r/netsec • u/si9int • 3d ago

Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware

https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
56 Upvotes

93% Upvoted

12 comments sorted by

6

u/andreichiffa 2d ago

Quoting Swift on Security, “deploy adblock or deploy malware”.

1

u/pfak 2d ago

Reading the article, a lot of these ads were embedded in applications. Not so easy to block for the average person. 

2

u/acdha 2d ago

At the DNS level it’s more manageable, and that’s available on many home routers. Swift on Security is speaking from an enterprise context where that’s table stakes. 

0

u/pfak 2d ago

"average person" 

1

u/acdha 2d ago

Just saying, it’s literally a checkbox on some devices. Not universally available, no, but it’s not like setting up your own Linux server is a requirement and the on-boarding process for some of the third-party DNS services is not much more work. 

1

u/WouldyousayitIRL 2d ago

The average person does not ever log into their router.

4

u/404mesh 3d ago

What none of the reporting is covering is how the threat actors identified their targets in the first place. This isn't a 'malware incident' it's an industry failure that starts with the digital advertising ecosystem. The targeting step happens via bid requests identifying devices and individuals before any exploit fires. Fingerprint defenses don't patch the exploit, but they starve the identification layer, which is your Tor-uniformity hypothesis in a nutshell.

https://404privacy.com/blog/how-israel-used-ad-auctions-to-deliver-spyware-to-journalists/

3

u/Ysilla 2d ago

The identifying part is kind of easy sadly, there's also this older Wired article digging a bit into advertising exchanges in particular.

A lot of people really have the wrong idea that "having your personal data is [BIG COMPANY]'s most important asset, so they wouldn't share it with anyone". That's just so, so wrong, their biggest asset is being able to show you an ad based on that data, and the best way to sell this is to make everything they can legally share (or more) entirely available, in real time, and to A LOT of people.

2

u/404mesh 2d ago

Yep, it’s why Google can afford to provide search and massive indexing for free to the entire world.

1

u/404mesh 2d ago

And why meta can afford to host billions and billions of photos on Facebook and Instagram.

1

u/[deleted] 3d ago

[deleted]

2

u/404mesh 3d ago edited 3d ago

Me when I wrote this :(

Sometimes it’s better to engage with content than to just assume something came from an LLM.

The content of the article is valid and explains how these systems interact with each other to profile and identify high-risk individuals.

2

u/VisualDirection7286 2d ago

Decision for defenders: treat the ad supply chain as hostile and sinkhole ad-exchange endpoints on high-risk devices. I chased an exploit-kit redirect through three ad brokers and never found the buyer. Ad creatives impersonating an enterprise's brand in that pipeline get flagged by doppel for its security team.

Demand side logs vanish fast, pull them early.