Norway’s Cyber Chiefs Said Relax. Then Spyware Ads Turned Up in Parliament

The day after Norway's cyber chiefs told a room to take a deep breath, Citizen Lab showed that ads linked to Candiru spyware had reached the Storting, the Armed Forces and Kripos. No click required.

Photo by Clint Patterson / Unsplash

Just like that we're halfway through October, also known as National Security Month in Norway. What could be better than a bit of scary news heading into the weekend?

For as long as I’ve been able to type on a PC, the virus warnings have been there. I clearly remember those tedious banners telling me I was one in a thousand who’d won a green card! Eleven-year-old me thought it meant the right to play on a golf course (in Norway, that’s what a “green card” gets you), and never quite understood why I’d win something like that. Of course, it was the fabled green card – the right to live in the USA.

Since then, the online crooks have only got better at what they do. It probably wasn’t children those fake American prizes were aimed at. But today we’re seeing completely different tools being put to use.

Yesterday I attended Power and Technology, a conference hosted by the Norwegian business newspaper Dagens Næringsliv. Fittingly, it took place at the old American embassy in Oslo, where I’ve heard rumours of huge amounts of cables and technical gadgets left behind in the ceilings, walls and floors when the Americans moved out of Henrik Ibsens gate 48.

Right at the top of the agenda was digital sovereignty. I’ve covered the topic in Kludder before, both here:

and here:

After that, the conversation turned to intelligence, and especially Russian activity. On stage, they talked about geopolitical uncertainty. Not least our neighbour Russia, which attacks Norwegian systems daily – something that keeps the Norwegian Cyber Defence Force on its toes. So it came as a big surprise when I left the room calmer than when I walked in. It seemed like our Cyber Defence Force is actually doing pretty well. Halvor Johansen, head of the Norwegian Cyber Defence Force, told us that the frequency and complexity of digital attacks against Norway have increased, but that this was really just something we had to expect.

The deputy head of the Norwegian Police Security Service (PST), Inga Bejer Engh, urged us all to take a deep breath. Among the examples she brought up was the increase in drone activity. Isn’t it a bit odd, she asked the room, that the more we read about drones, the more drones we observe? She revealed that none of the drone sightings from the past year could be linked to other nations – in fact, she hinted that quite a few of the drones may simply have been birds.

But that safe, cosy feeling would last barely twenty-four hours. Today, WIRED published a story revealing that phones and computers can now get infected without you having to do anything at all. The phenomenon is called a zero-click attack. In Toronto, Canada, there’s a gang of researchers at something called the Citizen Lab. They investigate digital espionage, and they’ve revealed that cybercriminals can install spyware – software that spies on your data – through ads on a website!

The Israeli ad agency Discover-Tech used an advertising tool to install spyware from another Israeli company, Candiru. The software targeted devices connected to the news network Al Jazeera. On top of that, 70,000 mobile apps and 120,000 websites were infected between March and June this year.

Discover-Tech spotted in the Norwegian parliament

But if you thought this only affected Al Jazeera and the Middle East, you’re wrong. NATO, the EU and the UN detected ads linked to Discover-Tech. So did the Norwegian Armed Forces, the Storting (the Norwegian parliament), Kripos (the National Criminal Investigation Service) and the Norwegian Digitalisation Agency. Citizen Lab calls the phenomenon AdFection. That, Johansen didn’t mention in his rather relaxed chat with DN’s Frithjof Jacobsen. So my impression of this week’s seminar has changed. Maybe it’s not that the Cyber Defence Force has things as under control as they claim, but that Johansen was sent to Power & Technology with a clear mission to calm the troops.

Bad timing, then, for the Discover-Tech news to drop today.

The news publishers have had enough

British and American news outlets are fed up with bots stealing their work to train language models and other AI. The Times, the Financial Times and Condé Nast – which owns WIRED, mentioned above – have sent a letter to the UK Prime Minister, Andy Burnham. They want stricter legislation and regulation that would reveal who the automated bots are working for, and what they’re using the content for. Right now, I’m seeing two very different approaches to bots that scrape content from the web. On one hand, you have the media houses who’d very much like – and rightly so – to protect their own work. Editor-led media are already under pressure, thanks to Meta and Mark Zuckerberg:

On the other hand, you have businesses optimizing, tailoring and more than happily inviting the bots to help themselves to the content on their websites. Over 50 per cent of web traffic is now made up of bots, and if they feed a company’s content into a language model, well, that’s fantastic marketing.

If the creators of trusted information receive no value for it, the supply of reliable information will diminish, then disappear. – from the letter sent to Burnham.

These are words we need to take seriously. It’s also one of my biggest worries about the times we’re heading into: that news we can trust loses out to algorithm-driven hot takes whose only purpose is to drive engagement. But getting to grips with media theft isn’t exactly easy.

The bot operators route their traffic through our IP addresses. That makes it look as though the traffic is coming from real people’s phones and computers. The letter points out that this is also a matter of national security.

The same technique and infrastructure are exploited by hostile state actors to launch concealed cyberattacks and mass cognitive warfare campaigns. – the letter from the news outlets to the UK Prime Minister.

It’s been a long time since a green card banner ad tried to scam me. Naive as I am, I’ve considered myself pretty digitally savvy. But maybe my data found its way to Israel a long time ago. It happened to Al Jazeera, and it’s utopian to think it can’t happen to the rest of us.

Anyway, I have to wrap up – just got a text (they call it an email, but fine) from One Park saying I haven’t paid the parking fee for a car I don’t own.