Ads served by DiscoverTech delivered spyware to at least 45 Al Jazeera devices, Citizen Lab says

A person at Al Jazeera opens a web page. According to Citizen Lab, that was the whole attack: no file to download and no link to click ^[1]. "Someone who gets hacked like this would not see anything amiss," said Bill Marczak, a senior researcher at Citizen Lab. "In fact, they might not even see any ad at all." ^[2]

NBC's version has the victim visiting a site on a vulnerable computer and seeing the ad ^[1]. Marczak says even the ad may go unseen ^[2]. We'd expect most threat models for ads to start from a click or a visible creative. A click is not required here, and by Marczak's account neither is a visible ad.

How new this is depends on the outlet. NBC says the report is the first time cybersecurity experts have shown that ad platforms can be used to hack visitors' devices ^[20]. Wired is narrower. Citizen Lab believes it has produced the first detailed, public technical evidence of sophisticated spyware infecting devices through digital ads ^[21], and Wired notes that attackers have used the ad ecosystem to spread malware before ^[22]. We'd use the narrower claim.

The evidence is Al Jazeera's own data. The outlet handed over network logs, and researchers used them to reconstruct the attacks ^[4]. DiscoverTech and its CEO did not respond to NBC ^[13]. Integrity Partners, believed to own Candiru's assets after US sanctions in 2021, did not respond to Wired ^[14].

Marczak puts the cause in how ads work. "The ability to push individualized, arbitrary content at specific users is a hallmark of the modern online ads ecosystem, and is perfectly suited to the mercenary spyware industry," he said ^[15]. Google's response was a block. "Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from our ad platforms for systematically violating our policies," a Google spokesperson said ^[8].

The intended victims are a narrow group. Spyware of this kind has repeatedly been used to crack down on journalists, human rights advocates and political opposition ^[18]. Citizen Lab had already reported that 36 Al Jazeera journalists and staff were hacked with what it said was Pegasus, made by NSO Group ^[19]. The sources show no targeting outside Al Jazeera.

For a rollout, we'd sort each group of staff devices on two questions. First, would a government customer of a spyware vendor want to hack a named person in this group? Second, can the organization enforce ad blocking on those devices, in browsers and in apps? By Citizen Lab's account, blocking ads as thoroughly as possible is the only protection an individual has ^[11].

A likely target with enforceable blocking gets the policy first. A likely target without it gets escalated, because nothing else protects that person individually. An unlikely target with blocking gets the policy at low priority. An unlikely target without it goes on the risk register, along with a watch on the vendor lists that Google and IAB Europe have already used against DiscoverTech ^[7].