Cam Wilson @[email protected]:
Research group, The Citizen Lab, said it found proof that an Israel-based company exploited digital advertising technology to install back doors onto devices, merely by the victim viewing an advertisement on a website or in an app.
This exploit — called ''zero-click mercenary spyware" — allowed bad actors to run code on devices that installed software that acted as a back door to the device, allowing them to access things like passwords, emails and details of internal systems.
The Citizen Lab claims that a company, Discover-Tech, acted as the go-between for online advertising platforms like Google and spyware and hacking companies. At least one of those, Candiru, has been placed under US export controls because of its “malicious cyber activities”.
I keep telling the IT people at work…
They’ve installed enpoint protection that reduces my PC performance by 70%.
They’ve got so much auth that most things are 4FA.
Services on a virtual desktop through a VPN still need have HTTPS.
The ACLs are so tight that I have to wait weeks on a ticket to make two PCs communicate in the same room.
Session timeouts are so short that I spend half my day reauthenticating with stuff.
Then they don’t block ads. Every time I’ve seen an infected machine, the attack vector has been an ad. It’s the only security measure that makes life better for the users, and they don’t do it.
I wish they would block the corporate portal ‘feelgood’ ads. I don’t really care that Carl plays over 50s cricket or that Maggie knits sweaters for bald cockatoos.
It’s because insurance doesn’t require it (yet?)
There’s definitely an insurer driving our security policy, hiding behind some ISO audit spec.
Probably the same insurers that gain from scraping personal data from everyone and everything.
4FA lol, good to know I’m not the only one.