The University of Toronto's Citizen Lab has published research describing how Israel-based Discover-Tech used real-time ad auctions to profile and infect devices with spyware. According to the report, simply displaying a harmless-looking ad was enough to deliver malicious code to selected targets. The researchers conclude with high confidence that devices at the Al Jazeera network were infected with Candiru's spyware. The company's ads appeared in popular apps, from language and weather apps to dating services.

What it means: The research shows that digital advertising is not only a privacy issue but a security one. The data shared in every ad auction, such as the advertising ID and IP address, is enough to single out one person and attack them without any action on their part. For Greece the story carries extra weight, since the report links the company to people involved in the Predator surveillance affair. For businesses, the practical takeaway is that the phones of executives, lawyers and finance directors are likely targets and need matching protection. Steps such as turning off the advertising identifier, using high-protection modes like Lockdown Mode on iPhones, installing updates immediately and keeping unnecessary free apps off company devices all reduce the risk. For developers of ad-funded apps, the research also raises a question of responsibility: which ad networks are allowed to reach their users. European rules such as the Digital Services Act could push large platforms to check more carefully who buys ad space. Companies should add mobile threats to their security awareness training, because many staff still assume that spyware needs a suspicious link to be clicked before it can do any harm.

Read the original on The Citizen Lab

Related service: Custom software

Related stories