GOS+Vanadium vs zero-click malware from targeted ads via JavaScript

science

As many here know, disabling JavaScript in the browser will break many popular and important websites.

But as was reported today, it is confirmed that zero-click malware has been recently distributed at scale through targeted ads and JavaScript.

Can anyone offer an informed opinion on whether Vanadium (with JavaScript ON) + GOS sandboxing could be sufficient to prevent infection from this type of malware?

https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and hack devices around the world. [...]

Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user. That code retrieves additional JavaScript code, which may, in turn, load further code, such as a browser exploit to install spyware. Since the code can contain identifiers for the user or their device, arbitrary JavaScript code can be sent precisely to a single user’s device. Our research in this report indicates that this architecture is indeed abused to facilitate the delivery of zero-click targeted spyware, and that the simple display of a targeted ad is enough for infection. [...]

Ads with attacker script tags were shown to users of 75,373 different Android and iOS apps and to visitors of 120,768 different websites in mobile and desktop browsers. These numbers refer to ads actually displayed to users of apps and websites rather than raw bids. [...]

Our analysis indicates that Discover-Tech deployed ads via Google, Yandex, and other ad vendors including Beeswax (FreeWheel/Comcast), Vungle (Liftoff), Eskimi, and Sunteng. In addition, both Google and the advertising association IAB Europe have listed Discover-Tech as a “certified” and “approved” ad vendor since the year 2020, which helped make the company appear to be a legitimate advertising firm and facilitate its participation in the advertising ecosystem at scale.

userofgos

science it may or may not be related to this thread: https://discuss.grapheneos.org/d/42752-vanadium-click-jacking-attack-leaked-a-sensitive-file-to-website

de0u

science Can anyone offer an informed opinion on whether Vanadium (with JavaScript ON) + GOS sandboxing could be sufficient to prevent infection from this type of malware?

I skimmed the report... and I don't think I can offer an opinion. Maybe I missed the part where it says which vulnerabilities were exploited?

guser39

de0u Maybe I missed the part where it says which vulnerabilities were exploited?

Per: https://infosec.exchange/@mttaggart/117446952630238750

There are no vulnerabilities exploited. This is not Pegasus 2.0. It's straight-ahead JS injection. Same trick as BeEF. In fact, Confiant even calls out that the iframe mechanism described limits what the Candiru payload can do.

de0u

guser39 Thanks. So far it sounds like an advanced platform for serving JavaScript that does whatever JS does. It sounds as if it can do mouse tracking, keystroke capture in some cases (if a user types at the right window), fingerprinting, etc.

If that's right, then if the JS code served to a given browser is designed to exploit a vulnerability that browser has, then the device could be exploited. But this is also true of any web site one might visit (if, hypothetically, discuss.grapheneos.org served malicious JS then people visiting the site would run the malicious JS).

Compared to other browsers, Vanadium on GrapheneOS has a lot of hardening. So the tracking and fingerprinting parts of the described effort would work, but I don't think we know whether or not any Vanadium exploits were tried, let alone worked.

mulfi

I guess ublock and adblocking dns would prevent this kind of thing, right?

NoahRaketic

mulfi Request filtering based ad blocking may reduce some of it, but it's not a preventative measure.