What if you simply viewed an ad and your device got infected?
Zero-click spyware exposes the limits of cybersecurity training and puts the onus on employers to stop intrusions.
Sign up now: Get ST's newsletters delivered to your inbox
Users cannot repair a flaw in their browser or operating system, but they can make their devices harder to compromise, says the writer.
PHOTO: LIANHE ZAOBAO
Victor Keong
Time and again, we are reminded: Don’t click on a suspicious link. But what if spyware can be delivered to us through an online advertisement, without any action on our part?
On Oct 15, researchers at the University of Toronto’s Citizen Lab and Confiant, a New York-based advertising security firm, reported exactly such a finding. They said that an Israeli advertising company, Discover-Tech, had given spyware makers, including Candiru, access to advertising networks run by Google, Comcast and Yandex. Between March and June alone, Discover-Tech’s advertisements appeared on about 75,000 apps and 120,000 websites.