Two senators say that revelations about online targeted advertising being used as a vector for spyware infections underscore the need for better security practices in the industry.Some members of the advertising industry that were subjects of the report, meanwhile, think their practices are up to the task.The Citizen Lab at the University of Toronto, in partnership with the cybersecurity and ad-tech firm Confiant, last week published a report on AdFection, a technique whereby targeted ads were delivering zero-click mercenary spyware.“Ad vendors must significantly level up their cybersecurity and threat detection capacity to effectively cut off malicious advertisers across the supply chain,” The Citizen Lab report states. “They must rigorously and regularly vet, screen, and audit their business partners and hold them accountable for their own supply chains.”In 2023, Democratic Sens. Ron Wyden of Oregon and Cory Booker of New Jersey introduced legislation to ban advertising networks and facilitators from using personal data to target, but the legislation never advanced past introduction. Both said The Citizen Lab report illustrated the need for industry reform.“The report underscores the growing risk of spyware and the increasingly sophisticated methods used to track and target people online,” Booker said in a statement to CyberScoop. “Americans need vastly stronger privacy protections that stay ahead of these evolving surveillance threats.”The security threat of targeted online advertising to government devices is of particular concern to Wyden, with his letters to government agencies cited in the report. Wyden has called adtech a national security threat. Ads from Discover-Tech, the company most linked to AdFection, got impressions on government networks.“Allowing targeted ads on government devices is an open invitation to spies and criminals. It’s the digital equivalent of leaving all the doors and windows unlocked at a sensitive government facility,” he said in a statement to CyberScoop.“It’s clear that advertising exchanges are not meaningfully protecting users against malware and location tracking, which is why I’ve been urging the government to disable ads on government browsers and turn off mobile ad IDs, and have pushed my bill to ban all targeted advertising,” he continued. “The latest Citizen Lab report is an impressive reminder that this sector simply cannot be trusted to put users’ security ahead of profits.”A number of U.S. agencies have taken steps to block ads due to the threats they pose, or recommended blocking them for feds.Discover-Tech appeared on lists of “certified” and “approved” vendors that Google and the advertising industry association IAB Europe maintained. Google participated in the report, but IAB Europe didn’t respond to it until after publication. Both provided additional comments to CyberScoop.Google and IAB Europe, and the ad networks Beeswax, Vungle and Eskimi all took steps to remove Discover-Tech’s access to the digital advertising ecosystem, according to the report. A mix of other ad systems replied to The Citizen Lab, but some did not, including Microsoft, which owns the ad system Xandr. Microsoft also didn’t respond to requests for comment from CyberScoop.The Citizen Lab report concluded that the advertising industry displayed “a dangerous lack of due diligence” and criticized “broken digital infrastructure,” while also saying that the sector needed to “get serious” about security.It said ad vendors needed to better share threat data, improve vetting of partners, audit vendor registries and ban vendors by default in jurisdictions known to be permissive of abuse.In response to questions from CyberScoop about those conclusions, a Google spokesperson provided a statement.“We banned Discover Tech during a joint investigation with Citizen Lab and Confiant,” the spokesperson said. “Throughout that work, we continuously blocked malicious ads to help people stay protected while we dismantled the network.”Google said that its safety teams and systems continuously blocked individual bad ads from Discover-Tech, but banning them entirely from the platform required proof that their ad infrastructure was linked to spyware.The company also said it regularly audits participants in its Authorized Buyer program, as well as deploying “multi-layered defenses to stop bad ads,” and that its automated systems detected over 99% of policy-violating ads before reaching users last year.IAB Europe responded more specifically.“The findings do not demonstrate that the digital advertising infrastructure is broken, but rather point to the potential misuse of existing technologies and functionalities that are not specific to digital advertising but inherent to web technologies,” said Lauren Wakefield, marketing and communications director for the association. “While the industry continuously invests in improving security and safeguards against fraud and other forms of misuse, the investigation of potentially unlawful activities, such as the deployment of spyware, ultimately falls within the remit of competent authorities.”The Citizen Lab report also urges regulators to take action, including conducting an investigation of Discover-Tech and the spyware firm Candiru, which infect users through Discover-Tech online ads; “more closely scrutinize the advertising ecosystem to determine whether other companies are leveraging it for espionage and spyware delivery, and determine whether they have violated applicable laws and regulations;” and pursue sanctions against mercenary spyware firms and the companies that enable them.“Preventing fraud and other forms of misuse is already an ongoing priority across the digital advertising ecosystem, and IAB Europe supports industry efforts to invest in technologies, processes and safeguards to identify and mitigate cybersecurity risks,” Wakefield continued. “We hope this report will be seen as an opportunity to reassess and improve existing approaches to cybersecurity. It is important to recognise that cybersecurity requirements and measures must be proportionate to the risks and circumstances of each individual company, which is why one-size-fits-all recommendations may not always be appropriate.”The post Senators say targeted ads are a security risk. Ad groups say the critics are off base. appeared first on CyberScoop.