An Israeli ad company, DiscoverTech, has for years been secretly helping spyware developers place their hacking software on popular websites, researchers at Citizen Lab say, resulting in a cyberattack that targeted at least 45 devices at the news outlet Al Jazeera.The findings, documented in a report published Thursday by Citizen Lab, are the first time cybersecurity experts have shown how online ad platforms, so common across the internet that they are inescapable, can be used as a vector to hack visitors’ devices without their knowledge.“Any time we browse the internet or open an app, all the data on our device can be hacked by malicious actors without us even knowing,” said Natalia Krapiva, a spyware expert at the digital rights nonprofit Access Now, who read the report and was not involved with its research.“States and tech companies whose infrastructure is used to conduct these attacks need to take urgent technical, legal and regulatory measures.”The report is a joint effort between Confiant, a U.S.
ad security company, and the Citizen Lab, a University of Toronto operation that researches mercenary spyware computer programs.Spyware is often leased to governments around the world to help them hack devices of people they want to spy on.While spyware companies often tout their products as crucial tools for governments to enforce national security, the tech has repeatedly been used around the world to crack down on journalists, human rights advocates and political opposition.DiscoverTech is a Tel Aviv company that sells online advertising services, the report said.
“We take pride in providing our clients with a gateway to global fraud-free traffic, connecting your brand with real users,” its site says.DiscoverTech is one of a number of companies that help brands show their advertisements on websites that may be visited by potential customers.But the company secretly ran a separate program, the report says, that allowed spyware companies to inject ...