An Israeli surveillance technology firm has run a large-scale operation to infect mobile phones with spyware using online advertisements to hack the devices, researchers said on Thursday.

Here is a bit more information that might help, I posted this in privacy too.

  • modestmeme@lemmy.world
    link
    fedilink
    arrow-up
    42
    ·
    3 days ago

    Internet gonna be off limits to most people soon enough… There’s spyware like this, but it’s a proof of concept that random a-hole hackers will develop into lolz…

  • Ricky Rigatoni@piefed.zip
    link
    fedilink
    English
    arrow-up
    26
    arrow-down
    1
    ·
    3 days ago

    I don’t remember the last time I loaded an app that has ads. Almost every app I have is from github or f-droid.

  • rockSlayer@lemmy.blahaj.zone
    link
    fedilink
    English
    arrow-up
    21
    ·
    3 days ago

    On Android, install the FOSS vpn ad blocker AdAway from F-Droid to block ads within apps. It isn’t perfect though, can’t stop Spotify ads

    • Maya S. Trojan@piefed.blahaj.zone
      link
      fedilink
      English
      arrow-up
      12
      ·
      3 days ago

      I already block an absolute fuck-ton stuff with Pi-hole, so I made a Wireguard VPN that pipes my phone through my local network. It’s been very effective at killing mobile app ads.

    • grue@lemmy.world
      link
      fedilink
      arrow-up
      7
      ·
      3 days ago

      On Android, my ad-blocking strategy is to use uBlock Origin with Firefox, and to not tolerate apps with built-in ads to begin with (getting most of them from F-Droid).

    • ɔiƚoxɘup@infosec.pub
      link
      fedilink
      arrow-up
      1
      ·
      edit-2
      2 days ago

      I use tracker control, Similar tool. I’ll look into that, sounds neat.

      E: It looks like tracker control is a little bit more granular, so I think I’ll stick with that.

      I’ll definitely keep this little gem in my back pocket, though. Looks like a coal app.

  • fonix232@fedia.io
    link
    fedilink
    arrow-up
    8
    ·
    3 days ago

    I run my own DNS based ad blockers, and use modded apps for platforms that enforce ads through their own domain, precisely because of this.

    What I find insane is that websites STILL try to use ad networks that have been proven time after time to be malicious actors and/or intentionally enabling malicious actors. We should really go back to the good old times of the internet where advertisers went to websites directly and had no middlemen holding their palms - also no JS, no scripting, no other BS, you get a fixed size banner where you can have an image and a URL redirect. With GIFV being a thing, you can render a full HD animated advert into a “GIF” that 99% of browsers will still play, but pose no danger to the end user.

    Or fuck it, I might even start such a business. Better rates, user friendly ads, no fucking Zioni spyware crap.

      • fonix232@fedia.io
        link
        fedilink
        arrow-up
        5
        ·
        3 days ago

        That’s… not the point. No ad today is a “simple text” block. It’s tons of JS (I’ve seen ads pull in 50-70kB of packed/minified JS), high res graphics and animations, videos, and so on.

  • NarrativeBear@lemmy.world
    link
    fedilink
    arrow-up
    14
    arrow-down
    1
    ·
    3 days ago

    I don’t really full understand the concept of “zero click” ads, and how that could possibly work. I would assume a browser should be robust enough to block unwanted downloads?

    Pretty scary stuff if just seeing a ad on a random website is enough for something to be installed on a phone or a pc.

    Anyone with more knowledge, can you elaborate?

    Also, I am using a full network ad blocker similar to Pihole. I barely see any ads on websites or apps, when connected to my home network (either through WiFi or VPN to my home)

    • Em Adespoton@lemmy.ca
      link
      fedilink
      arrow-up
      18
      ·
      3 days ago

      “Zero click” means you’ve already given something permission to run on your device.

      In this case, the ad network had permission to run scripts on the device, and they abused that privilege to run scripts that could install spyware.

      People like us who have always blocked active scripts and ads aren’t vulnerable to most of these “zero click” attacks because we already distrust the mechanisms they abuse.

      It’s why I prefer my email and texts to be pute text too, with no automation set to take action based on incoming unvetted content.

      • AgentSeven@lemmy.zip
        link
        fedilink
        arrow-up
        14
        ·
        3 days ago

        It’s why I prefer my email and texts to be pute text too, with no automation set to take action based on incoming unvetted content.

        An excellent point, I disable loading email images in every client I use, even if for no other reason than not giving them a way to recognize that the email was read and subsequently list me as a live target.

    • CrossingtheAbyss@lemmy.today
      link
      fedilink
      arrow-up
      9
      ·
      3 days ago

      Once an ad loaded, code inside it could contact a Discover-Tech server. That server decided whether the visitor was a chosen target. If the details matched, it could return JavaScript that loaded more code and began the infection process. No click was needed.

      This method works because modern ads are not always simple pictures or videos. They can include code for measuring views, tracking users, and loading content from other companies.

      Real-time bidding systems also share data within a fraction of a second so advertisers can decide whether to buy an ad slot. That data may include a device ID, IP address, location, and browser details. AdFection used this design to find selected devices and send code only to them, making the activity harder for ad platforms and security researchers to catch.

      https://cybersecuritynews.com/0-click-spyware-infects-devices/

  • mHtt@lemmy.ca
    link
    fedilink
    arrow-up
    4
    ·
    edit-2
    2 days ago

    the simple goyim in this thread cannot comprehend how the zionist master race loves us. By surveilling us constantly and disciplining us: our zionist overlords demonstrate their love for us. they allow us to exist; our simple savage goyim minds cannot understand because we are inferior. it is gods will. https://www.youtube.com/watch?v=XCCR8D7C0PU

  • Tollana1234567@lemmy.today
    link
    fedilink
    arrow-up
    4
    ·
    edit-2
    3 days ago

    my mobile uses adblocks, and other anti-tracking blockers, on FF or other forks. and who does israeli work with alot for spying and surveillance.

  • benjirenji@slrpnk.net
    link
    fedilink
    arrow-up
    1
    ·
    2 days ago

    I don’t have an Ad ID on e/OS Android, right? Can’t find the setting on my phone, but I think I’m already doing things wrong.