations. The investigation was deepened following the detection of unusual network traffic on the smartphones of Al Jazeera employees.
According to the research, the Israel-based ad-tech firm Discover-Tech manipulated RTB systems, known as real-time bidding, to collect data on targets' IP addresses, location information, and digital identities. It was noted that in this process, there is no need for the user to click on an ad or download any files.
RISK THAT CAN INFECT WITHOUT CLICKING
In Citizen Lab's analysis, it was reported that the attack architecture operates using a method known in cybersecurity literature as "zero-click." Accordingly, the brief display of malicious ad code in a browser or application screen can be sufficient to initiate the infection process on the target device.
The investigation reported that unpatched security vulnerabilities were exploited and that spyware belonging to Candiru was used in the operation. It was stated that the software in question could access emails, encrypted messages, photos, and browser cookies, and could remotely activate the microphone and camera.
Billions of auction records analyzed as part of the research revealed that the network in question was actively present in 75 thousand 373 Android and iOS applications, as well as 120 thousand 768 websites. It was noted that the networks where the espionage-targeted ads were displayed included institutions such as the Pentagon, NATO, the United Nations, the International Criminal Court, and the International Atomic Energy Agency.
It was reported that platforms with large user bases such as Yahoo, BBC, New York Times, Duolingo, AccuWeather, and Grindr were also part of this advertising ecosystem. Following the publication of the report, it was announced that Google had blocked Discover-Tech's access to its ad exchanges.
According to experts, the case shows that internet advertising can become a risky infrastructure not only for commercial targeting but also for advanced surveillance and cyber-attack techniques. The findings have brought the need for transparency and oversight in advertising technologies back to the agenda.
News Source: 12punto
