Spyware can infect your phone or computer via the ads you see online – report

Comments

• CookieJarObserver@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

  Adblock is and always has been a security feature.

  source
• adespoton@lemmy.ca ⁨1⁩ ⁨year⁩ ago

  I had an odd moment just now of “wait… you mean that isn’t already obvious to everyone?”

  Then I realized it probably wasn’t.

  source

  • NaibofTabr@infosec.pub ⁨1⁩ ⁨year⁩ ago

    ≥ What sets Insanet’s Sherlock apart from Pegasus is its exploitation of ad networks rather than vulnerabilities in phones. A Sherlock user creates an ad campaign that narrowly focuses on the target’s demographic and location, and places a spyware-laden ad with an ad exchange. Once the ad is served to a web page that the target views, the spyware is secretly installed on the target’s phone or computer.

    This is the part that makes this newsworthy. Insanet uses the advertising infrastructure to target a specific group or even person, and when the ad is displayed it does not require user interaction to install itself. They’ve developed a zero-click exploit, which is very concerning

    I’m not clear on whether an adblocker will actually protect you from this - some adblockers only prevent the display of the ad in your browser, but the content of the ad is still downloaded with the rest of the webpage information. You might actually need something like Pihole to block ad server addresses so that the content never gets downloaded at all, but that would make any browsing outside your home network dangerous.

    source

    • furrowsofar@beehaw.org ⁨1⁩ ⁨year⁩ ago

      This is the crazy thing about ads. The ad network and site operators should be responsible for making sure both the ads and the people putting up the ads are trustworthy. The reason I now block all ads is this reason. Neither party cares and they are willing to act as a conduit for this stuff. In most other industries orgs are responsible forvtgeir supply chains.

      source

      • -> View More Comments
    • MasterBuilder@lemmy.one ⁨1⁩ ⁨year⁩ ago

      Any DNS based blocker will filter out anything from URLs at the source, so no data is received. I use AdAway with Magisk. Blocklists are updated regularly.

      source
    • newIdentity@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

      Most do both and also block the Javascript of the ad to load.

      source
• LostDeer@infosec.pub ⁨1⁩ ⁨year⁩ ago

  Blocking ads is just another layer of defense in your security stack. I want to say it’s like locking your front door, but not using an ad blocker is worse than just having your front door unlocked.

  Imagine you have numerous solicitors coming up to your front door everyday and you left your front door not only wide open, but off the hinges. Who’s walking into your home with the best of intentions in that situation?

  source
• Showroom7561@lemmy.ca ⁨1⁩ ⁨year⁩ ago

  Just another reason to use an adblocker. 🤗

  source
• JoMomma@lemm.ee ⁨1⁩ ⁨year⁩ ago

  VPN, Firefox, uBlock… goodbye

  source

  • lud@lemm.ee ⁨1⁩ ⁨year⁩ ago

    How is a VPN gonna help?

    source

    • JoMomma@lemm.ee ⁨1⁩ ⁨year⁩ ago

      Filtered DNS, avoid the weighted routing of ISPs like Comcast, ability to locate in countries that have laws preventing data collection and bias routing

      source

      • -> View More Comments
• Vendetta9076@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

  Its almost like forcing users to download whatever you deem “good” can be a problem. Fuckin imagine that.

  source
• Francis_Fujiwara@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

  I use a private DNS precisely for that reason.

  source
• nevernevermore@kbin.social ⁨1⁩ ⁨year⁩ ago

  the price tag $6m+ price tag to infect one device on this product alone means it’s only likely to be used in extreme circumstances. But if you’re a public figure, or have some form of notoriety, then It’s always a good practice to block any connections you didn’t personally open.

  source
• PublicLewdness@burggit.moe ⁨1⁩ ⁨year⁩ ago

  I use uBlock Origin; Jshelter; and Privacy Badger. I don’t even see ads.

  source