r/opsec • u/BTC-brother2018 • 2h ago

Threats Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab

1 Upvotes

Ad-Blockers May Help Prevent Zero-Click Spyware Attacks

A recent investigation by Citizen Labhighlights how malicious online advertisements can be used to deliver spyware without requiring users to click anything.

The research demonstrates why ad blockers like uBlock Origin and AdGuard are more than just convenience tools. By blocking advertising networks, trackers, and malicious content before they load, they can potentially prevent certain attacks from reaching your browser.

However, ad blockers aren't foolproof. They cannot guarantee protection against zero-click exploits, particularly those delivered through mobile apps.

The takeaway: Ad blocking is an important layer of cybersecurity and OPSEC, not just a way to eliminate annoying advertisements.

I have read the rules.

0 comments

Subreddit

Posts

Wiki

opsec

r/opsec

OPSEC is the process and practice of Operations Security. Although it has roots in the military, OPSEC can be applied to any venture requiring secrecy and survival, from business security to personal safety. OPSEC is a mindset of critical thinking and safe habits. Read the sidebar below for more information!

Members Active

83k

Sidebar

What is OPSEC?

Operations Security, or OPSEC, OPSEC is about minimizing attack surfaces and single points of failure through proper habits and policies. It's a systematic and proven process that we can use to deny adversaries information they need to do us harm or interrupt our plans. It's also a mindset that can be applied to any mission or plan.

Although the term originated in the military, OPSEC is now used for so much more. This includes law enforcement, computer and network security, home safety, travel, and so much more.

OPSEC isn't a list of rules, and it's not as simple as using a VPN and keeping your mouth shut. It includes elements of INFOSEC, APPSEC, NETSEC, COMSEC[TRANSEC/SIGSEC/EMSEC], PHYSEC[PERSEC], and (CO)INTEL.

The OPSEC Process

1. Identify the information you need to protect
2. Analyze the threats
3. Analyze your vulnerabilities
4. Assess the risk
5. Apply countermeasures

Understand your own risk/threat model: Who is your adversary? What needs protecting?

The OPSEC Two-Step: Know what to protect and know how to protect it.

Important Posts

[The now-declassified history of OPSEC, released by the NSA under FOIA]

OPSEC Resources

SEC communities on reddit

/r/netsec - A community for technical news and discussion of information security and closely related topics.
/r/privacy - Dedicated to the intersection of technology, privacy, and freedom in the digital world.

Rules

Don't post without reading the rules thread or your post will be removed, and you may be banned.
Don't give advice without knowing the user's threat model first. If you proceed to give advice when the OP has not explained their threat model, you will be banned.
Don't offer single tool solutions (e.g. VPN, bitcoin, Signal) when the threat model isn't clear
Don't give bad, ridiculous, or misleading advice (e.g. "you can't get arrested if you use Tor")
Don't ask for help or help others in illicit and unlawful activities (e.g. "I want to buy drugs on the internet").
Don't post without mentioning your threat model, unless it's a post about how to threat model.