Israeli Spyware Ads Target Australian Government and Media Networks
A recent report has highlighted that online advertisements linked to an Israeli firm have reached critical Australian government networks and media organizations. The findings, published by the University of Toronto's Citizen Lab, indicate that the company, Discover-Tech, masqueraded as a standard online advertising business while facilitating tracking and potential spyware deployment.
The report, titled Exposing Adfection, details how Discover-Tech utilized online advertising to gather information about devices. When ads are displayed on websites or apps, the space is auctioned off quickly, with companies receiving data about the device that will show the ad, including its internet address and tracking ID. This information can reveal the device's approximate location and the organization it connects to.
Discover-Tech's Controlium control panel allowed clients to target specific devices using tracking IDs or internet addresses, enabling campaigns to be restricted to particular countries. The ads were not merely visual; they contained code that could execute small programs on the device displaying the ad. For most users, the ads did not lead to further action. However, for selected targets, the ads could trigger a response that might infect the device without any user interaction.
Citizen Lab reported a significant number of ad impressions in Australia, particularly on networks associated with the Australian Nuclear Science and Technology Organisation (ANSTO) and other critical infrastructure operators. ANSTO confirmed awareness of the report and stated that it had not identified any impact on its systems from the described techniques. However, the agency did not disclose whether it blocks ads on its network.
Concerns Over Ad Presence in Sensitive Networks
The report emphasized that the mere appearance of an ad does not confirm that a device was targeted or infected. Nonetheless, the presence of these ads in sensitive networks has raised alarms about potential security threats. Discover-Tech reportedly bid to show ads 3.77 billion times between March and June, winning approximately 442 million auctions. The ads appeared in numerous mobile apps and websites, including popular platforms like Viber and Duolingo.
Approved for Dissemination
In response to the findings, the Australian Signals Directorate (ASD) has reiterated the importance of ad blocking as part of its security framework. The ASD's new Essentials framework emphasizes filtering internet content and urges organizations to consider all connections made by their applications, not just web browsers. Given that a significant portion of Discover-Tech's ad bids were for mobile apps, where traditional browser ad blockers do not apply, the agency's recommendations are particularly relevant.
Citizen Lab has called for mandatory ad blocking on government devices and networks, highlighting the systemic security risks posed by current online advertising practices. Following the report, Google removed Discover-Tech from its advertising platforms, and IAB Europe ceased its approval of the company as a vendor. Discover-Tech did not respond to inquiries from Citizen Lab regarding the allegations.
