AdFection: Spyware Delivered to Journalists Through an Ad Network — Without a Single Click

Last week, researchers at Citizen Lab revealed a new malware campaign they call "AdFection." Its operators used an ad network to push spyware onto journalists' devices, infecting them without the target ever clicking anything. The Electronic Frontier Foundation (EFF) stresses what makes it especially alarming: the attack rides on a technology the organization has long opposed — behavioral advertising.

Neither malvertising nor zero-click infection is new on its own. What's novel about AdFection is the combination: a highly targeted, extremely dangerous, and hard-to-detect attack. All it takes is for the ad to be delivered and its bundled code to run automatically.

How it worked

EFF walks through the chain using one of the Windows machines supplied to researchers by Al Jazeera.

A user browsing the web or using an app is served an ad created by Discover-Tech. The report describes the firm as "purporting to be a legitimate advertising company" but apparently serving as "a front for large-scale ad espionage abuse."

The ad carries a small JavaScript snippet that runs automatically when rendered. The code calls back to a Discover-Tech server — their so-called NOAS server — with detailed information about the device: its cookie-set advertising ID, IP address, and more. So far, nothing unusual — this is how the targeted-ad industry works.

Then it gets interesting. From this data the server determines the request came from an Al Jazeera machine. Instead of the empty response it returns most of the time, it sends back a malicious zero-click payload. That payload was built by Discover-Tech's partner Candiru/Integrity Labs, a firm previously exposed for sophisticated malware. The payload executes and infects the device.

Zero-click attacks on journalists sound like a spy thriller, but this one was enabled by the everyday practices of ad-tech. By repurposing the tracking identifiers and data collected for targeting, mercenary spyware firms can fine-tune exactly whom they infect — and hide it from everyone else.

Most ads are delivered not by their creators but by intermediaries running Real-Time Bidding auctions. Even so, the winning bidder gets to execute JavaScript in the recipient's browser — useful for interactive ads, but, as seen here, also for compromising a device.

What you can do

EFF argues the fundamental fix is to ban behavioral advertising, which is the perfect vehicle for exactly this kind of threat. Until then, protection falls on users, and it matters most for journalists in heavily surveilled states. Citizen Lab and EFF suggest: establish strong security fundamentals, use a tracker-blocking extension such as Privacy Badger or a network-wide ad blocker, disable or reset the advertising ID on your phone, and consider more privacy-protective browsers.

Source: EFF Deeplinks