The most paranoid conspiracy theories of the programmatic-advert blocking crowd naturally turn out to be the reality of what's going on

There are many valid arguments for blocking ads on the internet, alongside one good reason not too. I myself am a real advocate of blocking given the state of the web.

One of the most important reasons to me is that the way they work essentially means companies surveil you and trade your ever-more personal data in return for the ability to run arbitrary code on your computer, for pennies given to some tech monopolist or other. This is exactly the sort of ability anyone trying to monitor, de-anoymise or or hack you, whether en masse or in a personalised manner, would dream of.

Paranoid delusions from people such as myself that probably read too much cyberpunk as a kid? Well no, not at all. It’s real. Thanks to the incredible work of Citizen Lab, we have concrete proof that it’s happening. Their report is lengthy but well worth reading for anyone concerned about this type of matter, which should really be anyone that uses the internet.

To quote from the summary:

Devices at international news network Al Jazeera were infected with mercenary spyware from Candiru (rebranded as “Integrity Labs”) via targeted online advertisements. We provide the first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted advertising, which we call AdFection.

The malicious advertisements were purchased by Discover-Tech, an Israeli company that presents itself as a legitimate advertising company, but which we found operates as a facilitator for multiple mercenary spyware partners.

Discover-Tech operates a platform called Controlium that enables its mercenary partners to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered — a form of zero-click attack.

Analysis of four billion Discover-Tech bidding records shows that during a four-month period, the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries.

Discover-Tech’s ads also covertly directed millions of devices to contact Candiru’s servers, likely for large-scale tracking and reconnaissance. Discover-Tech is linked to mercenary spyware and intelligence threat actors beyond Candiru, including Intelos and Bindecy.

A separate threat actor we call DARK CARTOGRAPHER is using Discover-Tech’s infrastructure to exploit vulnerabilities across numerous mobile carriers to link device advertising IDs with phone numbers, mass-deanonymizing internet users. We will detail our findings concerning this threat actor in a separate forthcoming report.

The ad networks themselves have, of course been incredibly incompetent in terms of detecting and proactively removing them.

Discover-Tech has appeared on lists of “certified” and “approved” vendors maintained by Google and advertising industry association IAB Europe, and has served ads via major networks such as Google, Yandex, and Beeswax. Discover-Tech has also leveraged the European General Data Protection Regulation (GDPR) consent frameworks to target users within the European Union. Discover-Tech’s mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report.

For what it’s worth, we are not talking about sketchy websites and apps here. Here’s a presumably non-comprehensive

Ads with attacker script tags were shown to users of 75,373 different Android and iOS apps and to visitors of 120,768 different websites in mobile and desktop browsers. These numbers refer to ads actually displayed to users of apps and websites rather than raw bids.

Android apps that displayed more than one million of those ads include MX Player and Lark Player:Music Player & MP3. The messenger Viber showed more than 700,000. The apps Snap VPN, Truecaller, and VivaCut – AI Video Editor displayed around half a million. The ads were deployed in email apps like Yahoo Mail, browser apps like Opera Mini, weather apps like German Wetter Online, learning apps like Duolingo, religious apps like WeMuslim, health apps like Period Calendar Period Tracker and in a large number of games like Bubble Shooter and Ludo STAR. Lower numbers of ads in the thousands were shown in family tracking apps like Location Share and in dating apps like Badoo and Grindr.

iOS apps deployed fewer of those ads than Android apps. The messenger Viber, which ranks second on iOS, showed only around 200,000 ads as compared to around 700,000 on Android. Still, the ads were displayed across a similarly wide range of iOS apps.

Note that most of these dangerous adverts were delivered via phone apps rather than the web. This, I assume, means that your typical web browser ad blocker would have been insufficient to protect you. You would need something more system or router level that analysing all the rogue data coming to your device.

Here’s Citizen Lab’s advice for the individual:

AdFection is a complex threat, and if you face elevated risk because of who you are or what you do, we strongly recommend seeking expert help. However, there are certain actions you can take to reduce some AdFection risks.

• Increase your overall security by following personalized instructions from the Security Planner.
• Use a trusted ad-blocking extension on your browser to reduce tracking.
• Consider using a privacy-respecting browser that blocks tracking and data-harvesting.
• Regularly reset your Mobile Advertising ID, disable ad-tracking, and use opt-out features of apps.
• Consider using an ad-blocking service on your network, such as at your home router, or use a trusted commercial VPN service that offers ad-blocking.

I have found tools such as AdGuard or NordVPN to be potentiallyuseful in this regard, although do your own due diligence to figure out whether or not they’d have protected against this particular attack.

The Citizen Lab report is also a fascinating insight into how one goes about gathering evidence when investigating something like this.