How Israeli firm’s ‘zero-click’ malware attack poses global security risk

The University of Toronto's Citizen Lab says devices at Al Jazeera were infected with mercenary spyware from Candiru (rebranded as "Integrity Labs") via targeted online advertisements.[2] Bloomberg reports that Candiru and ad-tech firm Discover Tech used online advertising platforms to target and infect 45 devices at Al Jazeera.[3]Citizen Lab says Discover-Tech's Controlium platform lets partners "de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered"[2]. Al Jazeera reports that the malware can capture keystrokes, take screenshots, record microphone and webcam input, and extract emails and messages[4].TU Dublin lecturer Stephen O'Shaughnessy told Al Jazeera that "because no message or link is involved, there is almost nothing for the victim to notice."[1]Middle East Eye reports that Confiant co-founder Jerome Dangu said "very likely hundreds of millions of people would have been touched by Discover-Tech."[5] Dangu also said the ads reached networks including the Pentagon, the International Atomic Energy Agency, and the International Criminal Court.[5] O'Shaughnessy told Al Jazeera that infection has not been confirmed there, only profiling of users.[1]An Al Jazeera spokesperson told CBC News that "this is a deliberate attack on journalists and on press freedom"[6].According to SOFX, Google ended Discover-Tech's ad-platform access, IAB Europe suspended the firm, and Comcast-owned Beeswax removed it.[7] SOFX also reports that Discover-Tech, Candiru, Bindecy, and Intelos did not respond to the researchers' requests for comment.[7]