AdFection: Targeted ads turned into a pipeline for zero-click mercenary spyware
citizenlab.caThen you can drastically reduce the mobile in browser block list which helps a lot with battery
It’s to do with hiding malware/spyware in an image which ends up in your cache on device. I can’t go much further into details but all this takes is for you to visit a site that serves it via ad network.
Israel has been known to have some sneaky spyware in the past with Pegasus.
Article on the CitizenLab website: https://citizenlab.ca/research/how-discover-tech-turned-targ...
I think lots of it has to do with how well the hasbara covers up the scandals from the wider publics perception, combined with the cultural bandwagon of considering them an ally even when their repeated actions say otherwise.
edit: also the idea that they have such good tech and its a pragmatic decision ignores the history of how and who they got it from and the intentions for it. I say this as someone who worked directly with Mellanox for example, before aquisition by Nvidia... I always thought kernel level shims for networking stacks from an Israeli company was dangerous... but the speeds!!!
- It came in through the front door. Discover-Tech ran its own ad-buying platform and was listed as a "certified" vendor by Google and IAB Europe for six years. Nothing was hacked to get in. It bid in ad auctions like any other buyer.
- The ads looked harmless. Plain banners for games, AliExpress deals and an IP-lookup site. Hidden inside each one was a small script that quietly phoned home when the ad loaded.
- Everyone who saw an ad was profiled. The script collected device details, IP addresses and, on many sites, the publisher's own cookies, sometimes including logged-in session tokens. Cookie-syncing with other ad networks built a huge identity graph.
- Only chosen targets got the payload. A gatekeeper server checked each device's ad ID and IP. Most people got nothing back. A selected target got code that handed them off to spyware maker Candiru, and the code was served only once, which made it very hard for researchers to capture.
- The handoff was built to defeat inspection. Encrypted channels, rotating hosting, anti-bot checks and even a fake "Copyright Google" comment to fool human reviewers.
- It worked. At least 45 devices at Al Jazeera were targeted, and spyware was recovered from an infected machine. Its ads also appeared on networks belonging to NATO, the UN, the European Parliament, the ICC and various defence ministries.
- The scale was huge. Billions of bids and ads in nearly 200,000 apps and websites, including Duolingo, Viber, Yahoo Mail, dating apps and period trackers, yet almost no sign of real advertisers or revenue.
Citizen Lab: https://citizenlab.ca/research/how-discover-tech-turned-targ...
Confiant: https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zer...
Citizen Lab also has a shorter executive summary: https://citizenlab.ca/research/exposing-adfection-executive-...
Edit:
the TFA answers: "Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user." Its wild! I thought the ads are sanitized, go through a CDR of sorts, and whatever javascript is permitted is authored by ad networks, not the buyers. Sheesh. Thats just RCE.
RTB (real-time bidding) does not incentivise publishers to care about what ads are actually being shown to individual users, so long as CPM is maximised.
> Don't post generated text or AI-edited text. HN is for conversation between humans.
Then the ad network delivers a targeted ad that exploits a vulnerability (eg a broken JPEG decoder that, when sent a bad image, allows to run arbitrary code on your machine), and from there you have access to the computer
I don't know if an ad blocker protects against Discover-Tech’s Controlium but in general you'd be a fool to allow ads in your browser in at this point. The ad industry is pretty shady all round.
One must wonder how many were genuine vs an influence op.
The whole point of an influence op is to find a bunch of useful idiots to provide a large multiplicative factor.
And that's the problem with arguing that something is an influence op, because it is going to be mostly genuine people by the time it gets to you, even though you're not wrong.
Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
From being hacked by others. Google was just trying to protect their property, which is the ability to spy on their users' every move. Google themselves really don't need to "hack" their users for that, they already have all the access and all the data they could ever want. And they also have the ability to brick their users' devices at a moment's notice the same as Apple does.
Totally not useless. It costs a lot more to pay a spyware firm then to have an employee send an email / ask a judge (like that's even necessary).
I feel quite confident of my messages privacy on my Pixel with GrapheneOS given most people I message are on iPhones which are second in security to Pixels running GrapheneOS. Not to mention my threat model doesn't include mercenary spyware, as most people's doesn't.
If you're talking about the sideloading restrictions those were intended to stop social engineering and scams, not from getting hacked via 0days.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Source? play services is privileged but not that privileged.
No, those restrictions were intended to keep Android users in the playstore ghetto (which is suffed to the gills with scams.)
In fact, following the OP's link to https://citizenlab.ca/research/how-discover-tech-turned-targ..., "the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries" so it's not just apps but ordinary websites you visit in your android chrome browser.
No info on if a recent version patches this?
It also mentions a "Windows DLL" - so they're somehow infecting Windows desktop too?
Streaming services used to be bad enough with ads in the shows, now they put an ad on the screen when you pause it. Peacock just started putting ads in the login screen.
If we don't stop this, pretty soon they're going to have ads in the stars as satellite constellations arrange themselves to sell you Twitter subscriptions. They're not going to stop even when there's an ad no matter where you look.
I'm reminded of the ending of the 2008 film Hancock in which Hancock defaced the moon with a corporate logo. But it was okay because it was "for a good cause".
Putting a static, printed poster on a wall is in no way analogous to surveillance.
The ad-tech network probably does make it easier, because any page that includes their ad network could deliver the malicious ad.
It’s a low-hanging fruit that has high value, particularly for less savvy internet users. Scams have always been the biggest threat. I’d say the majority of internet ads are scams, and the platforms often don’t make it clear what is or is not an ad.
But, we always knew the risk of malware was there. In the modern age, ads are basically never delivered as static assets. They’re delivered as small applications, with code. So, we’re relying on our sandboxing mechanics to work perfectly, and predictably they don’t. The solution is to block the code altogether; to block ads.
* https://citizenlab.ca/research/how-discover-tech-turned-targ...
The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited.
Though, there is a browser patch for this, don't advertise so much identifiable information that an advertiser can identify a user or their employer. That's the defense, but it'll never happen.
https://www.packetlabs.net/posts/demystifying-the-market-for...
Games are an underrated vector for similar campaigns.
Edit: for the doubters, malware-via-game has already been happening https://www.malwarebytes.com/blog/news/2025/07/steam-games-a...
NK likely also gets a bit of a boost because of the extended length of mandatory service. Males on technical teams have to serve for 13 years.
Russia has historically not had mandatory universal conscription.
A lot of the immediate neighbors attacked Israel at its birth, and further away countries just seem to hate Israel due to religion/ethnicity/populism (?), countries like Pakistan, Malaysia, etc.
That easy huh
She said, "Gary, I saw this very interesting documentary about Hitler's shenanigans." [audience laughter] Shenanigans! [he chuckles] Not even close!
And, as a Jew, I'm obviously not oversensitive, but when people trivialize Hitler's monkey-business... [audience laughter] When the Nazis' hijinks, tomfoolery, and ballyhoo is understated, I feel it does a disservice to the millions who were, ahhh, inconvenienced by Hitler's mischief! [audience laughter]
Tomato, tomahto. Shenanigans, genocide.
(Gary Gulman bit)
funding Israel violates the separation of church and state.
That's not really an accurate characterization of the situation as much of the land was uninhabited/unregistered and/or state owned. The Negev desert for example is a large percentage of the total land area and was effectively uninhabited and not privately owned. Land ownership records at the time were also not particularly clear and often there were disputed claims. Also Israel has about 20% Arab/Palestinian citizens so it's not like they ethnically cleansed everyone like Egypt/Jordan did with the Jews in Gaza and the West Bank when Israel gained independence.
Like immagine if the rhetoric of Turkey was constantly talking about expanding to Greece and how the land of Greece is historically the Turks. Obviously that would make any Greek uneasy.
And the Greeks are historically famous for being quite laissez-faire when it comes to their eastern borders.
You can literally count with both hands the amount of people in Israel that advocate for “greater Israel”
States like Israel formally define their borders via mechanisms like peace deals that include bilateral recognition of agreed upon borders, like Israel has with Egypt and Jordan.
You can't realistically define borders properly otherwise, trying to define borders via unilateral declaration doesn't really work when there are 2 states next to each other, the borders ultimately need to be negotiated bilaterally between those states with both sides recognizing the same borders.
It's still a major propaganda point for Hezbollah.
[1] https://en.wikipedia.org/wiki/Shia_villages_in_Palestine
Lets zoom out: The whole world is about to enter a massive economic calamity, all because Americans got tricked into to electing the current knucklehead in the White House who took a ~$300 million bribe from an Israeli supporter to start this war.
None of those other conflicts will affect the entire world as what Israel has done.
From what you've said. It sounds like America is to blame here, tbh. $300mil is chump change in international bribery/development. If your establishment sells itself so cheaply, that's on America.
Besides, what's happening in Iran is minuscule compared to what happened during the 'War on Terror'. Play imperial games, win imperial prizes.
>Besides, what's happening in Iran is minuscule compared to what happened during the 'War on Terror'. Play imperial games, win imperial prizes.
Disagree, Those wars were confined to an adversary that was already a few rungs down on the ladder and couldn't crash the world economy. Iran is larger than Iraq + Afghanistan combined, has very large mountainous terrain which has a lot of easy hiding spots for drones/launchers, has the fourth largest collection of trained staff in the field of nuclear science (more than France) and even became space launch capable in 2009.
Thats is like night and day difference between Iraq/Afghanistan.
America needed to push cheap credit to boost confidence after 9/11, oil prices skyrocketed and haven't really come back down, hugely expensive wars were funded on debt. It's arguable that these all directly contributed to the GFC in substantial ways.
Global confidence in American leadership plummetted since these wars, and opened the door for China and 'multi-polarity' to enter the stage which has caused a new wave of proxy wars as powers are trying to get a piece of the new round of global empires. We have Russia making moves (apparently also kickstarted by Gadaffi's death), UAE and Turkey playing games in the Sahel, dicerolled team selections in Libya, China testing the waters in Myanmar and Laos, fuckeries in Venezuela and Cuba, Syria, Azerbaijan....
If anything, Israel have been baited into their current actions just like America were as new and old powers try and undo 'centuries of shame', etc.
Jan. 6th wasn't enough to disqualify him from a second term. The Epstein files weren't enough to get him removed from power. ICE wasn't enough to get him removed from power. Blatant disregard for the courts, threatening allies, arbitrary and insane tariff policies weren't enough to get him removed from power. No President in the history of the United States has been as secure in his position as Donald Trump is. The Supreme Court even went out of its way to make him immune from prosecution for any crime he might possibly commit while in office.
Israel may have (probably did) talk Trump into the war but Americans are the reason Trump was in that position to begin with, and he is there because Americans want him there.
The fact that they are still trying last minute fuel price manipulation in the hopes of converting some people into Trumps good graces proves that you are wrong. The country is very large. In 300+ million people you will find a large distribution of people in terms of skills and ability to discern fact from fiction. The bottom 10% of the distribution is still ~30 million people. Some % of these people vote. Lets not even consider the bottom 50% percentile.
>Jan. 6th wasn't enough to disqualify him from a second term. The Epstein files weren't enough to get him removed from power. ICE wasn't enough to get him removed from power. Blatant disregard for the courts, threatening allies, arbitrary and insane tariff policies weren't enough to get him removed from power.
You are conflating two different things. This is a failure of the system. This takes time to reform. There are attempts going back years. When you have so many layers of people who benefit from the existing status quo the only way you speed up the fix this without decades of sludging through roadblocks is if a national calamity happens that finally forces change(economic or other challenge). Otherwise too many people are insulated from the downsides of the system until they aren't anymore and then something changes.
>but Americans are the reason Trump was in that position to begin with, and he is there because Americans want him there.
Objectively this is a stated fact (unless you believe the election was rigged). But it glosses over so much nuance and context.
The same can be said of Brexit, Victor Orban, AfD, etc. All of these bad things were, nevertheless, boosted by Russian ops with the same general strategic goal in mind.
Israel has a lot of enemies that going against them. Which is why they have incentive to be good at this - to attack back. Corporate attempts are just ways to make money.
I'm going to stay out of the political issue of what any actor should do.
Why do you think that is?
lol downvotes
Certainly some is antisemitism. To imply, as you have, that there is 0% legitimacy to any other reasons to hate the behavior of the current Israeli government is just as pro-genocide as you claim antisemitism.
Most people I know who oppose Israel's actions in Gaza have no problem with Jewish people; many themselves are Jewish.
In my political opinion Israel is an artificially created state which is why it's so unstable and we should simply walk away and cut our losses on this. I believe my opinion is the prevailing populist opinion too so y'all have to contend with that.
There needs to be some compromise between our points of view or else we'll continue to get more war and violence. I think our country needs to recognize our responsibility for this mess and should offer land in North America of equivalent value for any Zionist refugees and then leave the poor people of that land alone. I ultra extremists would feel right at home in the Catskills lol.
...are also widely considered bad actors. Yet, it isn't "islamophobia" when you criticize Iran or "anti-Orthodox" when you call Russia to account.
Curiously, however, when you similarly criticize the actions of this specific Israeli government and its leaders, you are slandered with the term "antisemite" and there are orgs that exist to doxx you and get you fired from your job.
Isn't that weird?
Thankfully, in many such cases, we can call the skyman to rescue:
What is hateful to you, do not do to your neighbor. That is the whole Torah; the rest is the explanation of this—go and study it!
I see lots of (maybe un-carefully-worded, maybe?) bashing of the actions of the current Israeli government, and its defense forces and intel apparatus.
That's 100% fair game, anywhere on the planet.
What's I don't see is the rank antisemitism you claim, except for a few outlier recently-created accounts.
The most despicable thing I see at scale in the conversations is the attempt to silence critics of Israel with slanderous accusations of antisemitism. It used to work, as a tactic, but it (like the "racism card") has been vastly overplayed and is rapidly losing its value.
I didn't attempt to silence anyone. I simply called out what I see. Silencing is what HN does when they moderate the Ukraine Russian discussions different than their newer standard for Israel Palestine.
Finding an understanding patterns and acting according to them is the most logical and natural thing a human or any life form can do. You would call someone speciest for not hugging a bear just to feel ideologically pure.
Pegasus: How a Spy in Your Pocket Threatens the End of Privacy, Dignity, and Democracy by Lauret Richard
But something tells me that the way you framed your question, is not about the companies and more about you and how you view Israel.
> The same reason why many great tech companies originate from Israel. That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
You never said what the reason for that is. Their society doesn't seem more tech-oriented than comparable countries. Their universities are OK, but not the best in the world. So what in their society caused this?
This bullshit polarization of ideology ruins civil discourse. It's possible to condemn Hamas' slaughter of innocents, and condemn Israel's slaughter of innocents. And to still realize there are innocent Palestinians and Israelis who are not working to make things worse.
Simply asking the question is going too far for most.
Paul wrestles with this in Romans 9:6.
Culturally, Israel has a strong emphasis on entrepreneurship, coupled with general lack of tolerance for bureaucracy, makes for pretty agile organizations.
In the military side, it creates a country sized funnel that picks the best people and places them together trying to solve problems that would seem impossible. When these people are discharged, they are friends that knows how to work best together. Think of it like a larger and more focused version of an Ivy League school
wait - what's the reason, though? i don't understand what you're trying to say.
> That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
you cite two american companies with presence in Israel to defend your claim that "many great tech companies originate from Israel".
> is not about the companies and more about you and how you view Israel
your entire response is predicated on your view of Israel but you haven't explained what your view actually is or what it's based on.
If Mossad is willing to give you a hundred million to make your startup a spyware company, you're obviously going to agree.
what a sad take.
Only Jewish pedophiles & criminals. Israel will not let in random non-Jewish criminals to flee prosecution, only those who are provably Jewish are granted citizenship and non-extradition.
It's fairly common in Europe[0].
[0] https://en.wikipedia.org/wiki/Jus_sanguinis#Leges_sanguinis_...
This is clearly a racial ideology.
> Converts to Judaism who wish to immigrate to Israel are evaluated on a case-by-case basis by the Israeli Interior Ministry, which determines whether the conversion was sincere in its view
The reasoning behind the 1970 amendment is usually traced to the Nuremberg Laws. Nazi Germany defined a Jew for the purposes of persecution as anyone with a Jewish grandparent. The amendment drew Israel’s circle of protection at the same radius: if having one Jewish grandparent was enough to be persecuted, it should be enough to be given refuge.
It is not a great law but it is what genocide is agreed to be and it is not based on amount. It's all about intent which is very hard to prove.
The ethnic cleansing that happened when Israel gained independence was not in just one direction, Israel also did allow plenty of Arab/Palestinians to stay and gave them citizenship where feasible. It's not surprising however that Israel doesn't currently offer citizenship to a population that largely doesn't think Israel should even exist. States don't normally give citizenship to their non-citizen enemies.
> They also allow people to convert to Judiasm and enter, so it actually has nothing to do with their ethnicity and is solely based on religion.
It's not solely based on religion. It's also quite rare for people to convert to Judaism in general so that exception has little practical implications.
It is no different that Israel's location tracking of StarLink terminals worldwide: https://www.newarab.com/news/israel-tech-firms-can-locate-an...
This is the same issue that the US government has with Chinese networking companies, it is too easy for the Chinese government to pressure these Chinese networking companies to put in back doors in the interests of national security. The US likely knows this because it pressures its own companies in similar ways.
I think the only technical solution available to individuals is to boycott non-verifiably e2ee services and corporate operating systems (especially including android).
just to confirm your info... https://buenosairesherald.com/society/argentine-teenager-pla...
If you put out a fire how many are you allowed to set while people applaud selectively?
I don’t think they’re striking a good balance between how invasive they are compared to the real results they deliver.
If the world moved that way overnight, I wonder where digital spy budgets would go. Into traditional techniques, cracking encryption, banning encryption, or a more educated guess?
In addition Israel is an apartheid state with many undemocratic features:
https://static1.squarespace.com/static/66a134337e960f229da81...
America was a democracy while we were exterminating our native population. Democracy is a system of government. Voters can democratically vote for terrible things.
Israeli Arabs are allowed to vote.
> Israel is an apartheid state
This is a valid argument, though still stretched–America didn't cease to be a democracy while we occupied Germany and Japan.
> America was a democracy while we were exterminating our native population.
I would argue that it was not for the very same reasons (and of course there were many other classes not allowed to vote at the time). Killing someone robs them of their right to vote.
Sure. But this also describes a lot of well-accepted democracies' histories.
Perhaps you're thinking of a liberal democracy?
> would argue that it was not
Sure, according to a personal definition that countries cease to be democracies any time they go to war (or more narrowly, commit war crimes), Israel is not a democracy...
> there were many other classes not allowed to vote at the time
Most democracies also prohibit children and non-citizens from voting. The term you may be looking for is full democracy. And I think most people and experts agree Israel is not a full democracy [1].
[1] https://en.wikipedia.org/wiki/The_Economist_Democracy_Index
I mean we're talking about all Black people, Indigenous people and women! I think arguing semantics isn't helpful.
Israel is an illegitimate state practicing crimes against humanity. That some of the colonizers can vote isn't really relevant. I actually think this can help us reflect on the true nature of the US as well and push for things like land back to Indigenous people and reparations for Black people.
Yes. Athens was similar–a minority of the population could vote. It was a deeply flawed democracy, but a democracy nonetheless.
> That some of the colonizers can vote isn't really relevant
Literally America! Also all of Europe depending on when you draw the line. Also all of the Middle East for the same reason. (Also most extant Native American tribes.) Hell, even in Palestine we can only say more than 50% of the population traces from Bronze-Age heritage.
By your definition, democracy does not exist and cannot exist in most parts of the world.
> this can help us reflect on the true nature of the US
It really can't if we're redefining precedented terms. America, like Israel, is a flawed democracy.
Can we get an alien invasion already please, god
Yet we don't sanction Israel nor hold them accountable in any way. Of course they're spying on members of the UN and ICC, of course. Israel is at war with the entire world right now, and my politicians continue to support them. Thankfully many people have woken up, but the situation is dire.
Based on responses from roughly 46,700 people assessing 129 countries, Israel ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
https://www.middleeastmonitor.com/20260513-israel-becomes-wo...
A Discover-Tech ad impression does not in and of itself confirm targeting or infection with spyware.
Israel is at war with Hamas, Iran and its proxies and allies.
In any case, Netanyahu's self-described "eighth front" is world-spanning and being (poorly) fought right now: https://www.timesofisrael.com/failing-on-the-8th-front-the-m...
Israel's engagement in worldwide information warfare is self-professed. You might not call it war, but Likud does.
https://www.dropsitenews.com/p/jeffrey-epstein-ehud-barak-le...
I will never vote for this particular (D) candidate again. Fortunately, the (L) candidate seems reasonable.
If indeed your representatives support Israel or the genocide in Gaza, I urge you to consider voting 3rd party. In two-party elections, candidates mostly just try to be a little better than their opponent. What forces them to do more isn’t a third party actually winning. It’s a real risk that enough fed-up voters will go third-party and cost them the election. This is basic game theory optimization.
edit: and I have been hasbar'd now for simply stating the fact that making people fear you instead of love you has consequences. oh well.
Hope we follow guidelines under this link or “then nobody gets it!”
Based on responses from roughly 46,700 people assessing 129 countries, X ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
https://www.middleeastmonitor.com/20260513-israel-becomes-wo...
Thanks by the way for introducing me to that graph. I didn't know that anyone collected that kind of stuff.Absolute morons.
Exploding pagers. Israel literally killed people with consumer tech.
They killed combatants in a war started by the same. Assuming you grant Israel the right to defend itself against those who attack them they could also have chosen to use less precisely targeted means to disable these combatants, leading to more 'collateral damage'. How would you have reacted had they done so?
I'm afraid to say there is zero justification for the atrocities Israel commits. None.
The numbers are available for you through numerous independent sources, Israel has murdered a disproportional order of magnitude more civilians than Hamas ever has, and even with these pager attacks it was reported each device had numerous collateral damages.
So please, if you want to be a disgusting human being, do it towards someone else.
Is that the case? That's not the impression I got from the reporting. Do you recommend anything in particular I should read to verify your view?
> Photographs and videos filmed by victims and witnesses to the incident and reviewed by Human Rights Watch showed pagers exploding in various locales, such as grocery stores. Other videos that appear to be linked to the incident show adults and children in emergency rooms with severe penetrating traumatic injuries to their heads, torsos. and limbs, and other injuries consistent with the detonation of high explosives.
https://www.hrw.org/news/2024/09/18/lebanon-exploding-pagers...
No, these specific attacks did not 'kill and maim far more bystanders than the targets themselves', where did you get that from? The beepers contained a few grams of explosives, enough to blow off a hand but not nearly enough to cause the imagined effect you describe. There is plenty of video material available which shows these things going off in pockets, hands and other locations. None of these show any collateral damage.
They use this software to find and kill people. Which they then publicly brag about. How much more hostile do you want to be?
There is no limit. The request is not coming from genuine curiosity — they are asking for a stricter definition so that they can attack any one that you provide, no matter how sensible. The befuddlement is deliberate.
If I was to say which countries do the most to restrict digital freedom, I'd say look at this table: https://eylenburg.github.io/countries.htm
If I was to say what companies have done the most to take the most privacy from the most people, it would be American big tech like Google and Meta.
There's some okayish software from Israel I can think of, like Zcash.
These Israeli ones are literal criminal companies. What Meta does should be illegal. Both are immoral.
A single spyware against a journalist is much worse than a single Facebook user, but for the total impact on society, they both destroy democracy and human rights significantly.
>I would sooner trust a Chinese company than an Israeli company
As for trust, with privacy I'm a big proponent of avoiding it. Use E2EE or self host if you have to. The country does not matter so much.
We all end up running closed source code somewhere
If you do you'll be much better off avoiding Israeli tech
As a rule if you boycott everything Israeli it'll be smarter, more ethical, and safer
Israel has openly and publicly threatened western politicians and citizens that don't aid their agenda however, many times. Like Russia, they have also shot down commercial airliners.
Unlike Russia, they have killed American sailors whilst directly attacking American naval assets.
Vote me down all you want for saying something about Israel that's not super negative, but it's not a "which country do I dislike most" competition when it comes to facts.
Also, meta discussion about down votes is against him policy, yet magically you're exempt, typical of **
Israel being a (disfunctional and rather illiberal at this point) democracy, means it's much better for it's own citizens (excluding Arabs ofc), but says nothing about the people outside. Same for the US BTW.
Israel still have the reputation of being part of the ‘free world’ in the collective mind.
that is more dangerous.
At this point, I don’t agree. I’m an immigrant living in the US currently. From an infosec and real-world consequences perspective, I have much less reason to fear what the Chinese government or corporations could do with my information than what either the current US government or its major tech corporations might do.
> Israel still have the reputation of being part of the ‘free world’ in the collective mind.
That collective mind is cognitively challenged and extremely ignorant, but it doesn’t mean I have to be.
I guess that your concerns are not aligned with reality, or the benefits far outweigh whatever it is you think may happen.
(Talking as an Israeli working in cybersecurity)
It's possible for this to be true, and that they spy on said companies on behalf of the government of Israel. It makes it easier to do so.
Do we have evidence this is a state operation versus a criminal group?
* The state of Israel does authorize spyware sales (eg NSO Group has to get a license from the Ministry of Defense, and Israel's Defense Export Control Agency states that its decisions take national security / foreign policy into account).
* In the case of Pegasus, NYT had reported that Netanyahu intervened to make an exception allowing sale of Pegasus to Saudi Arabia (as political leverage). NSO group execs used Israeli diplomatic passports when they traveled and stayed at the Israeli embassy.
* The government doesn't crack down on these industries, which it would do if it really considered them criminal.
* In this particular case, one of the main targets was Al Jazeera, which seems unlikely that a criminal company would want to target vs. a state actor.
So yea, the government seems to allow these companies to engage in what other countries would consider criminal activity. You can then kind of choose your spot on the spectrum of: "I think this is some broad conspiracy the government purposefully designed for large-scale espionage" or just "The Israeli government thinks it would be good to have great cybersecurity skills in the country so they bend the rules a little".
A good well-researched read is The Palestine Laboratory by Antony Loewenstein.
This crap is the worst of the worst.
I've witnessed consumer apps throwing quite heinous malware/sketchware advertisements and watched the banners rotate between 4-5 different ad vendors to keep things hot and spicy.
A regulation here that applies to all app stores is even business friendly as an appstore which wanted to do this already wouldn’t be punished by trying to do this on their own, for the reasons you mentioned.
Dang's official position by the way https://news.ycombinator.com/item?id=48100358 let's see how this thread goes.
Wild guess even if not in this particular case it's best to consider the possibility as non theoretical.
2) Adblockers
You should threat model, but if you want to maximally protect yourself, use Vanadium or Brave Browser and GrapheneOS and no privacy invasive apps.
In fact, just update the url and title to the report:
How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
https://citizenlab.ca/research/how-discover-tech-turned-targ...
How is this acceptable for society goes beyond me. And then corporations blame individuals when they get scammed. It is your fault that we have all your information and leak it everywhere, when it is not just directly sold.
And add jail time to fines. Fines means nothing for the rich.
People in the US have a unique window of opportunity starting TODAY (Oct 2026) in many places with early voting. I implore everyone who is able to vote in the midterms to do so.
What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).
If they win the landscape will change. It would set a precedent for civil liability for infecting your users even when it's not your content directly. That would likely spook the shit out of the market, security becomes a feature.
Attacking a single website does nothing. If you bankrupt the site, there are millions more sites. If you attack the ad provider, bankrupting it, and shutting it down, millions of sites are now protected.
Your logic just doesn't compute
I think you're also confusing multiple malicious activities occurring on the web. Data harvesting is another thing that needs to be banned into oblivion. Rarely are sites doing that natively. It is being done as a second part of service the site wants. A site/app wants naturally wants to seen analytics about how visitors are using the site/app, so they include some third party tool that provides that data to an extent at the cost of collecting/keeping that data for their own use. Want to make it easy for users to interact with social platforms regarding your site/app, they now get to collect/keep that data. That's a different thing than being served malicious ads.
"I'll pay you if you run this software on your visitors' computers without asking questions" is not a "service" you sign up for. People don't pay you as a service. That's about as shady a deal as it sounds.
It's fully possible to individually negotiate with someone that wants to publish an ad on your site. If you choose to take money from literally anyone who wants to do so, then why would you not be accountable when they inevitably use you to target users for fraud? You chose to take their money and not even look at what you were publishing.
Sure it did. The content coming from elsewhere doesn’t change their decision to include it when the user loads their page.
It just makes the decision wildly important.
This is no different than the “I’m too big, can’t tell what my subsidiaries are doing!” wink
Pay attention, do due diligence to do things correctly, or don’t do them.
It shouldn't fall on the person just going to a website to track down the vendors and third parties the website contracts with.
The ad platform that allows malware to be served to anyone is at fault.
As is the individual website that has selected to allow a 3rd party's code to be delivered to your machine without controlling that risk, often for very silly reasons.
Laughable. As countless class action lawsuits have demonstrated the victims are never made whole (https://instituteforlegalreform.com/wp-content/uploads/2020/...), the criminals get a slap on the wrist fine that is a tiny fraction of the profit they made doing crime, and the lawyers walk away with pockets filled with cash while nothing changes. (https://link.springer.com/article/10.1007/s10611-024-10170-w)
Fine's and class action lawsuits don't work. Throw some CEOs in jail and things will actually change.
This mentality of "it's to hard" doesn't get things done.
I do agree that some greedy lawyers and civil liability would solve this, but that's not a long term solution at all.
So you search for company A wanting to buy their product. You check out. Basically every setup I've audited has every tracking product ever for everything.
So you buy X, and the company sends that purchase event with your information to Meta, Google, TikTok, Applovin, Klaviyo, and 10 others.
This idea is hopelessly entrenched in every marketing department, who has leadership's ear: We HAVE to send EVERYTHING to EVERYONE otherwise our ROAS will go DOWN!
Every platform works this way, they're all set up to put giant red banners on your marketer's dashboards
"You could be getting 50% better results if you sent <customer_2nd_grade_report_card>!"
Too bad no one has the guts to enforce the law that way.
The main problem is that the exploits from js to code execution or data exfil are possible in the first place. The issue is that you have JS, which is generally pretty isolated, able to talk to bundled libraries (like libwebrtc), which often contain the exploits and share the same memory space. There needs to be a intermediate layer between JS talking to any such library, like process isolation with IPC for communication.
Easy, when your society glorifies and deifies greed, you can excuse literally any act so long as it makes enough money.
That's it. That's the entire explanation. It's capitalism and greed.
Not quite. Most people in society are completely oblivious to this happening. And their lack of awareness is why the exploiters don't face more public opposition.
This, pretty much. Money removes consequence form your actions. If every time you screwed up, instead of being fined you had to wear a silly hat, go on TV and apologize, or get some time behind bars, even if it were 1 or 2 days it would be very effective.
The CTO happens to have worked for Radware
https://www.innovid.com/about-us/news/mediaocean-completes-a...
https://www.innovid.com/about-us/news/mediaocean-completes-a...
As I skimmed the CitizenLab report, it was particularly interesting to see the history of the company and how they may have been acquired specifically to use as a covert operation.
I guess it is because it has been under the threat of larger enemies from its birth, so it must leverage whatever it has to survive. And once you grow an organization and let it loose, you don't have much control over it anymore, and it grows in the wild like a flower.
In that one incident, they killed and injured more than double the number killed and injured by Al Qaeda in the attack on the USS Cole.
That’s as much as your mom knows.
Yes.
But yeah the country under an eternal international microscope is the one “getting away with it.”
...Did you just emerge from a bunker that you entered in 1946? Here in 2026 we're on quite a losing streak against MUCH weaker opponents. I mean I get it, you're doing the "Jewish conspiracy" thing and reality, truth, words having meanings are all inconsequential to you, but you have to try harder than this.
Though this may be changing now with Trump and the israelification of america.
Come on... Snowden told us that we were all being spied on and we made some movies, some books, a lot of blog posts and that was it.
Abu Ghraib? The people literally on film doing things were prosecuted, and it was passed off as an essentially low-level problem.
Gitmo still exists and has prisoners.
We invaded Iraq on a lie, literally lied to the UN about a nuclear threat that didn't exist. Elected that guy a second time, just like Reagan and Nixon and Trump.
What we're good at is public debate that goes nowhere and losing wars in the Middle East.
2. Israel is embedded in US politics. So US government is allowed to purchase this from Israeli contractors but I doubt they would be allowed to purchase sensitive stuff like from a neutral country like UAE.
So, the US is the customer and also protects Israel so Israel has built an entire industry around it.
Russia, China and America each have notable offensive cyberwarfare capabilities. (Pyongyang is a nuclear-armed cybercrime ring at this point.)
China doesn't have large sanctions because it plays a key role in the economy, but the US had massive regime change intelligence operations against them in the 90s, but they failed and were dismantled.
Israel is not particularly skillful: they're a little bully getting in some punches while a big bully holds back the rescuers. Ooh, tough guy!
But good on you for recognizing that we have a pattern of this kind of thing, even if you've stopped just short of noticing that it's a problem.
I think its pretty clear to everybody now that we cannot protect you if your enemies are:
- sufficiently crazy
- willing to spend $1 attacking for every $50 we spend "defending"
It's now a very different kind of bargain.
"The people I don't like are always unskilled." You shouldn't hate your enemies; it affects your judgement.
Israel is the one occupying and bullying its neighbors, spying on its "allies", doing air-strikes on neutral countries, attacking US research ships, and performing piracy and kidnapping in international waters.
They ascribed a lot of the tech innovation to conscription - lots of the founders had learned a lot while in technical posts in the army and put that to use when they left.
https://en.wikipedia.org/wiki/Unit_8200
>The unit is composed primarily of 18–21 year olds. As a result of the youth of the soldiers in the unit, and the shortness of their service period, the unit relies on selecting recruits with the ability for rapid adaptation and speedy learning. Afterschool programs for 16–18 year olds, teaching computer coding and hacking skills, also serve as feeder programs for the unit. Former Unit 8200 soldiers have founded and hold top positions in many international IT companies, including in Silicon Valley.
>According to the Director of Military Sciences at the Royal United Services Institute in 2015, "Unit 8200 is probably the foremost technical intelligence agency in the world and stands on a par with the NSA in everything except scale."
I would recommend you to visit Israel and traditional orthodox jews. Women are serving as "birthing machines", constantly pregnant, and doing all house chores. Education for women is strongly discouraged. Men are "studying", but useless memorizing of old texts.
Normal education in western sense is strongly discouraged in traditional jewish culture!
https://www.timesofisrael.com/israel-plummets-to-worst-ever-...
As I understand it, they know God's not stupid and sees right through this sort of thing, but they believe God put rules like "stay indoors on the Shabbat" in place so that He could entertain Himself by watching the creative loopholes humans come up with. Other Shabbat loopholes include putting things on timers the day before, paying a non-Jew to do things that Jews are forbidden to do, or legally transferring ownership of the cupboard full of bread to a non-Jew for the one day a year when Jews aren't allowed to own bread.
And as I understand it, they do this with all things, from a young age. Cultivating this mindset definitely has something to do with their cybersecurity prowess.
There's no reason Netherlands are better at chip lithography except that they're doing it (Dutch agriculture success can be attributed to good soils/climate/geolocation, but not chips). There's no reason Hollywood is better at filmmaking. Kinda chaos theory -- small changes to initial state leads to huge changes in the later outcomes.
Same thing with Israel -- if they had some easier way to make moneys they would go for it. But constant demand from their defense kept if afloat.
If you want to do something artistic or start a business based around Art, Montreal is perfect for it, for the very same reason above.
Initially the govt invested in the arts to preserve French culture, which resulted in a lot of art infrastructure being made, cheap ateliers, fabric suppliers, paint suppliers, &c. Which attracted a lot of artists, which then increases the demand for the art infrastructure, which makes the city easy to make art in.
It makes it stupid easy to make stuff and find the skilled artisans you need to make it. Much easier than any other Canadian city I've lived in.
West coast filmmakng started in the Bay Area (at the time the largest conurbation in the west) but moved south because of the year 'round weather.
But why the west? Because Edison controlled the filmmaking patents and demanded not just royalties but script oversight as well. By moving west, they could ignore the patents because they were simply too hard to enforce from such a long distance.
So ironically, given how things worked out, IP piracy is at the root of Hollywood.
The only reason I even commented was because IP issues are popular and relevant on HN
Plus very much present in US politics and power circles for some reason.
2 examples out of many - my boss is a prime example, every thought somehow infused with money (I work in a bank). My ex gf was exactly the same (she is a successful commodity trader). Just very, very different mindset to the core to say typical european one (I mention folks who are europeans and I've never been to Israel, so extrapolating a bit here).
It has always been at odds with its neighbors and has persecuted its occupied people, for far too long. It has further facilitated other tyrant governments in the control of their people. The cyberwarfare industry in Israel is directly part of the controlled Defense Industry.
It is not under threat. It has sought to be a formidable threat to everyone.
See professor john mearsheimer on the history & future of israel
https://www.youtube.com/live/z8wooQEYyzc?si=_STtJSdEjDUwIl72
What I meant was, I don’t think Israel is the only guilty party in that decades old conflict, nor the only side with agency to choose how to react in the conflict.
Read the Hamas charter, Iran’s statements about Israel, etc. Israel is not unique in choosing violence.
As everybody else in the planet. Israel is not special in that sense.
Over the last 50 years, the probability of anyone invading france, canada, australia, etc has been next to 0. The only countries that really had to worry are the ones that straddle the regions of influence during the cold war.
Good for them. They learned to cooperate with their neighbors, created alliances and friends, and restrained to kill other people.
If you have one enemy, the enemy is the problem
If everybody else is your enemy, YOU are the problem.
Check your behavior and see if you can improve as human being.
Pre-1967 Israel didn't control the West Bank or Gaza. So most of the bad stuff people claim about Israel today didn't really exist.
Yet all its neighbours wanted to destroy it.
Lebanon who in theory should have no dispute with Israel bombarded it with ten's of thousands of rockets, mortars, anti-tank munitions etc. After Oct 7th.
The bit you're missing in your overly simplistic analysis is that Israel is really surrounded/attacked by a single religious/political ideology. There is no "everybody else here".
Israel has stolen as much military and industrial secrets from US as they could grab. Has violated every international law. There are strong suspicions to be behind Epstein honey trap for riches and politicians all around USA and Europe. Has funded Hamas. Has an horrible relationship with human rights, longer than the bible. Has called non Jews "human animals", and acted accordingly, even to the point of doing competitions about "who can destroy more kneecaps or shoot more testicles in a week", among starving people that were trying to obtain food none less. Has treated 5Yo children like partridges in a hunting party. Has killed thousands of journalists, doctors, nurses and NGO staff without even trying to pretend that they care. Has put spy devices in friend's phones each time they could. Was caught messing with the elections in UK. Has used, discarded, and left each politician that supported them, alone and hanging dry in the elections, from Biden, to Trump, to Merz.
US does not want the demise of Israel, but Israel does not even try to pretend that they respect the opinion of US. Even after all this time, is all grab and cash. And US is always cleaning the mess that they left behind.
And the only thing that we can hear from them is "Why everybody hates us?" Really?. Clean your acts first.
Because morality is a numbers game?
If Israel nuked everyone but one of their enemies, would they be in the right, as then they would have only one enemy?
TBH, considering the number of dead in palestine and the number of people in europe/us who literally lost everyone who ever mattered to them, the number of "terrorist" attacks seems relatively low.
If your point is the world is unfair, then yes obviously that is true, nobody disputes that.
- Compulsory military service means the government captures the best and brightest of the country.
- An extraordinarily outsized number of nobel prizes belong to Ashkenazi Jews, and other indicators of intelligence (lack of propensity for violent crime, lifetime earnings, etc) are also quite high for the whole group.
That we don't hear about it more often seems to me that nations that develop this stuff seem to have gotten better in making malware more precise in what they target and less leaky to the general population, but it could also be that media just don't report about it as much. When a gangs anonymous chat get hacked, or a tor hidden service website get taken down, news seems more interested in talking about the crime than what security vulnerability that the police used.
Unit 8200 [1]. Also, Israel doesn't extradite its own citizens and seems to turn a blind eye to criminals doing nonsense abroad. (Similar to Russia and China.)
"Unit 8200 was established in 1952," and apparently the Technion – Israel Institute of Technology was founded in 1912 [2]. I don't think Israel became a tech centre until the 1980s or 90s.
I'm not an expert on this. But similar to how military spending created Silicon Valley, I think Israeli military structure created its tech industry.
[1] Wikipedia
[2] https://ats.org/explore/videos/1912-today-the-institution-th...
That is why both Apple & Samsung have malware from Israel on their phones. The USA has the NSA building and exploiting products for surveillance and penetration globally.
Netanyahu recently was on a US broadcast, he held up a phone and stated to the reporter interviewing him, that Israel can penetrate any device obtaining it contents and then blackmail or discredit the owner of said device.
The USA now examines phones at airports to see if people are saying things the current administration doesn’t like.
American money, tech and intel, plus they are vastly overstaffed for the size of territory they want to defend.
But there is nothing explaining how the DLL becomes zero-click compromised by the ad.
No, their attribution is much more robust than this. Neglecting those details to oversimplify your explanation is intellectually dishonest.
> there is nothing explaining how the DLL becomes zero-click compromised [...]
They do, just a little later in that same section: "Both samples use a COM hijack for persistence [...]" through a malicious DLL.
and they’re just as troublesome as they were before,
to the degree they’re provably being used to decide who to send malicious payloads to…
Zero-click simply highlights if the user needs to actively interact with an element to get a malicious payload - or not.
This did get me interested in the specifics of the payload, though:
“It maintains persistence via COM hijacking by overwriting a legitimate COM class registry key’s DLL path with a first-stage DLL dropped in C:\Windows\system32\IME\, and it stores encrypted second-stage payloads in the configuration directory. A signed third-party driver (physmem.sys) enables kernel-level memory access and API call proxying to avoid detection. To preserve system stability, DevilsTongue reinjects the original COM DLL during hijacking, disguising this action through shellcode manipulation of the LoadLibraryExW return value. All additional payloads are decrypted and executed only in memory, allowing the malware to steal credentials from LSASS and browsers, access Signal messages, and use browser cookies to impersonate victims on platforms like Facebook, Gmail, and VK. The malware’s use of scrubbed metadata, encryption, and unique hashes for each file further complicates detection and analysis.”
from https://www.recordedfuture.com/research/tracking-candirus-de...
Then also mandatory pi-hole on every house.
Even if you are used by Windows OS, you must use an adblocker. Even if you use Chrome. On every browser.
I am scared for my parents to get exposed to this kind of thing from bad ad network actors. Does anyone have some practical concrete recommendations they took? Like I don't think they can install ublock origin and whitelist sites on demand in Firefox they way I do.
The only practical thing right now is to make sure they don't have the money on device and have 2 fac for email and bank accounts. But every now and then there are phishing attamepts that they could fall prey to.
It's tough. One option is to hope/assume that exploits only compromise user accounts rather than the whole computer.
In that case you can blacklist the banking website from the day-to-day browser as a reminder to switch to the other account, and configure the other account's browser so that it can do little else.
Without an ad blocker, they will be exposed to such an amount of social engineering (ranging from dropshipping sites, to subscription scams, to scam shops that don't ship at all but steal your CC data, to fake sites for government services, to attempts to trick you into installing malware) that you can't expect them to resist it. If installing uBO seems hard, resisting this or cleaning up the consequences is harder.
The amount of "hey have you heard of this great new product I saw" <photo of a handwritten note of the content of a scam site> went down from weekly to near zero once I got a relative to use an ad blocking browser.
No, I will never fund TikTok. This article must have struck a nerve with yourself identity. Speaks volumes about your void of humanity.
[0] https://yalebooks.yale.edu/book/9780300253375/culture-in-naz...
Wonder what the world's most boring ideological argument will bring us in the year 3027.
- The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.
- To the point below that "ad providers should be held responsible." There is no such thing as "ad provider." The AdTech ecosystem is teeming with different niches and business models - see the famous LUMAscapes diagrams: https://lumapartners.com/lumascapes/ . The sheer volume of traffic makes it virtually impossible to vet even a fraction of it. Google has thrown a lot of compute power to pre-scan 3p creatives and even then bad actors can sneak through. Add to this a lot of sophistication on their side (from different landing pages based on the perception of the type of user to farming throw-away advertiser accounts aimed at running just one campaign like that to hijacking legit accounts through sophisticated technical and people engineering means). In the end, politicians full of indignation do what politicians always do - sue or fine Google and call it a victory, whereas the true bad actors just keep going.
So, it’s definitely possible, especially with human review and static ads. No code. It might not be possible at scale. To me, that’s just not an excuse. If you can’t do something safely at scale, then you shouldn’t. If that means generalized online ads can’t exist then… so be it.
Online ads are definitely still possible. For example, im sure Disney reviews and approves all ads that run on Disney plus. So just do that, and if you can’t do that for e.g. YouTube then dont.
I think your answer gives us a clue about what went wrong and where.
The fact that internet advertising is run by the big US tech behemoths, makes them difficult to go after by countries that have previously had sane advertising standards. The lack of US regulation is the winning car in the race to the bottom.
That's the first point. Now, who should be responsible for getting the ads? The website? That will absolutely kill the monetization model and it is simply unrealistic. Which means, that responsibility now should be pinned on someone else. Who would that be? My point being that no one there has an inherent lawful obligation to provide such vetting, which would be a) costly and b) only applicable to one player (out of many).
And then we get to bad actors. If I were a really motivated bad actor as early as in 2005, I was serving different creatives and different landing pages to different audiences - a perfectly well-behaved ones to Google's crawlers (again, Google does A LOT to fight malware), a questionable quality clicky ones to general audiences and maybe malware-ridden ones to specifically targeted audiences. And you would not be able to catch me in real time - only after the fact, once the campaign was run and someone looked at the evidence (assuming it was collected, which it isn't normally)
There is no universe in which 'gosh it's just too hard' is the correct answer.
I'm assuming that means ad impressions and not unique ads.
And again, we are talking about logical creative (the actual visible part). Click URLs and such will definitely be different.
Perhaps the actual problem then are these monolith platforms that have done such a good job "eating the world" that they can no longer properly function.
I'm critically uninterested in the fictions of the business idiot class. I'm sure for many purposes it's important for all the papers to have the proper LLC's on them. For the purpose of burning it to the ground though, it's not overly important.
They 'solved scale' for being able to profit from it though.
The Web used to be a great place before surveillance capitalism and adtech took over. Some of us remember it. People participated because they wanted to. People contributed content because they enjoyed it. The incentive was a sense of community and contribution and shared knowledge - and usually there was no expectation of direct financial gain. Basic hosting was included in everyone's normal ISP plan. SEO wasn't a thing. Blogspam just to generate pages to host ads wasn't a thing. AI slop just to generate even more pages to host ads wasn't a thing. And there was still more genuine and worthwhile content out there than anyone could read in a lifetime.
If 95% of the modern Web disappeared tomorrow and all that was left was what people or organisations were still willing to contribute because they enjoyed it and/or it provided some direct benefit then the Web would probably be a much better place. I cite as exhibit A the fact that we're all here posting our thoughts on HN - itself a site that has always run without any of the intrusive advertising we're talking about - without any compensation or reward other than the enjoyment of the discussion and perhaps the chance to learn something new.
I see no reason to tolerate any sort of online advertising that conflicts with the above ideals. We should simply set rules that decide what is acceptable and drop legal nukes on any company - or indeed any entire business model or industry - that fails to comply. Low key advertising for YC's next round? I doubt a single contributor here minds the little banner that pops up at certain times of year. In-your-face auto-play videos that accidentally (or not - it doesn't matter) advertise something dangerous before your kid's favourite show plays? Sue everyone and punish the offending businesses without mercy. It's really not that complicated.
Continued lack of regulation, throwing up ones hands and saying "well, it's too big now" will not allow it to be solved.
What has been 'normalised' in the online advertising industry sets my teeth on edge as someone with some amount of security and privacy awareness. Hence I go out of my way to block as much of it as possible, for myself and family and friends.
Even the FBI and NSA make public their recommendation to run ad blockers as a safety requirement for internet browsing. I would have thought this may be some kind of red flag to say that maybe you're doing something not quite as well as would be satisfactory.
We can just decide that if you can't afford a person to vet the ad, it's not allowed to run.
Yes. That will destroy the current online advertising industry. As tempting as it is to say "that's the point", that is in fact not the point. The point is, we are completely in our rights as a society to say through regulation that if you can't vet an ad with a human, you can't run it, and the capital structure can damned well do what it does best and accommodate that whether they like it or not. We absolutely can write laws that say that Google is to some extent directly liable for the ads they run. Nothing is stopping us, at least in principle.
Does that mean it will be a lot harder for the advertising industry? Yes. So be it. That is not a reason this can't happen. Is it expensive for them? Yes. I don't care that this means that they won't be able to run anywhere near as many ads.
It is not a stopper that it would be really hard for them. It should be harder than it is. It should not be profitable to build a vast surveillance apparatus to squeeze literal fractions of a penny at a time out of us. It should not be profitable to have this massive machine that can push such targeted malware at as.
We're not talking about some minor tweaks that they can toss a few AI tokens at. We're talking about regulation that would rewrite the entire social contract of advertising. A social contract that we have not really signed, either individually or collectively. We can do that. We can rewrite the contract. It's a permissible thing.
We don't have to have a massive surveillance state just to serve us ads. We don't have to have sports gambling advertising on television. We don't have to have billboards on our highways. We don't have to have extra-cheap mailing rates for ads. We don't have to have Roblox and other video game systems exploiting our children's psychologies with deceptive game currency practices and gambling mechanics. We don't have to have state-sponsored gambling running what everyone knows is a backdoor tax on the poor. None of these things are physically inevitable. None of these things are socially inevitable. There are reasons why these things do exist, which economists and game theorists and political theorists have various words for, but none of the reasons are because they are mandatory and we're just stuck with them forever because there are no other possible worlds.
Which you can absolutely do, when you are Disney (read, agencies fight to run a campaign with you). When you are, let's say, TechCrunch, the situation changes - you can still strike some deals but a lot of your demand is not the same grade.
They're pointing out the article lacks substance implied by its title, and essentially that it would be nice to see the actual bad actors being prosecuted instead of the middleman. Both positive things to hear for me? Who cares if they work for the industry.
(The former thing is positive because it saves me time reading the article for information that won't be there.)
To paraphrase Churchill, it is a terrible model but others are worse.
If a website serves me malware, the website's owner should be liable to me. They may then be able to sue someone else, in turn. But I chose to interact with them and then they chose to outsource stuff to crooks.
This would be complicated to implement. But it's absolutely doable.
Then there are all kinds of fun scenarios - from drive-by malware to landing page malware to malware served after clicking an ad ON A LANDING PAGE. Who would assume responsibility for those?
Bottom line, this is not much different from "regular" crime. It happens. Governments employ police and various deterrents to reduce it. But it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness.
My main concern is supply chain attacks. I'm afraid, the frequency and sophistication of such attacks will only increase, thanks to really powerful LLMs. From there - to running keyloggers and stealing your bank credentials etc.
When I worked at an adtech company almost ten years ago, this sort of shit was the exact concern of me and my colleagues. We've had time to do better but guess we're just fucked.
"But not because of <industry I am employed by>"
As for the ad provider, it is trivial to not deliver criminal payloads if your business starts from the assumption that doing so is costly instead of something you can foist on society for your own benefit.
Why? An insurance product wouldn't wipe out ad revenues.
> this is not much different from "regular" crime. It happens
Why do you think parking lots have signs that say they aren't responsible for goods stolen out of cars parked there? Because that liability, by default, exists. And if a parking lot is a robbery hotspot, and the owners don't bother putting up cameras or whatnot, they'll absolutely start facing lawsuits and investigations.
> it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness
Nobody argued as much. That doesn't mean we give negligent actors monetizing malware a free pass.
Exactly. It moves the economic incentives from "serve the ads from the highest bidder and turn a blind eye to the fact that that's a scammer/malware" to "drop an ad platform that can't or won't keep the scammers/malware out".
Or even better, refusing to use ad platforms that let the ads serve arbitrary code. There is no strict reason why an ad can't be an image (re-rendered by the platform) and a link. Slapping scripts all over the place just makes it easier to collect data (among other things to verify that all the companies involved in serving your ad aren't cheating you, because the ecosystem is full of scammers in all directions).
The deterrent here would be prosecuting the accomplices involved in, and directly getting paid for, the crime.
How can you exercise situational awareness against a zero-day attack?
There are several parties who have an opportunity to detect that problem before it causes serious damage to people visiting a website. The visitors themselves are not among them. Trying to make those visitors responsible for the consequences is nonsensical.
And this would motivate fundamental change in the industry to be able to track down the bad actors.
KYC exists for various industries in order to track down the person responsible for bad actions. Implement KYC for the advertising chain, or something equivalent, to ensure there's a validly registered sue-able entity at the end of it.
> be mindful and exercise situational awareness
I'm not going to say victim blaming, but a good percentage of the population just aren't capable of this, especially with "the sheer scale" of advertising they're exposed to. It's exhausting to be on guard for the entirety of your life.
Might as well say: don't use the internet. That might actually be the best advice to come from all this.
The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited. The step-by-step info graphic in the article literally skips over how the infection actually occurs.
No, it doesn't. Your company is too much of a cheap fuck to do it and would rather offload that cost on society, no matter how bad the effects of it is.
>There is no such thing as "ad provider."
Only when it's to your advantage, because you're very happy to refer to yourself as an ad provider in every single marketing piece.
>AdTech engineer here (some 13 years in the industry)
You've made the world miserable for the past 13 years and have the gall to come over and pretend you're a poor innocent little thing who can't do nothing UwU there's just too much how could we be held responsible.
It’s a choice, and on the other side of that choice is profit.
I also have a choice. I choose to filter out as many ads I can. That is my vetting process.
How do you even plan to explain it to your grand-children?
Their argument was often that the complexities and volume of data, messages, devices just made it impossible for them to help law enforcement even when justified. Almost as if they were apologetic -- they simply cannot help!
But I was in a room once with a very senior police official, prosecutor and several telco reps when the simple question was asked: why is it not impossible then also to do billing?
Every time the conversation moved away from this point, it was forced to return by the non telco members: they knew it would cost money for the telco to help. And any argument against that was simply foregoing that cost at the expense of the safety or well-being of the public, and was unacceptable.
You may feel (in my example) their are many arguments against state surveillance, but the core truth is that all of these ad providers could indeed have systems that at least attempt to prevent this kind of activity -- it would just reduce profits to do so.
Lastly on the zero click lack of detail: it's kind of irrelevant. The exploit might be complicated, but the vector is clear -- the ad network.
It read to me like it was assumed to be using OS/browser/application-level exploits to get further access to target devices. I suspect the CitizenLab report is light on details in particular because they don't actually know them:
> In most cases, the user who sees the ad is not selected for targeting, and the server will not return any JavaScript to be executed.
> A large number of ads placed by Discover-Tech contain a script tag pointing back to what the company refers to as a “NOAS server” (also called a “getAd server”). This tag causes the ad, when rendered, to connect back to Discover-Tech, submit advertising identifiers for the user (either a cookie ID or a mobile ad ID), and automatically execute any JavaScript code returned. The NOAS server decides, apparently based on a combination of the source IP address and the advertising identifiers, whether the target is eligible to receive any JavaScript. If so, then code is returned. If not, a 0-byte response is returned. The NOAS server is a key part of Discover-Tech’s strategy, allowing Discover-Tech to avoid directly sharing malicious code, or even pointers to malicious code, with the companies who serve and display the ads.
It would break the long tail of the ad ecosystem, but a bunch of people think the tradeoff is fine.
Given how much of online advertising is now in walled gardens rather than display ads, I think this shows this is more doable than the people who are part of the open ecosystem want it to be.
Ads drive the internet. Sorry, but it's true. And you, the technical people, have no real idea of the scale. I don't like ads, but was amused when I had to turn off all my blockers to get stuff done. Many people in the adops world dislike ads, but money.
The point he's making is simple: the ad networks are not responsible for the ad payload. And you might argue the point, but your arguments are worthless. Even finding the entity responsible for the payload will be difficult, and they're probably overseas. Are you going to sue them? No, you're not. Can you actually prove damages, even if you did decide to sue? Probably not.
The structure in the article sounds nefarious, but it's literally the adtech stack. The only thing the company must be doing that's abnormal is tracking all the users in one specific IP range and associating it was a company, likely with their emails. I never touched the targeting section of the stack, but I presume that's possible but not "normal."
https://404privacy.com/blog/how-israel-used-ad-auctions-to-d...
My opinion on web infra patronage has shifted over time, I used to generally accept that for small websites to exist advertising was a necessary evil since they were too niche to have a real revenue source. Then I ran one and I realized that there's far more labor costs involved in maintaining a site than infra costs and that for niche hobbies and communities ten bucks can just find its way into a central pot every month to keep the lights on by those with a bit more to spare.
I am now of the opinion that web communities can survive in the same way arts and other liberal pursuits have always survived. People with a bit more to spare put more into the pot to create the community they want to exist in and "freeloaders" is an alien concept to the genuinely interested since that money is being spent to create a place where meeting can take place without a financial requirement.
And the only 'users' of these websites will be rich people? Because the moment a paywall goes up on a website it becomes unusable for a large portion of the planet.
But that aside, I think what we would see is a lot more Facebookification. A bunch of walled gardens that you pay a subscription for and then you get access to a whole slew of sites that FB buys up. Of course, they will make sure every site ends up toeing their line too.
If you ban online advertising, every publisher you know and like will either exit the market or need to use a paywall (which are famously… popular and successful for niche publishers? No.)
You can call online advertising loathsome if you want (indeed a lot of it sucks - no argument!) but it pays for content that everyone consumes. (Unless you only use HN, which is 99% of the time a collection of links to other sites with ads or paywalls or both.)
Regulate online advertising - fine. But “banning” it (what would that even involve?) is not a serious suggestion.
> If you ban online advertising, every publisher you know and like will either exit the market or need to use a paywall (which are famously… popular and successful for niche publishers? No.)
OK.
It's a fine model so long as you don't need it to scale to one million active users.
> We found two world-readable Apache Druid instances running on Discover-Tech’s website mtrtb[.]com. The druid.mtrtb[.]com endpoint contains bidding data for Discover-Tech’s MyDSP platform
https://news.softpedia.com/news/The-Jester-Presents-Project-...
Back in 2012 The Jester claimed he used targeted spyware to target Mir Islam or Josh the God leader of UGNazi which according to him led to his arrest, though law enforcement never confirmed it.
Interestingly enough they have his laptop he used for a while in a museum.
https://www.spymuseum.org/exhibition-experiences/about-the-c...
Found his blog post about it:
Given whom did this attack, I would not be surprised if it was used as intel for strikes on journalists.
There are reliable sources from inside the Israeli Intelligence apparatus that have stated on record that decisions were made to sacrifice 500+ innocent civilians to carry out a strike on one human target. I bet such a strike would be more likely if spyware indicated that one of the innocents was an "enemy" journalist.
Maybe Google, Yandex, etc. will decide this is the last straw and finally get serious about filtering malicious ads out of their services. Past history indicates they won't. I feel sorry for anyone who depends on ad revenue, but not sorry enough to expose people I care about to this crap.