Online Ads Can Infect Your Device with Spyware
Online Ads Can Infect Your Device with Spyware
An investigative report reveals that new spyware can slip in unseen through online ads—and there is currently no defense against it. So not only that online ads are intrusive and can infect devices through malware, they can also be used for spying.
and there is currently no defense against it.
Don't load ads. There, problem solved.
I swear 90% of the world not aware of adblocker.
And then 9% out of that remaining 10% just can't be bothered to install them for some insane reason.
I think I heard that usage on desktop is something like 1 in 4, which is pretty good. Mobile is another world altogether, since it requires different browsers that support adblocking and then accessing websites through the browser instead of the app for the website, which many users would definitely prefer to use.
There is no defense?
Imagine a world without Adblocker, haha!
There is no defence they will tell you about. No ADs for you means less money for them
“We did nothing, and are all out of ideas.”
The FBI recommends using an ad blocker for precisely this reason.
Are we back in 1995? This should be common knowledge.
Blocking ads to avoid their malware was the #1 reason to have adblocker.
Actually it's not really a problem anymore. Browsers have become probably the most secure softwares on your computer.
0days for browsers are crazy expensive. Unless you're targeted by state actors you have nothing to worry about.
Defense against it
But if corporate media reported on ways to block ads, it'd eat into their own bottom line, so I can understand their choice to skirt the whole "ads are blockable with some level of effort" conversation.
I've been blocking online ads for nearly the entirety of my multi-decade usage of the internet, to the point where seeing them now is actually quite jarring. The fact that they're now a prime vector for malware and spyware/capitalist surveillance just one-ups the decision to block them just for the annoyance factor.
Yea, that's not new. Malware in ads has been around for like a decade. None of the major ad providers have given zero fucks about it so an ad blocker is mandatory and with Google trying to make ad blocking harder to impossible it's only a matter of time until some major issues with this malware happens.
But now they being used for targeting devices by Spyware! Another reason to hate ads.
AdGuard DNS for android :)
This is using some vulnerability in iOS. I'm an Android and Linux guy, but let's hope Apple quickly finds the bug and fixes it. And fuck that agency for not alerting Apple and instead profiting from it. And fuck the Israeli government for enabling them.
Edit: I misread, supposedly this is miraculously able to target every device.
Even better: Thanks to ad tracking you can show specific malware to a specific cohort of people. Want to get spyware on every computer in DC? Just sign up for our ad program!
This sort of creepitude isn't even specific to online ads.
You know postal junk mail? The "direct marketing" companies that enable it will cheerfully sell you a list of the home addresses of people meeting any demographic characteristics you want.
Do you have reason to want a list of 18-25-year-old gay men in the Boston area, widowed Asians in San Francisco, or military veterans in Oklahoma City? With their names, ages, and their home addresses?
They can sell you one, perfectly legally, and it's not even that expensive.
From the article:
What sets Insanet’s Sherlock apart from Pegasus is its exploitation of ad networks rather than vulnerabilities in phones. A Sherlock user creates an ad campaign that narrowly focuses on the target’s demographic and location, and places a spyware-laden ad with an ad exchange. Once the ad is served to a web page that the target views, the spyware is secretly installed on the target’s phone or computer.
If they're using ads on a web page to install spyware, then they're most definitely exploiting vulnerabilities—unless they're showing the user a 'do you want to install XYZ?', in which case this isn't newsworthy at all. Ads aren't some magical thing that can just go around installing shit silently, so I don't know wtf the article is going on about, but it doesn't make sense.
Edit: The Register seems to have a more sensible take on it: https://www.theregister.com/2023/09/16/insanet_spyware/
Apple released an update day before yesterday, and another today.
And still websites are pissed that I block ads. Websites, the adblocker is not there to annoy you, it is there to protect me from your foolishness and lazyness when it comes to weed out bad actors.
And when websites demand I turn off the adblocker, I just close it.
Unity also purchased a company last year that was notorious for turning a blind eye to malvertisers
An adblocker in this day and time is must for internet usage.
Or offload them at the DNS so they dont even get to the device in the first instance.
I do so love my Pihole. I forget how many ads are all over websites until I load up some site on a machine outside of my network.
dns-based solutions don't get them all.
I use(and recommend) both for the best user experience.UBlock origin's element zapper feature has changed my life.