Nuclear agency targeted by ad spyware

Australia's nuclear science agency and other sensitive government organisations were targeted by a foreign bad actor using weaponised online advertising to track millions of devices.

The Citizen Lab finds the attack

Research group The Citizen Lab discovered an Israel-based company exploited digital advertising technology to install back doors onto devices merely by victims viewing an advertisement.

Millions of devices targeted

The attack targeted millions of devices on networks belonging to Australian Nuclear Science and Technology Organisation, other Australian government agencies, critical infrastructure and major media organisations.

ANSTO says systems unaffected

A spokesperson for ANSTO said it had not identified any impact to its systems as a result of the techniques identified by The Citizen Lab.

“We are following standard response processes and have not identified any impact to our facilities, systems, and information from the techniques described in the reports.”

How the spyware worked

Normal online advertising runs code in browsers to show ads. This exploit allowed bad actors to run code that installed software acting as a back door, accessing passwords, emails and internal system details.

Discover-Tech acted as middleman

The Citizen Lab claims Discover-Tech acted as go-between for advertising platforms like Google and spyware companies including Candiru, which is under US export controls for malicious cyber activities.

Ads placed on major websites

Discover-Tech bid against other advertisers to show ads on websites and apps like Duolingo, the BBC and New York Times. When they won, they showed seemingly benign ads with hidden malicious code.

Profiling enabled targeting

Researchers said the company exploited advertising technology to profile devices, identify them, track web activity and find geographical location. This information revealed names and workplaces to target spyware attacks.

Google removes Discover-Tech

The Citizen Lab report said Google removed Discover-Tech from its platform once researchers shared their findings. Diarmaid Harkin raised questions about how the company gained trust of major advertising players.

Calls for advertising industry oversight

Deakin University associate professor Diarmaid Harkin said the report showed how online advertising offered unique opportunities for bad actors and raised questions about who regulates these digital systems.

“Who's acting as a watchdog for these digital advertising systems?”