Zero-Click Spyware Delivered via Targeted Ads: AdFection

(citizenlab.ca)

161 points | by jcomp 6 hours ago

9 comments

  • Frieren 1 hour ago
    Ads providers should be held responsible for delivering malware. All the tracking (that includes fingerprinting for clients that do not want to be tracked) should also be illegal.

    How is this acceptable for society goes beyond me. And then corporations blame individuals when they get scammed. It is your fault that we have all your information and leak it everywhere, when it is not just directly sold.

    And add jail time to fines. Fines means nothing for the rich.

    • ticulatedspline 11 minutes ago
      nah, you'll never get there that way. Even if there was willpower to do it legislating these things is too hard.

      What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).

      If they win the landscape will change. It would set a precedent for civil liability for infecting your users even when it's not your content directly. That would likely spook the shit out of the market, security becomes a feature.

    • iamflimflam1 57 minutes ago
      That would mean some google people going to jail...
      • yummypaint 38 minutes ago
        If such a thing were passed, it can't apply retroactively. But yes, google people would go to jail when they inevitably flout it as they are accustomed to doing. We should make this happen.

        People in the US have a unique window of opportunity starting TODAY (Oct 2026) in many places with early voting. I implore everyone who is able to vote in the midterms to do so.

        • warkdarrior 4 minutes ago
          Which candidates support the "put ads providers in jail" platform?
      • tikimcfee 40 minutes ago
        Stop, stop, I can only dream so hard.
  • fhdkweig 2 hours ago
    A later submission has more comments: https://news.ycombinator.com/item?id=50103000 , 57 comments 1 hour ago
  • robotnikman 3 minutes ago
    >mercenary spyware from Candiru (rebranded as “Integrity Labs”)

    Hahaha, mercenary spyware and integrity in the same sentence, jfc

  • saagarjha 1 hour ago
    I’m a little confused how mobile ad targeting ends up as a DLL hijack?
    • woodruffw 4 minutes ago
      This was my first question as well. There’s a big gap between “ad network delivers JS” and a zero-click browser exploit. CitizenLab has done some great research including OSINT on the former, but there’s a conspicuous gap between it and the DLL ending up on the victim’s machine.
    • nielsbot 1 hour ago
      mobile ads can deliver JS-based exploits
      • saagarjha 54 minutes ago
        But how do the DLLs hack you
        • dwattttt 17 minutes ago
          They're vicious. A DLL once bit my sister.
  • the_giraffe 1 hour ago
    Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle...

    The CTO happens to have worked for Radware

    https://radware.com/

    https://www.innovid.com/about-us/news/mediaocean-completes-a...

    • saturn8601 18 minutes ago
      I wonder how we're going to unwind this mess in the upcoming years. It seems as if there was a concerted effort to plan this all out before Trump got elected, and then everything fell into place. They obviously have a post Trump plan ready to go. I partially blame the left(really the moderates) in the U.S. For being so unbelievably complacent that it led us to this mess. I just wonder how we're going to unwind this. Nothing lasts forever, but the transition in between states always tends to be disrupting.
      • the_giraffe 5 minutes ago
        The timing just seems very peculiar. I wish investigative journalists would do further investigation into this topic.
  • kotaKat 2 hours ago
    Apps should be required to disclose every single ad network they use as part of their app store disclosures. I want a lot more transparency as to where the ads are coming from inside the app itself.

    I've witnessed consumer apps throwing quite heinous malware/sketchware advertisements and watched the banners rotate between 4-5 different ad vendors to keep things hot and spicy.

    • itopaloglu83 1 hour ago
      The incentives are lopsided, there’s so much money to be made by selling access to you and your devices, and controlling you, than just taking your money.
      • Firaxus 1 hour ago
        Indeed, it seems there are some externalities that a 100% free market doesn’t protect against for which regulation is probably the best tool.

        A regulation here that applies to all app stores is even business friendly as an appstore which wanted to do this already wouldn’t be punished by trying to do this on their own, for the reasons you mentioned.

  • kleiba2 5 hours ago
    uBlock Origin ftw
    • rwaksmunski 48 minutes ago
      And wBlock on Safari.
    • tamimio 40 minutes ago
      Plus a dns based blocker for other apps. Android has an option ready for that, iPhone it will be like VPN.
    • dominojab 1 hour ago
      [dead]