Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
研究人员称，在线广告已被武器化，用于传播“零点击”间谍软件。
Millions of users worldwide have been served ads by Discover-Tech since 2024, say researchers. An Israeli advertising agency has been serving millions of online adverts that allow “zero-click” spyware to be used against targets, researchers at a Canadian university have said.
研究人员表示，自2024年以来，全球数百万用户收到了来自Discover-Tech的广告。加拿大一所大学的研究人员称，一家以色列广告代理商一直在投放数百万条在线广告，这些广告允许针对目标使用“零点击”间谍软件。
Citizen Lab, a digital investigations research unit at the University of Toronto, said it believed dozens of devices at the Qatari broadcaster Al Jazeera had been compromised by spyware delivered through ads run by Discover-Tech, which describes itself as a specialised digital advertising agency.
多伦多大学数字调查研究部门“公民实验室”（Citizen Lab）表示，他们认为卡塔尔半岛电视台的数十台设备已遭到间谍软件入侵，这些软件是通过Discover-Tech投放的广告传播的，该公司自称为一家专业数字广告代理商。
According to Citizen Lab, Discover-Tech operates a software platform called Controlium that allows its clients to “mass-profile and deanonymise” internet users then covertly hack targets with third-party spyware. Unlike infections that rely on people interacting with links or files, the spyware requires no interaction from the victim to be installed, making it a new delivery technique, Citizen Lab says.
据“公民实验室”称，Discover-Tech运营着一个名为Controlium的软件平台，允许其客户对互联网用户进行“大规模画像和去匿名化”，然后利用第三方间谍软件秘密入侵目标。该实验室表示，与依赖用户与链接或文件交互的感染方式不同，这种间谍软件无需受害者进行任何交互即可安装，这是一种新的传播技术。
The infections happen without a user’s knowledge, and in a matter of seconds, according to Citizen Lab. “[The online advertising] ecosystem is being weaponised at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware,” the report says.
据“公民实验室”称，感染过程在用户不知情的情况下发生，且仅需几秒钟。报告指出：“（在线广告）生态系统正被大规模武器化，用于对数百万用户进行画像，然后利用零点击雇佣间谍软件悄无声息地感染目标。”
According to the report, Controlium is able to harvest a user’s identity and IP address when the user is shown a seemingly benign custom-created ad – for example, for a digital game or a telecoms service. If the user has been selected as a target for hacking, a mercenary spyware firm can then send a malicious code containing spyware to their device, the researchers say.
报告显示，当用户看到看似无害的定制广告（例如数字游戏或电信服务广告）时，Controlium能够获取用户的身份和IP地址。研究人员称，如果用户被选为黑客攻击目标，雇佣间谍软件公司随后便可向其设备发送包含间谍软件的恶意代码。
They say that millions of users worldwide have been served ads by Discover-Tech since 2024, including in Yemen, Brazil, Mexico and Czechia. Related work by the research group Confiant also suggests that Discover-Tech’s ads have been shown to users of the networks of government entities in Europe and the US, as well as the UN, Nato, the international criminal court and the International Atomic Energy Agency.
他们表示，自2024年以来，全球数百万用户收到了来自Discover-Tech的广告，其中包括也门、巴西、墨西哥和捷克共和国的用户。研究小组Confiant的相关工作也表明，Discover-Tech的广告已出现在欧洲和美国政府实体，以及联合国、北约、国际刑事法院和国际原子能机构的网络用户面前。
“It’s disastrous that major ad vendors and organisations apparently were neither able to detect nor prevent the company’s malicious advertising operations for years,” said Wolfie Christl, a researcher at Citizen Lab. “The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike.”
“各大广告供应商和组织多年来显然既无法检测也无法阻止该公司的恶意广告运营，这简直是灾难性的，”公民实验室研究员沃尔菲·克里斯托（Wolfie Christl）表示。“当今在线广告生态系统的运作方式对国家、私营部门、公民社会以及其他所有人来说都是一种安全威胁。”
According to Citizen Lab, Controlium acts as a “facilitator” for third-party spyware firms that have targeted “government officials, journalists, businesspeople, activists, academics and embassy workers”. Citizen Lab claims it can deliver spyware that can access everything on the device of a target, extracting messages, photos and emails, recording calls and secretly activating microphones.
据“公民实验室”称，Controlium充当了第三方间谍软件公司的“推动者”，这些公司曾针对“政府官员、记者、商人、活动人士、学者和大使馆工作人员”进行攻击。该实验室声称，它能够传播可访问目标设备上所有内容的间谍软件，提取信息、照片和电子邮件，录制通话并秘密激活麦克风。
The full extent of the targeting allegedly enabled by Discover-Tech is unknown. Citizen Lab’s findings join mounting evidence that the opaque arrangements underpinning the world of online advertising can be leveraged for surveillance.
Discover-Tech所促成的攻击范围尚不完全清楚。“公民实验室”的发现进一步证明，支撑在线广告世界的各种不透明安排正被利用于监视活动。
“There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action,” said Bill Marczak, a researcher at Citizen Lab.
“关于在线广告可用于识别并以极高精度自动入侵目标的传言很多，但现在我们首次获得了具体的证据，展示了这一过程是如何运作的，”公民实验室研究员比尔·马尔扎克（Bill Marczak）说道。
When a user navigates to a website that shows advertisements, their details become part of a split-second programmatic auction involving dozens or hundreds of companies. These companies bid automatically to place an ad in front of that user.
当用户浏览显示广告的网站时，他们的详细信息会成为涉及数十或数百家公司的瞬间程序化拍卖的一部分。这些公司会自动竞价，以便将广告展示给该用户。
These bids are based on the user’s profile, which can include information about their device and data compiled on them by tracking their activity across the web. For example, companies given the profile of a 35-year-old interested in sports betting and crypto might bid to show that individual an advertisement for an energy drink.
这些竞价基于用户画像，其中可能包括有关其设备的信息，以及通过跟踪其网络活动所汇总的数据。例如，如果公司获得了一位对体育博彩和加密货币感兴趣的35岁用户的画像，它们可能会竞价向该个人展示能量饮料广告。
There is little regulation on this automated online market, and there is growing evidence that it is being exploited by malevolent actors. Reuters has reported that billions of dollars’ worth of Meta’s ad revenue comes from ads for scams, illegal gambling, pornography and other banned content. In the US, ICE and other government agencies have bought software that uses ad tech data to track people’s movements.
这个自动化在线市场几乎没有监管，且越来越多的证据表明它正被恶意行为者利用。路透社曾报道称，Meta数十亿美元的广告收入来自诈骗、非法赌博、色情和其他违禁内容的广告。在美国，移民及海关执法局（ICE）和其他政府机构已经购买了利用广告技术数据来追踪人们行踪的软件。
“Cybersecurity agencies, regulators and lawmakers in the US, Europe and other regions must urgently step in. They must investigate the involved companies and fix the systemic risks that enable malicious ad targeting,” said Christl.
“美国、欧洲和其他地区的网络安全机构、监管机构和立法者必须紧急介入。他们必须调查相关公司，并修复导致恶意广告定位的系统性风险，”克里斯托表示。