Omer Benjakob and Eliza Triantafillou, Haaretz:

According to the documents, in 2022 Intellexa presented a proof of concept for a system called Aladdin that enables the remote infection of a specific mobile telephone device through online advertisements. This is the first time it has been revealed that a company outside of Israel has developed such a spyware tool – which was considered the cutting edge of Israel’s offensive cyber. At that time, in Israel, the Defense Ministry was actively working to prevent Israeli companies from marketing identical spyware tools abroad.

[…]

It is not known what happened to Aladdin. It is possible it was never developed or if it was, if it was ever actually sold. Adint systems are considered extremely complicated to develop and maintain over time, and it is not clear if Intellexa moved ahead with trying to develop it into a working product and if they ever pitched it or sold it.

This was described by Intellexa as a near zero-click solution, in that it only requires someone to be using a web browser for their device to be affected; it does not require someone to tap on an ad. iPhones were apparently not affected by this zero-click ad infection capability, and required at least one tap, but that is barely comforting considering how frequently I accidentally tap on ads in third-party apps on my iPhone.1

Via Zack Whittaker, TechCrunch:

Online ads help website owners, including this one, generate revenue. But online ad exchanges can be abused to push malicious code to a target’s device.

[…]

While no phone or computer can ever be completely unhackable, ad blockers can be effective in stopping malvertising and ad-based malware before it ever hits the browser.

The technology described by Haaretz is clearly among the most cutting edge and it seems unlikely any random person would be caught in its net. The whole point, after all, is specific and targeted malware delivery — something which, as with surveillance, is possible thanks to the way online advertising works. While there are many ad blockers available for browsers, including site sponsor Magic Lasso, there are no user-friendly answers for in-app ads on iOS, many of which use the same networks and technologies as those in browsers. This is an unfortunate limitation of the way iOS works.

1. This is not really the point of this post, but it seems like something changed a few major iOS versions ago and I now find myself accidentally tapping way more often. This is especially noticeable when I am just trying to stop an in-progress scroll. ↥︎

⌥ Permalink