加拿大和美国的研究人员提出新的指控，称一家以色列公司使用“零点击”间谍广告监视了半岛电视台及其他目标。“是的。我的荣幸。谢谢。”
Researchers in Canada and the U.S. are making new allegations that an Israeli firm used "zero-click" spy ads to surveil Al Jazeera and others. THE >> YEAH. MY PLEASURE. THANKS. >> WELL, NOW TO DISTURBING NEW ALLEGATIONS THAT AN ISRAELI FIRM SPIED ON THE NEWS NETWORK. AL JAZEERA.
“好，现在来谈一则令人不安的新指控：一家以色列公司对新闻网络Al Jazeera进行间谍活动。该公司Discover Tech据称利用在线广告追踪目标，并帮助入侵其设备。最令人担忧的是，用户甚至不需要点击这些广告，程序就会开始进行间谍活动。广告只需在用户设备上加载即可。根据加拿大网络监督组织Citizen Lab和美国广告安全公司Confiant的两篇独立报告，这一情况属实。Al Jazeera在声明中谴责了这些攻击，并要求追究责任。然而，该网络并非唯一受害者。广告同样出现在五角大楼、联合国、北约以及许多其他政府和高安全性场所的用户面前。它们在巴勒斯坦领土也随处可见。”
DISCOVER TECH ALLEGEDLY USED ONLINE ADS TO TRACK TARGETS AND HELP HACK INTO THEIR DEVICES. THE MOST TROUBLING PART IS THAT USERS DID NOT EVEN NEED TO CLICK ON THE ADS FOR THOSE PROGRAMS TO BEGIN SPYING. INSTEAD, THE ADS SIMPLY NEEDED TO LOAD ONTO THE USER'S DEVICE.
“Bill Marczak是Citizen Lab的高级研究员，他现在加入我的节目。Bill，欢迎你的到来。”“Bill，真高兴有你在。”
THIS, ACCORDING TO TWO SEPARATE REPORTS FROM CANADIAN CYBER WATCHDOG GROUP CITIZEN LAB AND AMERICAN ADVERTISING SECURITY FIRM CONFIANT. IN A STATEMENT, AL JAZEERA CONDEMNED THE ATTACKS AND DEMANDED ACCOUNTABILITY. THE NETWORK, HOWEVER, IS NOT ALONE.
“首先，你的调查描述了你所称的‘已知的首例利用定向广告投放零点击间谍软件’的案例。请解释一下其意义，因为迄今为止，相关指南一直是让人们避免此类程序——比如不要点击未知链接，等等。但这一次根本不需要点击。”
THE ADS ALSO APPEAR TO HAVE BEEN SHOWN TO USERS IN THE PENTAGON, THE UNITED NATIONS, NATO AND IN MANY OTHER GOVERNMENT AND HIGH SECURITY SETTINGS. THEY ARE ALSO UBIQUITOUS IN THE PALESTINIAN TERRITORIES. BILL MARCZAK IS A SENIOR RESEARCH FELLOW AT CITIZEN LAB, AND HE JOINS ME NOW.
“没错。目标无需做任何操作就会被感染。攻击者只要将广告推送到其设备，恶意代码便在后台运行，设备就会被间谍软件感染。”“你们是如何将这款软件的来源追溯到以色列的？”
BILL, SO GOOD TO HAVE YOU HERE. UM, FIRST, YOUR INVESTIGATION DESCRIBES WHAT YOU CALL THE FIRST KNOWN CASE OF TARGETED ADVERTISING USED TO DELIVER ZERO CLICK SPYWARE. EXPLAIN THE SIGNIFICANCE OF THAT BECAUSE TO DATE, OF COURSE, THE GUIDANCE HAD BEEN TO PROTECT YOU FROM PROGRAMS LIKE THIS. JUST DON'T CLICK ON UNKNOWN LINKS, ET CETERA. BUT THIS ONE DIDN'T EVEN NEED THE CLICK. >> THAT'S RIGHT.
“这是个很好的问题。对任何网络攻击进行归因本来就非常困难，尤其是这种极其短暂的攻击。广告在屏幕上出现一秒钟，下一秒就消失。但我们能够查看Al Jazeera在攻击期间捕获的网络日志。”
THERE'S NOTHING THE TARGET NEEDS TO DO IN ORDER TO BECOME INFECTED. JUST HAVE THE AD PUSHED TO THEIR DEVICE BY THE ATTACKER, AND THEN MALICIOUS CODE RUNS IN THE BACKGROUND AND THE DEVICE CAN CAN GET INFECTED WITH SPYWARE. >> HOW DID YOU DRAW THE LINE BACK TO ISRAEL FOR THIS?
我们看到，就在间谍软件激活之前，出现了大量对已注册给这家此前鲜为人知的以色列广告公司Discover Tech的域名的访问。>> 如果不需要点击。有没有办法防御这种软件或程序？因为，你知道，在我多年报道这类事情的经历中，你知道，数字卫生建议一直是“不要点击”。所以我的意思是，如果你根本不需要点击，还有防御的办法吗？
FOR THIS SOFTWARE? >> WELL, IT'S A GREAT QUESTION. AND IT'S ALWAYS REALLY, REALLY TRICKY TO DO THE SORT OF ATTRIBUTION FOR ANY CYBER ATTACK, ESPECIALLY ONE WHICH IS SO EPHEMERAL. THE AD IS THERE ON THE SCREEN ONE SECOND AND THE NEXT IT'S GONE. BUT WHAT WE WERE ABLE TO DO IS LOOK AT THE NETWORK LOGS THAT. >> AL JAZEERA WAS ABLE TO CAPTURE DURING THE ATTACK. AND WE SAW THAT RIGHT BEFORE THE SPYWARE ACTIVATED, THERE WERE A BUNCH OF HITS TO DOMAIN NAMES THAT WERE REGISTERED TO THIS HERETOFORE OBSCURE ISRAELI ADS COMPANY CALLED DISCOVER TECH >> IF NO CLICK IS NECESSARY. IS THERE ANY DEFENSE AGAINST A SOFTWARE OR A PROGRAM LIKE THIS? BECAUSE, YOU KNOW, IN MY MY YEARS COVERING THIS KIND OF THING, YOU KNOW, THE DIGITAL HYGIENE ADVICE HAD BEEN DON'T CLICK.
好吧，不幸的是，根本没有非常好的防御手段。而这正是问题所在。嗯，用户可以做一些事情，让在这些类型的攻击中被定位变得稍微困难一些。例如，每部手机都有所谓的广告标识符。现在苹果和谷歌允许你在手机的隐私设置中关闭或删除它。所以这是一个好的步骤，但它不是万能的。广告商仍然有办法使用他们在不同公司之间同步的标识符来追踪和投放广告。
SO I MEAN, IF YOU DON'T HAVE TO CLICK, IS THERE ANY DEFENSE? >> WELL, UNFORTUNATELY, THERE'S NOT ANY VERY GOOD DEFENSES. AND THAT'S SORT OF THE PROBLEM. UM, THERE ARE SOME THINGS THAT USERS CAN DO TO MAKE IT A LITTLE BIT TRICKIER TO GET TARGETED IN THESE SORTS OF ATTACKS. FOR EXAMPLE, EVERY MOBILE PHONE HAS WHAT'S CALLED AN ADVERTISING IDENTIFIER. NOW APPLE AND GOOGLE ALLOW YOU TO TURN THIS OFF OR DELETE IT IN THE SETTINGS, ON THE PRIVACY SETTINGS ON YOUR PHONE. SO THAT'S A GOOD STEP, BUT IT'S NOT A SILVER BULLET. THERE ARE STILL WAYS THAT ADVERTISERS CAN TRACK AND DELIVER ADS USING IDENTIFIERS THAT THEY SYNCHRONIZE BETWEEN DIFFERENT COMPANIES.
所以这是一个巨大的问题，我认为个人在最终实际上能做的事情真的不多。这是在线广告生态系统的系统性问题。看，在线广告生态系统的设计目的是让广告商——也就是说，任何有现金的人——不仅能推送图片和视频，还能推送在你所看到这些广告的网站上的应用程序中运行的代码。而直到这种设计、广告的架构……
SO IT'S A HUGE PROBLEM, AND I DON'T THINK THAT THERE'S REALLY MUCH THAT INDIVIDUALS CAN DO AT THE END OF THE DAY. IT'S A SYSTEMIC PROBLEM WITH THE ONLINE ADS ECOSYSTEM. LOOK, THE ONLINE ADS ECOSYSTEM IS DESIGNED TO ENABLE ADVERTISERS, MEANING ANYBODY WHO HAS CASH TO PUSH NOT ONLY IMAGES AND VIDEOS, BUT ALSO CODE THAT RUNS WITHIN THE APPS ON THE WEBSITES WHERE YOU SEE THESE ADS. AND UNTIL THAT DESIGN, THAT ARCHITECTURE OF THE ADS