In short:
The ABC is wiping a small number of staff devices as a precaution but says it has found "no signs of compromise" from ads linked to a spyware campaign from an Israeli company.
asserted
it → wipe → company
Researchers uncovered an operation using online ads to infect devices, targeting Australian high-profile and sensitive organisations.
asserted
Researchers → uncover → organisations
More than two dozen other Australian organisations are part of a "significant cluster" of targets, but they have not yet been identified.
asserted
they → identify → targets
The ABC has wiped staff devices that were exposed to a new, sophisticated cyber attack carried out as part of a broader campaign to track and even hack into networks of some of Australia's most high-profile and sensitive organisations.
asserted
that → wipe → organisations
It can be revealed the ABC is among more than two dozen Australian government, critical infrastructure, universities and media organisations that researchers claim were targeted by an Israel-based company abusing the online advertising system.
uncertain
researchers → reveal → system
The public broadcaster confirmed a "small number" of devices had been exposed but said so far it had not identified any impact from the attack discovered by researchers at The Citizen Lab.
"The ABC is aware of the Citizen Lab report that describes exposure to advertising that may contain spyware.
uncertain
that → confirm → spyware
There is no evidence of a resulting compromise," a spokesperson said.
asserted
spokesperson → be → compromise
'No evidence' ABC impacted by cyber attack
The ABC attack was part of a bigger campaign, dubbed "Adfection", revealed by Citizen researchers last week.
asserted
attack → impact → researchers
The Canadian-based group found evidence that company Discover-Tech exploited digital advertising technology from major platforms like those run by Google to deliver spyware that could infect devices merely by viewing an online advertisement and without clicking.
uncertain
that → base → advertisement
Researchers were able to confirm Discover-Tech's technique was used to infect devices at international news network Al Jazeera with spyware from another Israeli company, Candiru.
A spokesperson for the ABC confirmed that this had included the public broadcaster but had found no evidence so far of any adverse impact.
"Our review found that ads from this network were shown on a small number of ABC devices.
asserted
ads → confirm → devices
We have found no evidence that any staff member has been identified or tracked," they said.
asserted
they → find → evidence
"For the small number of ABC devices identified, we have found no signs of compromise, and are wiping any still in service as a precaution.
asserted
we → identify → precaution
We take the privacy of staff and the protection of journalists' sources seriously.
asserted
We → take → sources
New method of cyber attack exploits known risks of online advertising
Even if this infection is unsuccessful, researchers said, the same method also allowed the attackers to profile tens of millions of devices that were shown these malicious advertisements — measured by "impressions" — potentially giving information about their identities and online habits.
asserted
that → exploit → identities
University of Queensland Professor Nicholas Carah, whose research focuses on digital advertising, said the attack was proof of the well-known risks about online advertising technology.
asserted
attack → focus → technology
"On one level, it's horrifically surprisingly, but on another level it's like, well, yeah of course, online advertising is really useful infrastructure for doing something like this," he said.
asserted
he → do → this
Professor Carah said the report showed how bad actors could exploit existing characteristics of online advertising technology to thwart protections that were supposed to stop tracking for nefarious purposes.
uncertain
that → say → purposes
"You can get an [internet protocol] address, or a mobile, then, hey, presto, you're able to identify those individuals," he said.
asserted
he → get → individuals
Greens leader and digital rights spokesperson David Shoebridge said the report's contents were alarming.
asserted
contents → say → ?
"When foreign zero-click adtech is aimed at our public broadcaster, and other sensitive government agencies, that of course raises serious questions about foreign interference," he said, adding that this shows the need for privacy reform and to include advertising in the government's proposed digital duty of care.
asserted
this → aim → care
Australian government, critical infrastructure and media organisations targeted
While there were devices targeted across the world using Discover-Tech's techniques, Citizen Lab researchers noted a "substantial cluster of impressions in Australia, including on government and private-sector networks associated with critical infrastructure".
asserted
researchers → target → infrastructure
The researchers did not know who Discover-Lab or Candiru were carrying out the attacks on behalf of, if anyone.
asserted
Lab → know → behalf
The report singled out Australia's nuclear science agency, ANSTO, as being a hot spot in their data for the number of malicious ads shown.
asserted
report → single → ads
It did not specify the other organisations.
asserted
It → specify → organisations
An ANSTO spokesperson told the ABC earlier this week it had not identified any impacts.
asserted
it → tell → impacts
Australia's cybersecurity agency, the Australian Signals Directorate, declined to comment.
asserted
agency → decline → ?
Researchers also claimed three Australian media organisations had seemingly been targets.
asserted
organisations → claim → ?
"The use of spyware against journalists is on the rise," international group Reporters Without Borders wrote late last year.
"Digital attacks often go unnoticed, so it is vital that journalists regularly check if their devices are compromised."
asserted
devices → write → Borders
The Aporia