• Em Adespoton@lemmy.ca
    link
    fedilink
    English
    arrow-up
    32
    ·
    1 year ago

    I had an odd moment just now of “wait… you mean that isn’t already obvious to everyone?”

    Then I realized it probably wasn’t.

    • NaibofTabr@infosec.pub
      link
      fedilink
      English
      arrow-up
      17
      ·
      edit-2
      1 year ago

      What sets Insanet’s Sherlock apart from Pegasus is its exploitation of ad networks rather than vulnerabilities in phones. A Sherlock user creates an ad campaign that narrowly focuses on the target’s demographic and location, and places a spyware-laden ad with an ad exchange. Once the ad is served to a web page that the target views, the spyware is secretly installed on the target’s phone or computer.

      This is the part that makes this newsworthy. Insanet uses the advertising infrastructure to target a specific group or even person, and when the ad is displayed it does not require user interaction to install itself. They’ve developed a zero-click exploit, which is very concerning

      I’m not clear on whether an adblocker will actually protect you from this - some adblockers only prevent the display of the ad in your browser, but the content of the ad is still downloaded with the rest of the webpage information. You might actually need something like Pihole to block ad server addresses so that the content never gets downloaded at all, but that would make any browsing outside your home network dangerous.

      • newIdentity
        link
        fedilink
        English
        arrow-up
        4
        ·
        edit-2
        1 year ago

        The ad is downloaded, but it’s removed before execution

      • MasterBuilder@lemmy.one
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        Any DNS based blocker will filter out anything from URLs at the source, so no data is received. I use AdAway with Magisk. Blocklists are updated regularly.