Senators and ad industry clash over AdFection report on targeted ads delivering Candiru zero-click spyware via Discover-Tech
Sens. Ron Wyden and Cory Booker say the Citizen Lab and Confiant report on AdFection shows that targeted online advertising is a security risk and that the industry needs reform. AdFection is a technique in which targeted ads delivered zero-click mercenary spyware. Ads from Discover-Tech, the company most linked to AdFection, reached government networks. Wyden is urging agencies to disable ads on government browsers and turn off mobile ad IDs. Google and IAB Europe dispute the report's framing: Google says it banned Discover-Tech and blocks malicious ads, and IAB Europe says the findings point to misuse of web technologies rather than broken ad infrastructure.
Detalhes técnicos
- The report links the spyware firm Candiru to infections of users through Discover-Tech online ads.
- Discover-Tech appeared on "certified" and "approved" vendor lists maintained by Google and IAB Europe.
- Google, IAB Europe and the ad networks Beeswax, Vungle and Eskimi removed Discover-Tech's access to the ad ecosystem. Microsoft, which owns Xandr, did not respond to Citizen Lab or CyberScoop.
- Google says banning Discover-Tech outright required proof that its infrastructure was linked to spyware, while individual bad ads were blocked continuously. It also says its automated systems caught over 99% of policy-violating ads last year.
- Citizen Lab criticised "a dangerous lack of due diligence" and "broken digital infrastructure" in the ad sector.
Remediação
- Citizen Lab recommends that ad vendors share threat data, improve partner vetting, audit vendor registries and ban vendors by default in jurisdictions permissive of abuse.
- It urges regulators to investigate Discover-Tech and Candiru, scrutinise the ad ecosystem for other espionage use, and pursue sanctions against mercenary spyware firms and their enablers.
- Wyden urges disabling ads on government browsers and turning off mobile ad IDs. Several U.S. agencies have already blocked ads or recommended blocking them.
Linha do tempo
-
Senators and ad industry clash over AdFection report on targeted ads delivering Candiru zero-click spyware via Discover-Tech
ler a análise desta fonte ocultar
Sens. Ron Wyden and Cory Booker say the Citizen Lab and Confiant report on AdFection shows that targeted online advertising is a security risk and that the industry needs reform. AdFection is a technique in which targeted ads delivered zero-click mercenary spyware. Ads from Discover-Tech, the company most linked to AdFection, reached government networks. Wyden is urging agencies to disable ads on government browsers and turn off mobile ad IDs. Google and IAB Europe dispute the report's framing: Google says it banned Discover-Tech and blocks malicious ads, and IAB Europe says the findings point to misuse of web technologies rather than broken ad infrastructure.
Technical Details
- The report links the spyware firm Candiru to infections of users through Discover-Tech online ads.
- Discover-Tech appeared on "certified" and "approved" vendor lists maintained by Google and IAB Europe.
- Google, IAB Europe and the ad networks Beeswax, Vungle and Eskimi removed Discover-Tech's access to the ad ecosystem. Microsoft, which owns Xandr, did not respond to Citizen Lab or CyberScoop.
- Google says banning Discover-Tech outright required proof that its infrastructure was linked to spyware, while individual bad ads were blocked continuously. It also says its automated systems caught over 99% of policy-violating ads last year.
- Citizen Lab criticised "a dangerous lack of due diligence" and "broken digital infrastructure" in the ad sector.
Remediation
- Citizen Lab recommends that ad vendors share threat data, improve partner vetting, audit vendor registries and ban vendors by default in jurisdictions permissive of abuse.
- It urges regulators to investigate Discover-Tech and Candiru, scrutinise the ad ecosystem for other espionage use, and pursue sanctions against mercenary spyware firms and their enablers.
- Wyden urges disabling ads on government browsers and turning off mobile ad IDs. Several U.S. agencies have already blocked ads or recommended blocking them.