Ad-delivered spyware gives security sellers a new budget line customers have not planned for

What’s happened.

Researchers at the University of Toronto’s Citizen Lab, a research unit at the Munk School of Global Affairs and Public Policy, worked with the security firm Confiant and found something that had not been confirmed before: spyware delivered through ordinary online advertising, with no click from the user. Dozens of devices at Al Jazeera were infected with spyware built by the Israeli firm Candiru. The ads were bought by Discover-Tech, an Israel-based advertising company whose platform let spyware customers pick out and infect specific devices. When the ad is shown, the device’s internet address is sent to Discover-Tech’s servers; if that device is a target, malicious code is sent back and run by the browser or app without the person touching anything. The researchers call it “AdFection” and say the ads appeared on close to 200,000 websites and apps across dozens of countries, from dating apps to news articles on CBC. BetaKit covered the report, and Computing framed it as a security problem inside automated ad buying.

Citizen Lab and Confiant shared the findings with ad vendors including Google and Beeswax, both of which removed Discover-Tech’s access to their ad marketplaces. That closes one door, not the category. The weakness is in how automated ad buying works: anyone who can buy ad space can reach a device directly, and the device loads what it is sent.

For sellers of security services in Canada, this turns an abstract risk into something a chief executive understands in one sentence — an employee can be compromised by reading the news. Most companies have no line in the budget for ad-borne attacks, and most endpoint and awareness training programs are built around the assumption that someone has to click something first.