Researchers at The Citizen Lab have for the first time released technical evidence of sophisticated mercenary spyware being distributed via online advertising.
I tracked down a few different versions of the story on the web, but I couldn’t find any indication of iOS of Android. I’m assuming Android, though - doesn’t Apple control ads on their platforms? Because Google is fingered as one of the ways these ads are being distributed…
Analysis of four billion Discover-Tech bidding records shows that during a four-month period, the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries.
That too. There are no details that say “[iOS/Android] is vulerable to 0-click RCE” and there are no details about which OSes are vulerable. It would be great if they mentioned any of those details at all, even if just to say that they do not have those details. Instead we’re left with FUD.
I don’t see anything that says either are vulnerable. The closest I can find is “exploit vulnerabilities across numerous mobile carriers”. The CVEs they list are for Chrome, Windows Kernel, and Microsoft Office.
I tracked down a few different versions of the story on the web, but I couldn’t find any indication of iOS of Android. I’m assuming Android, though - doesn’t Apple control ads on their platforms? Because Google is fingered as one of the ways these ads are being distributed…
it’s both
better link: https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
They say iOS and Android, but they don’t say which OS can be infected.
you mean which versions?
That too. There are no details that say “[iOS/Android] is vulerable to 0-click RCE” and there are no details about which OSes are vulerable. It would be great if they mentioned any of those details at all, even if just to say that they do not have those details. Instead we’re left with FUD.
I don’t get it, Android and iOS are OSes, the article I linked says both are vulnerable, are you reading the main article ?
I don’t see anything that says either are vulnerable. The closest I can find is “exploit vulnerabilities across numerous mobile carriers”. The CVEs they list are for Chrome, Windows Kernel, and Microsoft Office.
Sorry what I meant is, are you reading the wain article instead of the one I linked above?
Thank you! I admit the hunt for an answer started frustrating me; I visited that link, but clearly didn’t read the page carefully enough…