'Nightmare scenario' is here as zero-click software can now infect smartphones
Zero-click spyware is now a reality for smartphones, with new research discovering the frightening truth that certain ads could infect your phone with malicious software simply by appearing on your screen in an advert.
The research, conducted by experts from The Citizen Lab at the University of Toronto, has connected activity from an Israeli-registered advertising firm to specific servers linked to a spyware firm, with confirmation that smartphones can pick up malware from these ads.
While it shouldn't necessarily come as a surprise that almost anything you find on the internet could potentially create a vulnerability within your phone, what's so dangerous about this particular exploit is the 'zero-click' nature — relating to a process where your phone becomes infected without you ever doing anything.
Zero-click malware is among the most feared of its kind by cybersecurity experts as effectively anyone can fall prey to it, no matter how vigilant they are, and to know that there are ads out there that can cause such an issue is understandably something to fear.
Researchers identify zero-click spyware with 'AdFection'
Referred to by The Citizen Lab as AdFection, this malware was confirmed to have infected devices at international news platform Al Jazeera, with ad agency Discover-Tech being used as "a facilitator for multiple mercenary spyware partners."
Advert
As soon as one of these adverts is rendered on your device, it de-anonymizes, fingerprints, and automatically infects it, with this operation seemingly impacted anyone that has viewed more than 200,000 unique websites and smartphone apps across a four-month period.
Offering its assessment of the dangers this spyware operation proposed, The Citizen Lab outlined that "Discover-Tech's mass abuse, privacy invasion, and facilitation for mercenary spyware attack illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report."
On top of this, the researchers appeared to discover a separate threat actor, referred to as 'Dark Cartographer', who is taking advantage of the zero-click ad infrastructure operated by Discover-Tech to "exploit vulnerabilities across numerous mobile carriers to link device advertising IDs with phone numbers, mass-deanonymizing internet users."
What are the recommended next steps following this discovery?
While it's an incredible challenge to combat the potentially hundreds of thousands, if not millions of individuals potentially exposed to these zero-click adverts across the period of which Discover-Tech's operation was live, The Citizen Lab has called on regulators, governments, and tech companies to investigate the parties involved, alongside implementing laws and protections to prevent this from happening again.
It is vital that measures are put in place to prevent 'AdFection-style' attacks from happening again, but if the right action isn't taken then this could become even more prevalent, posing a major threat to the safety of all devices that are connected to and regularly use the internet.
The researchers reveal that the findings of their investigation were disclosed to leading ad ventors and industry organizations, adding that "Google, IAB Europe, Beeswax, Vungle (Liftoff), and Eskimi took action to disconnect Discover-Tech's access to the digital advertising ecosystem," but that's only the first step in what must be a wider plan to prevent further danger.