Lessons Learned From 'AdFection' and What To Do Next

Last week, researchers at Citizen Lab revealed a horrifying new malware campaign, dubbed 'AdFection.' It used an ad network to distribute spyware to journalists' devices to infect them without the target ever needing to click anything. This sort of attack on journalists is dangerous and incredibly concerning, especially since it's built on the backbone of a technology we already object to: behavioral advertising.

Although this type of attack has only been described targeting journalists, you can take steps to mitigate the risk no matter who you are. A few factors combined to make this attack a noteworthy first-of-its-kind. First, it utilized the surveillance ad-tech ecosystem to specially target the malicious code. Second, the spyware it delivered was so-called 'zero-click,' meaning it required no interaction from the user to be infected.

How the Attack Works

The attack begins when someone browsing the web or using an app on a targeted machine is served an ad created by Discover-Tech, a company exposed in the report as 'purporting to be a legitimate advertising company, [but] appears to be a front for large-scale ad espionage abuse.' The ad contains a small snippet of JavaScript code which is automatically executed when rendered in the app or website.

This code reaches back out to a Discover-Tech server, referred to as their 'NOAS server,' with detailed information about the machine rendering it: its cookie-set advertising ID, IP address, and more. The NOAS server uses this detailed information to determine it is an Al Jazeera machine requesting the ad. Instead of returning an empty response, it responds with a malicious, zero-click spyware payload created by Discover-Tech's partner Candiru/Integrity Labs, a company previously exposed for involvement in sophisticated malware attacks.

Broader Implications

Companies targeting zero-click malware attacks against journalists might seem like the plot of a blockbuster spy thriller, but this attack was enabled by the everyday practices of ad-tech companies, which unfortunately have extreme latitude in the collection of users' data. By leveraging tracking identifiers and data collected on devices for delivering targeted ads, mercenary spyware companies can repurpose this data to fine-tune who they infect.

Most ads are not delivered directly by the ad creators, but rather by intermediaries that facilitate Real-Time Bidding auctions. Winning bidders are given the ability to execute JavaScript code in the browser of the person who receives the targeted ad, which allows for interactive ads but also for device compromise just by delivery of malicious code.

Protective Measures

While working towards fundamental fixes to the ad ecosystem and banning online behavioral ads, individuals must take steps to protect themselves. Citizen Lab outlines several measures depending on your threat model. Establish strong security fundamentals using resources like Surveillance Self-Defense and Consumer Reports' Security Planner.

Use browser extensions to reduce tracking, such as Privacy Badger, or consider network-wide ad blocking services. On mobile phones, disable or reset your AD ID. Using more privacy-protective browsers can also help. These steps can be very helpful, but there is only so much individuals can do. Banning behavioral ads like this would be a good place to start, as they aren't just a privacy nightmare—they're the perfect vehicle for malvertising and similar threats.