Citizen Lab says ANSTO was targeted through online advertising — ABC News Australia
Networks of the Australian Nuclear Science and Technology Organisation (ANSTO) and other Australian government and critical institutions were targeted in a malicious online advertising scheme, research group Citizen Lab said. As ABC News Australia reports, researchers believe the advertisements were used to track millions of devices and install spyware on some of them.
Advertising with hidden code
Citizen Lab, a research laboratory at the University of Toronto, links the scheme to Israeli company Discover-Tech. According to the group, the company acted as an intermediary between advertising platforms, including Google, and companies that create spyware and hacking tools.
According to Citizen Lab, Discover-Tech took part in advertising auctions to display ads on websites and in apps, including Duolingo, BBC and The New York Times. When its ads won the auctions, users were shown advertisements that appeared ordinary but contained code capable of infecting a device.
Researchers described this mechanism as the use of zero-interaction spyware. The malicious code could run without clicking on an advertisement and install a backdoor that could potentially provide access to passwords, email and data on internal systems. At the same time, merely viewing such an advertisement did not guarantee that a device would be infected.
More current news is available on the UA.News Telegram channel Telegram.
Targeting Australian networks
Citizen Lab identified a significant cluster of ad impressions on the networks of Australian critical infrastructure facilities, government institutions, universities and media outlets. The report mentions ANSTO and its Australian Synchrotron research campus; according to the researchers, many targets were connected to nuclear research.
An ANSTO spokesperson said the organisation was aware of the reports but had not identified any impact from the described methods on its facilities, systems or information. Citizen Lab concluded that the advertising technology could also help identify devices, track web activity and determine geolocation for further targeting.
The researchers said they confirmed the infection of Al Jazeera devices through this scheme and traced the sequence from the display of an advertisement to contacts with the servers of spyware maker Candiru and the installation of files on computers. The report also states that Google removed Discover-Tech from its platform after the company was provided with the findings of Citizen Lab's investigation.
