This New Cyberattack Can Infect Your Computer Just By Running An Ad

Common knowledge (and cybersecurity experts) says you still need some form of antivirus software on your computer. Of course, common-sense practices such as never clicking on attachments from emails you don't recognize should be your first line of defense, but some entities have found ways to infect your PC without you needing to lift a finger — or even press it down on a mouse button to click an infected link.

Recently, the news outlet Al Jazeera stated that its reporters had been bugged thanks to spyware. According to The Citizen Lab — part of the Munk School of Global Affairs & Public Policy, University of Toronto — this attack was the result of targeted ads that delivered "zero-click" spyware, aka, "AdFection." This cyberattack leveraged the basic functions of internet ads. Every ad is made up of code, usually in the form of HTML or JavaScript, that is rendered into an image. This code can gather data, such as internet cookies, public IPv6 addresses, and whether a person clicks on the ad. This information is then sent to companies that bid money for ad slots, which results in targeted ads. AdFection ads can also retrieve additional code that uses browser exploits to install spyware, even if a user doesn't actually see the ad.

In the case of Al Jazeera, the malware was traced to two companies, Discover-Tech and Integrity Labs (or as the latter was formerly known, Candiru — yes, as in the South American parasitic fish that can allegedly swim up human urethras). According to The Citizen Lab, these two companies worked hand in hand to carry out the attack — Integrity Labs supplied the spyware, while Discover-Tech provided the means to inject the malware via its ad platform known as Controlium.

In the spirit of fairness, the AdFection that Al Jazeera suffered from and reported came from targeted ads in the most literal of senses. Discover-Tech allegedly targeted reporters from the outlet, so most people are unlikely to be targeted. But that's not the point. The technology exists; people can install spyware on your computer almost whenever they want, but you aren't completely defenseless.

Let's imagine a hypothetical future where malicious actors get their hands on zero-click spyware and release it into the internet at large to infect as many people as possible. Your best defense is ad-blocker programs, since they prevent ads from even loading onto your browser. This is why you should always install these sorts of browser extensions — zero-click spyware can't install onto your PC if the ad that contains the initial payload can't load. Of course, since ads can also pop up on smart devices, you should also install phone apps designed to block ads. Switching to browsers that minimize tracking features (or turning off as many as possible on your browser of choice) can also help.

According to Al Jazeera, some ads potentially containing AdFection vectors cropped up in networks critical to various governments, including the Pentagon and International Criminal Court. As such, The Citizen Lab recommends government-level actions to minimize the damage. These include banning browsers with data harvesting capabilities on government devices, enforcing laws to discourage AdFection use, and encouraging ad vendors to investigate partners and audit vendors. If you can contact your congressperson to encourage such actions, you might want to do so. The sooner we stem the flow of AdFection ads, the better.