The Digital Security Digest, by Freedom of the Press Foundation (FPF), is a weekly newsletter with security tips that keep you, your sources, and your devices safe. If someone shared this newsletter with you, please subscribe here.

Mercenary spyware uses ads to target journalists, governments, and industry actors

Researchers with The Citizen Lab at the University of Toronto published an analysis examining tools tied to mercenary spyware firm Candiru (now Integrity Labs). These advertisements have been used to conduct reconnaissance on millions of devices, and for one subset of users — including journalists at Al Jazeera — to deliver spyware.

Citizen Lab claims that a company called Discover-Tech presents itself as a legitimate advertising business, but in fact purchases ads on behalf of spyware firms, and offers a platform that allows partners to “precisely profile and de-anonymize millions of individuals, fingerprint their devices, and target them with a form of zero-click hacking, where their devices can be automatically infected when an ad is displayed to them.”

Discover-Tech would place bids for advertisements through major ad networks, delivered through mobile apps and browsers. The researchers identified ad impressions in networks tied to dozens of government entities around the world and the semiconductor industry. They identified ad impressions targeting media organizations in no fewer than eight countries, including at least 45 devices belonging to journalists at Al Jazeera.

What you can do

No-click advertising malware is extremely unusual and, as Citizen Lab notes, this is the first time they have identified it in the wild. However, more routine malicious advertising is not new. Because of the opacity and automation of the advertising ecosystem, even media organizations have been leveraged to deliver these ads. More commonly, you would have to click on a malicious link and/or download an application onto your device.

Practice the digital equivalent of handwashing. While it is a scary risk, zero-click spyware is relatively rare, and you are far more likely to run into more traditional malware that can be avoided by simply keeping your device up to date and declining to download any software or files you don’t strictly need. Consider also going through your settings to identify software you don’t need and uninstall it.

Block tracking in your browser. As Citizen Lab notes, you can use a browser that supports Global Privacy Control, a set of web specifications designed to inform businesses of a user’s preference not to have their personal data sold to or used by ad trackers. Privacy-focused browser extensions like the Electronic Frontier Foundation's Privacy Badger can also help provide this signal to advertisers and actively block common trackers while you browse the web.

Block advertisements. Mercenary malware vendors are always iterating on their techniques, and there is no permanent solution to this problem. But you can make their job harder, and the same applies to more routine tracking and malicious software delivered through ads.

  • Ad blocking extensions can help. uBlock Origin and uBlock Origin Lite are browser extensions for mobile and desktop that will allow you to prevent advertisements from appearing in the first place.
  • Some VPNs also block ads. If you already use a VPN, look in your app’s settings to see if this feature is supported. There is a lot of marketing hype around VPNs, so it’s important to understand their limitations. The primary benefit of a VPN is to prevent the websites and services you visit online from seeing your IP address; you may still be trackable in other ways, such as through browser cookies. To learn more, read our guide to choosing a reputable VPN.

Disable mobile ad IDs. Ordinary apps provide developers with tools to embed advertisements. Ad tracking may also include sensitive information tied to you, such as your location data. To lower the risk of this data being tied back to you individually, disable your mobile advertising ID from your phone’s settings.

  • iPhone users: Settings app > Privacy & security > Tracking > Disable Allow apps to request to track
  • Android users: Settings app > Security & privacy > Privacy controls > Ads > Delete advertising ID

Our team is always ready to assist journalists with digital security concerns. Reach out here, and stay safe and secure out there.

Best,
Martin Shelton
Deputy Director of Digital Security
Freedom of the Press Foundation