Oh darn, maybe we should just ban the entire online advertising industry. Gosh, what value we'd lose if we couldn't have our personalized attention destroying glitter boxes.
My opinion on web infra patronage has shifted over time, I used to generally accept that for small websites to exist advertising was a necessary evil since they were too niche to have a real revenue source. Then I ran one and I realized that there's far more labor costs involved in maintaining a site than infra costs and that for niche hobbies and communities ten bucks can just find its way into a central pot every month to keep the lights on by those with a bit more to spare.
I am now of the opinion that web communities can survive in the same way arts and other liberal pursuits have always survived. People with a bit more to spare put more into the pot to create the community they want to exist in and "freeloaders" is an alien concept to the genuinely interested since that money is being spent to create a place where meeting can take place without a financial requirement.
>I am now of the opinion that web communities can survive in the same way arts and other liberal pursuits have always survived.
And the only 'users' of these websites will be rich people? Because the moment a paywall goes up on a website it becomes unusable for a large portion of the planet.
AdTech engineer here (some 13 years in the industry). A couple of notes:
- The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.
- To the point below that "ad providers should be held responsible." There is no such thing as "ad provider." The AdTech ecosystem is teeming with different niches and business models - see the famous LUMAscapes diagrams: https://lumapartners.com/lumascapes/ . The sheer volume of traffic makes it virtually impossible to vet even a fraction of it. Google has thrown a lot of compute power to pre-scan 3p creatives and even then bad actors can sneak through. Add to this a lot of sophistication on their side (from different landing pages based on the perception of the type of user to farming throw-away advertiser accounts aimed at running just one campaign like that to hijacking legit accounts through sophisticated technical and people engineering means). In the end, politicians full of indignation do what politicians always do - sue or fine Google and call it a victory, whereas the true bad actors just keep going.
Prior to online ads, that is ads that existed on TV, print media, etc, ads were properly vetted. Very few outright scams made it through.
So, it’s definitely possible, especially with human review and static ads. No code. It might not be possible at scale. To me, that’s just not an excuse. If you can’t do something safely at scale, then you shouldn’t. If that means generalized online ads can’t exist then… so be it.
Online ads are definitely still possible. For example, im sure Disney reviews and approves all ads that run on Disney plus. So just do that, and if you can’t do that for e.g. YouTube then dont.
If a website serves me malware, the website's owner should be liable to me. They may then be able to sue someone else, in turn. But I chose to interact with them and then they chose to outsource stuff to crooks.
This would be complicated to implement. But it's absolutely doable.
Not to jump on you after everyone else did (although I agree with them), but they didn't give you a solution. The solution is unfortunately for everyone a robust KYC regime. Then the linkages stop being impossible to track and instead become merely burdensome.
Your appeal to authority as an "AdTech Engineer" works against you when support your own industry. You have a conflict of interest. Of course you will try to do damage control and PR.
This was my main question as well. I read the report, but I'm still not clear on what the browser vulnerability is. This clearly seems like something browser vendors should be able to patch, correct?
The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited. The step-by-step info graphic in the article literally skips over how the infection actually occurs.
>The sheer volume of traffic makes it virtually impossible to vet even a fraction of it
No, it doesn't. Your company is too much of a cheap fuck to do it and would rather offload that cost on society, no matter how bad the effects of it is.
>There is no such thing as "ad provider."
Only when it's to your advantage, because you're very happy to refer to yourself as an ad provider in every single marketing piece.
>AdTech engineer here (some 13 years in the industry)
You've made the world miserable for the past 13 years and have the gall to come over and pretend you're a poor innocent little thing who can't do nothing UwU there's just too much how could we be held responsible.
Obviously not the first time an Israeli tech firm is responsible for these types of exploits, and at this point I'd go so far as saying that any Israeli-based tech company (especially cyber security ones, of which they have a strong industry) should be considered beholden to the government of Israel and hence, probably not trustworthy. How could you be sure whether they will act like a trustworthy independent entity, or compromise your data for the benefit of the state?
OK, I read the report, but I'm still not clear on what the browser vulnerability is. This clearly seems like something browser vendors should be able to patch, correct?
The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited.
My question is, why is Israel so good at this? It seems to be at least the 4th cyber power of the world, after the US, Russia and China, if not actually on par or better.
I guess it is because it has been under the threat of larger enemies from its birth, so it must leverage whatever it has to survive. And once you grow an organization and let it loose, you don't have much control over it anymore, and it grows in the wild like a flower.
Don't forget the compounding effect. Say, one country (or city or community) decides to invest their efforts into area X (e.g. clock making in Switzerland). They do it and become better and better. As long as they keep doing that they can become #1 in the world. Regardless of any reasons "why them".
There's no reason Netherlands are better at chip lithography except that they're doing it (Dutch agriculture success can be attributed to good soils/climate/geolocation, but not chips). There's no reason Hollywood is better at filmmaking. Kinda chaos theory -- small changes to initial state leads to huge changes in the later outcomes.
Back when I was a tech journalist, back in the 90s I visited Israel once and interviewed a number of their tech companies - admittedly most in the cyber-security space.
They ascribed a lot of the tech innovation to conscription - lots of the founders had learned a lot while in technical posts in the army and put that to use when they left.
Multiple reasons. America gives Israel special protection for everything they do, Ashkenazi and general Jewish culture values education more than anyone outside of East Asia, and a lot of Soviet Jewish scientists had to work for the military so they came to Israel with cryptography or spy tech experience.
Unit 8200 [1]. Also, Israel doesn't extradite its own citizens and seems to turn a blind eye to criminals doing nonsense abroad. (Similar to Russia and China.)
A few potential possibilities that may or may not be popular here.
- Compulsory military service means the government captures the best and brightest of the country.
- An extraordinarily outsized number of nobel prizes belong to Ashkenazi Jews, and other indicators of intelligence (lack of propensity for violent crime, lifetime earnings, etc) are also quite high for the whole group.
It’s an interesting question. I would also guess that this kind of behaviour would be illegal for private companies in many countries even if you don’t do it domestically.
It has always been at odds with its neighbors and has persecuted its occupied people, for far too long. It has further facilitated other tyrant governments in the control of their people. The cyberwarfare industry in Israel is directly part of the controlled Defense Industry.
It is not under threat. It has sought to be a formidable threat to everyone.
We have had viruses leaked by other countries in the past, with US and Germany coming to mind. If I remember right it was around 2005-2010 when democratic nations officially started to state that they had a right to use malware against criminals and military targets, and from that on it has just kept going. As I recall, Bruce Schneier and FSF made a bit of articles and talks where they tried to get people to understand that once democratic nations starts to use malware offensively they also generally stop protecting their citizens from those security holes.
That we don't hear about it more often seems to me that nations that develop this stuff seem to have gotten better in making malware more precise in what they target and less leaky to the general population, but it could also be that media just don't report about it as much. When a gangs anonymous chat get hacked, or a tor hidden service website get taken down, news seems more interested in talking about the crime than what security vulnerability that the police used.
And also it has help, it is unlikely it acts alone. Example Stuxnet. Israel has the talent so they are a convenient and willing proxy too for getting shady shit done.
To a certain extent, i think its because Israel benefits from being seen as "scary" so there isn't as much pressure to keep this sort of thing on the down low, where in any other countries there is more pressure to keep grey-area stuff like this secret to prevent blowback.
Because Apple, Intel and Samsung have huge engineering labs there and employ IDF & intelligence people to work in those corporation’s labs. It means they have very detailed knowledge of their products as they have all internal documents and also design software & hardware.
That is why both Apple & Samsung have malware from Israel on their phones. The USA has the NSA building and exploiting products for surveillance and penetration globally.
Netanyahu recently was on a US broadcast, he held up a phone and stated to the reporter interviewing him, that Israel can penetrate any device obtaining it contents and then blackmail or discredit the owner of said device.
The USA now examines phones at airports to see if people are saying things the current administration doesn’t like.
This, plus all jewish folks I've ever met are naturally smart (not genetically of course, more like societal pressures/expectations/upbringing), hard working like few others, and seem to genuinely veer towards numerical jobs - banking and finance, math, applied math like security, cryptography, trading and so on. Very similar to Iranians to be fair, if US and British MI6 wouldnt be meddling in Iranian internal politics and supporting corrupt shah to steal all the oil cheaply those 2 would be together a superpower on global scale. Israel was very very lucky to not have any oil on their territories.
Plus very much present in US politics and power circles for some reason.
2 examples out of many - my boss is a prime example, every thought somehow infused with money (I work in a bank). My ex gf was exactly the same (she is a successful commodity trader). Just very, very different mindset to the core to say typical european one (I mention folks who are europeans and I've never been to Israel, so extrapolating a bit here).
Israel is the one occupying and bullying its neighbors, spying on its "allies", doing air-strikes on neutral countries, attacking US research ships, and performing piracy and kidnapping in international waters.
It is standard that companies within a country act in the interests of its security services. Israel has a lot of ad-tech companies and thus it makes sense that they are roped into serving Israel's security services.
This is the same issue that the US government has with Chinese networking companies, it is too easy for the Chinese government to pressure these Chinese networking companies to put in back doors in the interests of national security. The US likely knows this because it pressures its own companies in similar ways.
Bills like the US CLOUD Act (there are similar ones in the EU and China) force service providers to illegally spy on people overseas (via unauthorized use of anything they can access—consider Microsoft’s Windows backdoors).
I think the only technical solution available to individuals is to boycott non-verifiably e2ee services and corporate operating systems (especially including android).
Why do some of the most evil tech companies, especially ones that use exploits and zero-days as part of their business model, disproportionately originate from the same small (population-wise) country? The company from the article, all the other examples everyone here lists, Candiru, NSO... All Israeli.
It was so successful that IronSource, one of those companies, ended up merging with Unity and I think they got like 25% of the company: https://en.wikipedia.org/wiki/IronSource
That explains a lot. You're basically just fishing for downloads in your target networks. You don't actually care if anyone clicks the ads in the installers, the sole purpose of the adware is to get arbitrary software running alongside the installer, so that you can compromise their machine.
Guess where the company big AI labs are using for security sandbox is from? The one that was involved in both big hacking scandals from "rogue agents" by OpenAI and Anthropic?
Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.
Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Totally not useless. It costs a lot more to pay a spyware firm then to have an employee send an email / ask a judge (like that's even necessary).
I feel quite confident of my messages privacy on my Pixel with GrapheneOS given most people I message are on iPhones which are second in security to Pixels running GrapheneOS. Not to mention my threat model doesn't include mercenary spyware, as most people's doesn't.
>Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.
If you're talking about the sideloading restrictions those were intended to stop social engineering and scams, not from getting hacked via 0days.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Source? play services is privileged but not that privileged.
> useless as a way to prevent people from being hacked
From being hacked by others. Google was just trying to protect their property, which is the ability to spy on their users' every move. Google themselves really don't need to "hack" their users for that, they already have all the access and all the data they could ever want. And they also have the ability to brick their users' devices at a moment's notice the same as Apple does.
However, this hack could have happened whether sideloading was allowed or not.
In fact, following the OP's link to https://citizenlab.ca/research/how-discover-tech-turned-targ..., "the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries" so it's not just apps but ordinary websites you visit in your android chrome browser.
I'm sure Google's latest push to make it inconvenient to install apps from outside Google's Playstore, where Google charges a 30% commission, is going to solve that.
It's really sad this got taken off the front page (347 points, posted 2 hours ago at the time of this comment). Israel is deeply intertwined with the tech industry and they use tech extensively in extremely hostile ways. It's relevant to this site discussion and the votes demonstrate that. There's no reason to hide the elephant in the room, let's address it, now is the time.
As much as it sucks for the ecosystem that's built itself up around the world wide web, good ad blockers and fingerprinting protection are as important as firewalls and antiviruses now. There's no more babies in this fetid bathwater.
Targets could have been identified using pretty basic advertising and marketing techniques. Bid requests broadcast IP, device details, and ad IDs to every bidder. Intersecting topic audiences across a few months of Al Jazeera stories could narrow that audience to a few individuals. The ad ecosystem already does set-intersection de-anonymization to identify interests and profile customers.
"Researchers also recommend that users at high risk of targeting use ad blockers, disable ad tracking, and regularly reset mobile ad IDs.". Not "recommend". Everyone must use uBlock Origin or at least some type of ad blocker in every device.
Then also mandatory pi-hole on every house.
Even if you are used by Windows OS, you must use an adblocker. Even if you use Chrome. On every browser.
It's kinda funny that a website with an article titled "Online ads weaponised to deliver ‘zero-click’ spyware" immediately loads a splash that asks users with adblock installed to disable it.
The separation between advertising and editorial has never been greater. Brought to you by the marketing wizards who saw you bought a vacuum cleaner on Amazon and concluded you love buying vacuum cleaners so here’s some more.
>During our analysis of the Controlium platform, we observed that the source code mentioned an endpoint called “/csv-download”, which accepted start and end date parameters. When we sent normal HTTP GET requests to this endpoint without any password, special headers, or authentication token, we received logs showing which users had logged in to Controlium, and from which IP addresses.
So reading the article, it feels a bit confusing what zero click exploit they are talking about. It sounds like they are talking about CVE-2021-21166, but if they really are talking about an exploit from 5 years ago, i feel like their intro paragraph is rather misleading.
Ads providers should be held responsible for delivering malware. All the tracking (that includes fingerprinting for clients that do not want to be tracked) should also be illegal.
How is this acceptable for society goes beyond me. And then corporations blame individuals when they get scammed. It is your fault that we have all your information and leak it everywhere, when it is not just directly sold.
And add jail time to fines. Fines means nothing for the rich.
I think it would be nice for them to be held accountable but I get the feeling this is part of a wider nation state intelligence apparatus and I doubt that they will hold themselves accountable.
nah, you'll never get there that way. Even if there was willpower to do it legislating these things is too hard.
What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).
If they win the landscape will change. It would set a precedent for civil liability for infecting your users even when it's not your content directly. That would likely spook the shit out of the market, security becomes a feature.
> And add jail time to fines. Fines means nothing for the rich.
This, pretty much. Money removes consequence form your actions. If every time you screwed up, instead of being fined you had to wear a silly hat, go on TV and apologize, or get some time behind bars, even if it were 1 or 2 days it would be very effective.
So you search for company A wanting to buy their product. You check out. Basically every setup I've audited has every tracking product ever for everything.
So you buy X, and the company sends that purchase event with your information to Meta, Google, TikTok, Applovin, Klaviyo, and 10 others.
This idea is hopelessly entrenched in every marketing department, who has leadership's ear: We HAVE to send EVERYTHING to EVERYONE otherwise our ROAS will go DOWN!
Every platform works this way, they're all set up to put giant red banners on your marketer's dashboards
"You could be getting 50% better results if you sent <customer_2nd_grade_report_card>!"
This is not the problem. You visiting any website can lead to your computer running the same code.
The main problem is that the exploits from js to code execution or data exfil are possible in the first place. The issue is that you have JS, which is generally pretty isolated, able to talk to bundled libraries (like libwebrtc), which often contain the exploits and share the same memory space. There needs to be a intermediate layer between JS talking to any such library, like process isolation with IPC for communication.
There is a tinfoil narrative that suggest that entire formats are in bed with intelligence services. It sounds pretty wild, but other zero-click attack vectors have been possible through sabotaging the parsing of file formats. ie. send a message -> hacked. How? the message wasnt even opened. How is, an app like Messenger receives a photo attachment binary, tries to unpack it and in doing so receives an instruction that stops the parser and executes arbitrary instructions.
They use ad network to try to target individual user visiting a page (eg you know your target is a male, 60 years old, living in that area, with a few other checks you can almost uniquely identify your target)
Then the ad network delivers a targeted ad that exploits a vulnerability (eg a broken JPEG decoder that, when sent a bad image, allows to run arbitrary code on your machine), and from there you have access to the computer
It’s to do with hiding malware/spyware in an image which ends up in your cache on device. I can’t go much further into details but all this takes is for you to visit a site that serves it via ad network.
Israel has been known to have some sneaky spyware in the past with Pegasus.
How the ad-based spyware actually worked (from the Citizen Lab and Confiant reports):
- It came in through the front door. Discover-Tech ran its own ad-buying platform and was listed as a "certified" vendor by Google and IAB Europe for six years. Nothing was hacked to get in. It bid in ad auctions like any other buyer.
- The ads looked harmless. Plain banners for games, AliExpress deals and an IP-lookup site. Hidden inside each one was a small script that quietly phoned home when the ad loaded.
- Everyone who saw an ad was profiled. The script collected device details, IP addresses and, on many sites, the publisher's own cookies, sometimes including logged-in session tokens. Cookie-syncing with other ad networks built a huge identity graph.
- Only chosen targets got the payload. A gatekeeper server checked each device's ad ID and IP. Most people got nothing back. A selected target got code that handed them off to spyware maker Candiru, and the code was served only once, which made it very hard for researchers to capture.
- The handoff was built to defeat inspection. Encrypted channels, rotating hosting, anti-bot checks and even a fake "Copyright Google" comment to fool human reviewers.
- It worked. At least 45 devices at Al Jazeera were targeted, and spyware was recovered from an infected machine. Its ads also appeared on networks belonging to NATO, the UN, the European Parliament, the ICC and various defence ministries.
- The scale was huge. Billions of bids and ads in nearly 200,000 apps and websites, including Duolingo, Viber, Yahoo Mail, dating apps and period trackers, yet almost no sign of real advertisers or revenue.
Awful lot of words here, but not much explanation of the actual capabilities of the "zero-click spyware". Tacking on the phrase "zero-click" suggests some kind of browser exploit, but it seems like this is just the same sort of thing as tracking cookies, third-party telemetry etc.
and they’re just as troublesome as they were before,
to the degree they’re provably being used to decide who to send malicious payloads to…
Zero-click simply highlights if the user needs to actively interact with an element to get a malicious payload - or not.
This did get me interested in the specifics of the payload, though:
“It maintains persistence via COM hijacking by overwriting a legitimate COM class registry key’s DLL path with a first-stage DLL dropped in C:\Windows\system32\IME\, and it stores encrypted second-stage payloads in the configuration directory. A signed third-party driver (physmem.sys) enables kernel-level memory access and API call proxying to avoid detection. To preserve system stability, DevilsTongue reinjects the original COM DLL during hijacking, disguising this action through shellcode manipulation of the LoadLibraryExW return value. All additional payloads are decrypted and executed only in memory, allowing the malware to steal credentials from LSASS and browsers, access Signal messages, and use browser cookies to impersonate victims on platforms like Facebook, Gmail, and VK. The malware’s use of scrubbed metadata, encryption, and unique hashes for each file further complicates detection and analysis.”
People have disliked ads since ads existed. Carl Sagan's 1985 book Contact includes a brazillionaire S.R. Hadden who made his fortune by inventing an adblocker for television. https://en.wikipedia.org/wiki/Contact_(novel)
The FBI has previously recommended running adblockers as a method to prevent malware and especially scamming. Nobody cares much.
It’s a low-hanging fruit that has high value, particularly for less savvy internet users. Scams have always been the biggest threat. I’d say the majority of internet ads are scams, and the platforms often don’t make it clear what is or is not an ad.
But, we always knew the risk of malware was there. In the modern age, ads are basically never delivered as static assets. They’re delivered as small applications, with code. So, we’re relying on our sandboxing mechanics to work perfectly, and predictably they don’t. The solution is to block the code altogether; to block ads.
If only! I think we can no longer afford to ignore all these security threats and should make online advertising wholesale illegal. But I won't hold my breath.
It seems to be app-based. So DNS blocking could work; it's easily circumvented by the platforms, but it's rarely circumvented. like mobile games with those ads.
You should threat model, but if you want to maximally protect yourself, use Vanadium or Brave Browser and GrapheneOS and no privacy invasive apps.
How paranoid should one be of, say for example, a wasm vulnerability exploited on zero day by a bad JS ad?
I am scared for my parents to get exposed to this kind of thing from bad ad network actors. Does anyone have some practical concrete recommendations they took? Like I don't think they can install ublock origin and whitelist sites on demand in Firefox they way I do.
The only practical thing right now is to make sure they don't have the money on device and have 2 fac for email and bank accounts. But every now and then there are phishing attamepts that they could fall prey to.
Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle...
I wonder how we're going to unwind this mess in the upcoming years. It seems as if there was a concerted effort to plan this all out before Trump got elected, and then everything fell into place. They obviously have a post Trump plan ready to go. I partially blame the left(really the moderates) in the U.S. For being so unbelievably complacent that it led us to this mess. I just wonder how we're going to unwind this. Nothing lasts forever, but the transition in between states always tends to be disrupting.
This was my first question as well. There’s a big gap between “ad network delivers JS” and a zero-click browser exploit. CitizenLab has done some great research including OSINT on the former, but there’s a conspicuous gap between it and the DLL ending up on the victim’s machine.
The article contains no information on which browsers are impacted, what exploit is being used, if it has been patched, etc? Does anyone know more about how this ad network is exploiting browsers to install spyware on the users machine?
Incredible that they don't clearly say what the exploit is and what OS/hardware/apps is/are vulnerable. Still, quite a lot of interesting info about the modern ad delivery networks sewer system...
I would be interested in knowing which devices were (or still are) vulnerable to these zero click exploits. And how those exploits (used to) work, specifically.
I doubt it's that easy to click on a link and install malware without the user knowing. Most browsers are highly secure and finding a zero day isn't that easy these days because both sides use A.I. to find vulnerabilities and to secure against them.
It’s not “easy”, it requires a complex infrastructure of exploit devs (who can sell their findings for millions in some cases) and the companies who package these exploits together with implants and sell them.
One side uses AI to find them. The other side probably needs to keep the holes open for NSA, as the multiple 0 click root exploits that happened in the past to the iPhone with very similar techniques suggest.
> Reuters has reported that billions of dollars’ worth of Meta’s ad revenue comes from ads for scams, illegal gambling, pornography and other banned content. In the US, ICE and other government agencies have bought software that uses ad tech data to track people’s movements.
I don't know if an ad blocker protects against Discover-Tech’s Controlium but in general you'd be a fool to allow ads in your browser in at this point. The ad industry is pretty shady all round.
Once again proving that ads are an unacceptable security threat. All those sites now deploying ad-blocker blockers should assume liability for whatever ad software they force their readers to run.
Apps should be required to disclose every single ad network they use as part of their app store disclosures. I want a lot more transparency as to where the ads are coming from inside the app itself.
I've witnessed consumer apps throwing quite heinous malware/sketchware advertisements and watched the banners rotate between 4-5 different ad vendors to keep things hot and spicy.
The incentives are lopsided, there’s so much money to be made by selling access to you and your devices, and controlling you, than just taking your money.
All ads should have to appear in an <advertisement> node, and users should have the option of disabling javascript within an advertisement. Make it the fucking law.
Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle...
The CTO happens to have worked for Radware
> Related work by the research group Confiant also suggests that Discover-Tech’s ads have been shown to users of the networks of government entities in Europe and the US, as well as the UN, Nato, the international criminal court and the International Atomic Energy Agency.
Yet we don't sanction Israel nor hold them accountable in any way. Of course they're spying on members of the UN and ICC, of course. Israel is at war with the entire world right now, and my politicians continue to support them. Thankfully many people have woken up, but the situation is dire.
Based on responses from roughly 46,700 people assessing 129 countries, Israel ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
That conflates the state with a business headquartered in it. It begs the question of what the sanctions would be for: is the argument that this firm is an arm of Israel, that Israel turns a blind eye to abusive businesses, or something else?
My Democratic Rep (who is a Zionist) voted with the Republican Party to financially sanction and impose visa restrictions on members of the International Criminal Court for issuing an arrest warrant for Netanyahu, so the ICC could hold Netanyahu for trial.
I will never vote for this particular (D) candidate again. Fortunately, the (L) candidate seems reasonable.
If indeed your representatives support Israel or the genocide in Gaza, I urge you to consider voting 3rd party. In two-party elections, candidates mostly just try to be a little better than their opponent. What forces them to do more isn’t a third party actually winning. It’s a real risk that enough fed-up voters will go third-party and cost them the election. This is basic game theory optimization.
Hacker News sure loves to single out one specific country and blanket label. I remember when comments like those in this thread directed against Russia after the Ukraine war heated up were shut down by Dang. But blanket generalizations against Israel?
Why would anyone trust any Israeli cybersecurity firm at this point? Any website or service knowingly utilizing their services is a huge risk. They're already deeply embedded in federal and local governments so there is a strong sense of doom.
Probably happens with Russia, US, etc as well, but the "hasbara" campaigns through the years have the effect of making people assume the mossad is all powerful etc etc. You inspire fear on your enemies, but also your friends.
edit: and I have been hasbar'd now for simply stating the fact that making people fear you instead of love you has consequences. oh well.
Oh darn, maybe we should just ban the entire online advertising industry. Gosh, what value we'd lose if we couldn't have our personalized attention destroying glitter boxes.
My opinion on web infra patronage has shifted over time, I used to generally accept that for small websites to exist advertising was a necessary evil since they were too niche to have a real revenue source. Then I ran one and I realized that there's far more labor costs involved in maintaining a site than infra costs and that for niche hobbies and communities ten bucks can just find its way into a central pot every month to keep the lights on by those with a bit more to spare.
I am now of the opinion that web communities can survive in the same way arts and other liberal pursuits have always survived. People with a bit more to spare put more into the pot to create the community they want to exist in and "freeloaders" is an alien concept to the genuinely interested since that money is being spent to create a place where meeting can take place without a financial requirement.
>I am now of the opinion that web communities can survive in the same way arts and other liberal pursuits have always survived.
And the only 'users' of these websites will be rich people? Because the moment a paywall goes up on a website it becomes unusable for a large portion of the planet.
AdTech engineer here (some 13 years in the industry). A couple of notes:
- The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.
- To the point below that "ad providers should be held responsible." There is no such thing as "ad provider." The AdTech ecosystem is teeming with different niches and business models - see the famous LUMAscapes diagrams: https://lumapartners.com/lumascapes/ . The sheer volume of traffic makes it virtually impossible to vet even a fraction of it. Google has thrown a lot of compute power to pre-scan 3p creatives and even then bad actors can sneak through. Add to this a lot of sophistication on their side (from different landing pages based on the perception of the type of user to farming throw-away advertiser accounts aimed at running just one campaign like that to hijacking legit accounts through sophisticated technical and people engineering means). In the end, politicians full of indignation do what politicians always do - sue or fine Google and call it a victory, whereas the true bad actors just keep going.
Prior to online ads, that is ads that existed on TV, print media, etc, ads were properly vetted. Very few outright scams made it through.
So, it’s definitely possible, especially with human review and static ads. No code. It might not be possible at scale. To me, that’s just not an excuse. If you can’t do something safely at scale, then you shouldn’t. If that means generalized online ads can’t exist then… so be it.
Online ads are definitely still possible. For example, im sure Disney reviews and approves all ads that run on Disney plus. So just do that, and if you can’t do that for e.g. YouTube then dont.
> There is no such thing as "ad provider."
If a website serves me malware, the website's owner should be liable to me. They may then be able to sue someone else, in turn. But I chose to interact with them and then they chose to outsource stuff to crooks.
This would be complicated to implement. But it's absolutely doable.
> AdTech engineer here (some 13 years in the industry).
How do you even plan to explain it to your grand-children?
Not to jump on you after everyone else did (although I agree with them), but they didn't give you a solution. The solution is unfortunately for everyone a robust KYC regime. Then the linkages stop being impossible to track and instead become merely burdensome.
> virtually impossible to vet even a fraction of it
It’s a choice, and on the other side of that choice is profit.
I also have a choice. I choose to filter out as many ads I can. That is my vetting process.
Your appeal to authority as an "AdTech Engineer" works against you when support your own industry. You have a conflict of interest. Of course you will try to do damage control and PR.
This was my main question as well. I read the report, but I'm still not clear on what the browser vulnerability is. This clearly seems like something browser vendors should be able to patch, correct?
The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited. The step-by-step info graphic in the article literally skips over how the infection actually occurs.
>The sheer volume of traffic makes it virtually impossible to vet even a fraction of it
No, it doesn't. Your company is too much of a cheap fuck to do it and would rather offload that cost on society, no matter how bad the effects of it is.
>There is no such thing as "ad provider."
Only when it's to your advantage, because you're very happy to refer to yourself as an ad provider in every single marketing piece.
>AdTech engineer here (some 13 years in the industry)
You've made the world miserable for the past 13 years and have the gall to come over and pretend you're a poor innocent little thing who can't do nothing UwU there's just too much how could we be held responsible.
Obviously not the first time an Israeli tech firm is responsible for these types of exploits, and at this point I'd go so far as saying that any Israeli-based tech company (especially cyber security ones, of which they have a strong industry) should be considered beholden to the government of Israel and hence, probably not trustworthy. How could you be sure whether they will act like a trustworthy independent entity, or compromise your data for the benefit of the state?
I would sooner trust a Chinese company than an Israeli company. Is there any country less trustworthy and more hostile to users?
> should be considered beholden to the government of Israel
Do we have evidence this is a state operation versus a criminal group?
Many, many, many Fortune 500 companies use Israeli cybersecurity services.
I guess that your concerns are not aligned with reality, or the benefits far outweigh whatever it is you think may happen.
(Talking as an Israeli working in cybersecurity)
Actual report from Citizen Lab:
* https://citizenlab.ca/research/how-discover-tech-turned-targ...
OK, I read the report, but I'm still not clear on what the browser vulnerability is. This clearly seems like something browser vendors should be able to patch, correct?
The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited.
My question is, why is Israel so good at this? It seems to be at least the 4th cyber power of the world, after the US, Russia and China, if not actually on par or better.
I guess it is because it has been under the threat of larger enemies from its birth, so it must leverage whatever it has to survive. And once you grow an organization and let it loose, you don't have much control over it anymore, and it grows in the wild like a flower.
Don't forget the compounding effect. Say, one country (or city or community) decides to invest their efforts into area X (e.g. clock making in Switzerland). They do it and become better and better. As long as they keep doing that they can become #1 in the world. Regardless of any reasons "why them".
There's no reason Netherlands are better at chip lithography except that they're doing it (Dutch agriculture success can be attributed to good soils/climate/geolocation, but not chips). There's no reason Hollywood is better at filmmaking. Kinda chaos theory -- small changes to initial state leads to huge changes in the later outcomes.
Back when I was a tech journalist, back in the 90s I visited Israel once and interviewed a number of their tech companies - admittedly most in the cyber-security space.
They ascribed a lot of the tech innovation to conscription - lots of the founders had learned a lot while in technical posts in the army and put that to use when they left.
Multiple reasons. America gives Israel special protection for everything they do, Ashkenazi and general Jewish culture values education more than anyone outside of East Asia, and a lot of Soviet Jewish scientists had to work for the military so they came to Israel with cryptography or spy tech experience.
> why is Israel so good at this?
Unit 8200 [1]. Also, Israel doesn't extradite its own citizens and seems to turn a blind eye to criminals doing nonsense abroad. (Similar to Russia and China.)
[1] https://en.wikipedia.org/wiki/Unit_8200
A few potential possibilities that may or may not be popular here.
- Compulsory military service means the government captures the best and brightest of the country.
- An extraordinarily outsized number of nobel prizes belong to Ashkenazi Jews, and other indicators of intelligence (lack of propensity for violent crime, lifetime earnings, etc) are also quite high for the whole group.
Country that prizes education and is constantly under threat. Plus, most folks do serious time in the army and only after that do they go to college.
It’s an interesting question. I would also guess that this kind of behaviour would be illegal for private companies in many countries even if you don’t do it domestically.
> it has been under the threat of larger enemies
It has always been at odds with its neighbors and has persecuted its occupied people, for far too long. It has further facilitated other tyrant governments in the control of their people. The cyberwarfare industry in Israel is directly part of the controlled Defense Industry.
It is not under threat. It has sought to be a formidable threat to everyone.
We have had viruses leaked by other countries in the past, with US and Germany coming to mind. If I remember right it was around 2005-2010 when democratic nations officially started to state that they had a right to use malware against criminals and military targets, and from that on it has just kept going. As I recall, Bruce Schneier and FSF made a bit of articles and talks where they tried to get people to understand that once democratic nations starts to use malware offensively they also generally stop protecting their citizens from those security holes.
That we don't hear about it more often seems to me that nations that develop this stuff seem to have gotten better in making malware more precise in what they target and less leaky to the general population, but it could also be that media just don't report about it as much. When a gangs anonymous chat get hacked, or a tor hidden service website get taken down, news seems more interested in talking about the crime than what security vulnerability that the police used.
And also it has help, it is unlikely it acts alone. Example Stuxnet. Israel has the talent so they are a convenient and willing proxy too for getting shady shit done.
To a certain extent, i think its because Israel benefits from being seen as "scary" so there isn't as much pressure to keep this sort of thing on the down low, where in any other countries there is more pressure to keep grey-area stuff like this secret to prevent blowback.
Putting it amongst that cohort and suggesting it's a flower is definitely one reading I guess.
Given the number of enemies Israel has, it has to be prudent and explore every opportunity it has. One strategic mistake could be fatal.
Integrated selection pipeline spanning 15 years from age 4 up until age 18.
Because Apple, Intel and Samsung have huge engineering labs there and employ IDF & intelligence people to work in those corporation’s labs. It means they have very detailed knowledge of their products as they have all internal documents and also design software & hardware.
That is why both Apple & Samsung have malware from Israel on their phones. The USA has the NSA building and exploiting products for surveillance and penetration globally.
Netanyahu recently was on a US broadcast, he held up a phone and stated to the reporter interviewing him, that Israel can penetrate any device obtaining it contents and then blackmail or discredit the owner of said device.
The USA now examines phones at airports to see if people are saying things the current administration doesn’t like.
You conclude that they’re good at it because they keep getting caught? Fascinating.
Because it's the only country allowed get away with stuff that would be an international scandal if a normal country did it.
They get away with genocide, it's no wonder that they can get away with this.
“Threat of larger enemies” yeah that’s the direction the threat goes.
This, plus all jewish folks I've ever met are naturally smart (not genetically of course, more like societal pressures/expectations/upbringing), hard working like few others, and seem to genuinely veer towards numerical jobs - banking and finance, math, applied math like security, cryptography, trading and so on. Very similar to Iranians to be fair, if US and British MI6 wouldnt be meddling in Iranian internal politics and supporting corrupt shah to steal all the oil cheaply those 2 would be together a superpower on global scale. Israel was very very lucky to not have any oil on their territories.
Plus very much present in US politics and power circles for some reason.
2 examples out of many - my boss is a prime example, every thought somehow infused with money (I work in a bank). My ex gf was exactly the same (she is a successful commodity trader). Just very, very different mindset to the core to say typical european one (I mention folks who are europeans and I've never been to Israel, so extrapolating a bit here).
The US, to its eternal shame, guarantees their security.
Israel is not particularly skillful: they're a little bully getting in some punches while a big bully holds back the rescuers. Ooh, tough guy!
> has been under the threat of larger enemies from its birth
As everybody else in the planet. Israel is not special in that sense.
"threat of larger enemies from its birth"?
Israel is the one occupying and bullying its neighbors, spying on its "allies", doing air-strikes on neutral countries, attacking US research ships, and performing piracy and kidnapping in international waters.
It's the spy agencies you hear nothing of you should worry about.
It is standard that companies within a country act in the interests of its security services. Israel has a lot of ad-tech companies and thus it makes sense that they are roped into serving Israel's security services.
It is no different that Israel's location tracking of StarLink terminals worldwide: https://www.newarab.com/news/israel-tech-firms-can-locate-an...
This is the same issue that the US government has with Chinese networking companies, it is too easy for the Chinese government to pressure these Chinese networking companies to put in back doors in the interests of national security. The US likely knows this because it pressures its own companies in similar ways.
Difference being we're pretending that Israel is a democracy that values human rights, so nobody makes a real stink about it, unlike with China.
Bills like the US CLOUD Act (there are similar ones in the EU and China) force service providers to illegally spy on people overseas (via unauthorized use of anything they can access—consider Microsoft’s Windows backdoors).
I think the only technical solution available to individuals is to boycott non-verifiably e2ee services and corporate operating systems (especially including android).
Except this isn't the security services they are serving it's a mercenary spyware vendor.
This is abhorrent. Every government spying on everyone.. and who benefits from all of this?
Can we get an alien invasion already please, god
Israel has been a nexus of cybercrime for as long as they've been on the internet at all.
https://en.wikipedia.org/wiki/Download_Valley
Why do some of the most evil tech companies, especially ones that use exploits and zero-days as part of their business model, disproportionately originate from the same small (population-wise) country? The company from the article, all the other examples everyone here lists, Candiru, NSO... All Israeli.
It was so successful that IronSource, one of those companies, ended up merging with Unity and I think they got like 25% of the company: https://en.wikipedia.org/wiki/IronSource
That explains a lot. You're basically just fishing for downloads in your target networks. You don't actually care if anyone clicks the ads in the installers, the sole purpose of the adware is to get arbitrary software running alongside the installer, so that you can compromise their machine.
There's a reason for that. Israel is a test bed to remove freedoms world-wide through digital surveillance.
They've also been a nexus of cyber security: Palo Alto Networks, Checkpoint, Wiz, etc are all Israeli companies.
That country has long been known as a haven for American pedophiles/criminals who end up fleeing the country.
Guess where the company big AI labs are using for security sandbox is from? The one that was involved in both big hacking scandals from "rogue agents" by OpenAI and Anthropic?
Also affordable generic drugs. YMMV.
Y'all will be shocked at how much of the VPN space is owned/controlled by Israel.
https://share.gemini.google/DbWctQhiJXMh
Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.
Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Totally not useless. It costs a lot more to pay a spyware firm then to have an employee send an email / ask a judge (like that's even necessary).
I feel quite confident of my messages privacy on my Pixel with GrapheneOS given most people I message are on iPhones which are second in security to Pixels running GrapheneOS. Not to mention my threat model doesn't include mercenary spyware, as most people's doesn't.
>Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.
If you're talking about the sideloading restrictions those were intended to stop social engineering and scams, not from getting hacked via 0days.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Source? play services is privileged but not that privileged.
> useless as a way to prevent people from being hacked
From being hacked by others. Google was just trying to protect their property, which is the ability to spy on their users' every move. Google themselves really don't need to "hack" their users for that, they already have all the access and all the data they could ever want. And they also have the ability to brick their users' devices at a moment's notice the same as Apple does.
However, this hack could have happened whether sideloading was allowed or not.
In fact, following the OP's link to https://citizenlab.ca/research/how-discover-tech-turned-targ..., "the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries" so it's not just apps but ordinary websites you visit in your android chrome browser.
I'm sure Google's latest push to make it inconvenient to install apps from outside Google's Playstore, where Google charges a 30% commission, is going to solve that.
Is GrapheneOS affected?
It's really sad this got taken off the front page (347 points, posted 2 hours ago at the time of this comment). Israel is deeply intertwined with the tech industry and they use tech extensively in extremely hostile ways. It's relevant to this site discussion and the votes demonstrate that. There's no reason to hide the elephant in the room, let's address it, now is the time.
This is even crazier than the last time Citizen Lab found an Israeli zero-click spyware (Pegasus). You could call it a sequel
Don't call it a comeback, I been here for years Rocking my peers and putting suckas in fear
As much as it sucks for the ecosystem that's built itself up around the world wide web, good ad blockers and fingerprinting protection are as important as firewalls and antiviruses now. There's no more babies in this fetid bathwater.
Targets could have been identified using pretty basic advertising and marketing techniques. Bid requests broadcast IP, device details, and ad IDs to every bidder. Intersecting topic audiences across a few months of Al Jazeera stories could narrow that audience to a few individuals. The ad ecosystem already does set-intersection de-anonymization to identify interests and profile customers.
https://404privacy.com/blog/how-israel-used-ad-auctions-to-d...
"Researchers also recommend that users at high risk of targeting use ad blockers, disable ad tracking, and regularly reset mobile ad IDs.". Not "recommend". Everyone must use uBlock Origin or at least some type of ad blocker in every device.
Then also mandatory pi-hole on every house.
Even if you are used by Windows OS, you must use an adblocker. Even if you use Chrome. On every browser.
Yes. Browsing without an adblocker is analogous to driving without a seatbelt. Sure, you can do it - but it's a terribly unsafe idea.
It's kinda funny that a website with an article titled "Online ads weaponised to deliver ‘zero-click’ spyware" immediately loads a splash that asks users with adblock installed to disable it.
The separation between advertising and editorial has never been greater. Brought to you by the marketing wizards who saw you bought a vacuum cleaner on Amazon and concluded you love buying vacuum cleaners so here’s some more.
The site works much better with JS disabled.
>During our analysis of the Controlium platform, we observed that the source code mentioned an endpoint called “/csv-download”, which accepted start and end date parameters. When we sent normal HTTP GET requests to this endpoint without any password, special headers, or authentication token, we received logs showing which users had logged in to Controlium, and from which IP addresses.
Absolute morons.
So reading the article, it feels a bit confusing what zero click exploit they are talking about. It sounds like they are talking about CVE-2021-21166, but if they really are talking about an exploit from 5 years ago, i feel like their intro paragraph is rather misleading.
Ads providers should be held responsible for delivering malware. All the tracking (that includes fingerprinting for clients that do not want to be tracked) should also be illegal.
How is this acceptable for society goes beyond me. And then corporations blame individuals when they get scammed. It is your fault that we have all your information and leak it everywhere, when it is not just directly sold.
And add jail time to fines. Fines means nothing for the rich.
I think it would be nice for them to be held accountable but I get the feeling this is part of a wider nation state intelligence apparatus and I doubt that they will hold themselves accountable.
nah, you'll never get there that way. Even if there was willpower to do it legislating these things is too hard.
What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).
If they win the landscape will change. It would set a precedent for civil liability for infecting your users even when it's not your content directly. That would likely spook the shit out of the market, security becomes a feature.
It seems like ads already violate the law via whatever that "unauthorized usage" law is that the government likes to throw around.
Too bad no one has the guts to enforce the law that way.
That would mean some google people going to jail...
All ads are malware.
> And add jail time to fines. Fines means nothing for the rich.
This, pretty much. Money removes consequence form your actions. If every time you screwed up, instead of being fined you had to wear a silly hat, go on TV and apologize, or get some time behind bars, even if it were 1 or 2 days it would be very effective.
The default setups are also _crazy_.
So you search for company A wanting to buy their product. You check out. Basically every setup I've audited has every tracking product ever for everything.
So you buy X, and the company sends that purchase event with your information to Meta, Google, TikTok, Applovin, Klaviyo, and 10 others.
This idea is hopelessly entrenched in every marketing department, who has leadership's ear: We HAVE to send EVERYTHING to EVERYONE otherwise our ROAS will go DOWN!
Every platform works this way, they're all set up to put giant red banners on your marketer's dashboards
"You could be getting 50% better results if you sent <customer_2nd_grade_report_card>!"
We should make targeted advertising illegal, full stop. This would remove so many perverse incentives in the system.
This is not the problem. You visiting any website can lead to your computer running the same code.
The main problem is that the exploits from js to code execution or data exfil are possible in the first place. The issue is that you have JS, which is generally pretty isolated, able to talk to bundled libraries (like libwebrtc), which often contain the exploits and share the same memory space. There needs to be a intermediate layer between JS talking to any such library, like process isolation with IPC for communication.
I'm not sure you understand what you're asking for, or if you do you have not followed the results of this to its conclusion
> How is this acceptable for society goes beyond me.
Easy, when your society glorifies and deifies greed, you can excuse literally any act so long as it makes enough money.
That's it. That's the entire explanation. It's capitalism and greed.
If you work for an ad tech firm you are one of the baddies.
How does this actually work? Are they talking about browser fingerprinting or something else?
Looks like it's much worse, they get more information due to exploits, and they can take full control of your machine.
Article on the CitizenLab website: https://citizenlab.ca/research/how-discover-tech-turned-targ...
There is a tinfoil narrative that suggest that entire formats are in bed with intelligence services. It sounds pretty wild, but other zero-click attack vectors have been possible through sabotaging the parsing of file formats. ie. send a message -> hacked. How? the message wasnt even opened. How is, an app like Messenger receives a photo attachment binary, tries to unpack it and in doing so receives an instruction that stops the parser and executes arbitrary instructions.
Here is a better article https://citizenlab.ca/research/how-discover-tech-turned-targ...
https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zer...
https://citizenlab.ca/research/how-discover-tech-turned-targ...
They use ad network to try to target individual user visiting a page (eg you know your target is a male, 60 years old, living in that area, with a few other checks you can almost uniquely identify your target)
Then the ad network delivers a targeted ad that exploits a vulnerability (eg a broken JPEG decoder that, when sent a bad image, allows to run arbitrary code on your machine), and from there you have access to the computer
If I had to ponder a guess…
It’s to do with hiding malware/spyware in an image which ends up in your cache on device. I can’t go much further into details but all this takes is for you to visit a site that serves it via ad network.
Israel has been known to have some sneaky spyware in the past with Pegasus.
How the ad-based spyware actually worked (from the Citizen Lab and Confiant reports):
- It came in through the front door. Discover-Tech ran its own ad-buying platform and was listed as a "certified" vendor by Google and IAB Europe for six years. Nothing was hacked to get in. It bid in ad auctions like any other buyer.
- The ads looked harmless. Plain banners for games, AliExpress deals and an IP-lookup site. Hidden inside each one was a small script that quietly phoned home when the ad loaded.
- Everyone who saw an ad was profiled. The script collected device details, IP addresses and, on many sites, the publisher's own cookies, sometimes including logged-in session tokens. Cookie-syncing with other ad networks built a huge identity graph.
- Only chosen targets got the payload. A gatekeeper server checked each device's ad ID and IP. Most people got nothing back. A selected target got code that handed them off to spyware maker Candiru, and the code was served only once, which made it very hard for researchers to capture.
- The handoff was built to defeat inspection. Encrypted channels, rotating hosting, anti-bot checks and even a fake "Copyright Google" comment to fool human reviewers.
- It worked. At least 45 devices at Al Jazeera were targeted, and spyware was recovered from an infected machine. Its ads also appeared on networks belonging to NATO, the UN, the European Parliament, the ICC and various defence ministries.
- The scale was huge. Billions of bids and ads in nearly 200,000 apps and websites, including Duolingo, Viber, Yahoo Mail, dating apps and period trackers, yet almost no sign of real advertisers or revenue.
Citizen Lab: https://citizenlab.ca/research/how-discover-tech-turned-targ...
Confiant: https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zer...
Citizen Lab also has a shorter executive summary: https://citizenlab.ca/research/exposing-adfection-executive-...
Awful lot of words here, but not much explanation of the actual capabilities of the "zero-click spyware". Tacking on the phrase "zero-click" suggests some kind of browser exploit, but it seems like this is just the same sort of thing as tracking cookies, third-party telemetry etc.
No, they’re using those same techniques,
and they’re just as troublesome as they were before,
to the degree they’re provably being used to decide who to send malicious payloads to…
Zero-click simply highlights if the user needs to actively interact with an element to get a malicious payload - or not.
This did get me interested in the specifics of the payload, though:
“It maintains persistence via COM hijacking by overwriting a legitimate COM class registry key’s DLL path with a first-stage DLL dropped in C:\Windows\system32\IME\, and it stores encrypted second-stage payloads in the configuration directory. A signed third-party driver (physmem.sys) enables kernel-level memory access and API call proxying to avoid detection. To preserve system stability, DevilsTongue reinjects the original COM DLL during hijacking, disguising this action through shellcode manipulation of the LoadLibraryExW return value. All additional payloads are decrypted and executed only in memory, allowing the malware to steal credentials from LSASS and browsers, access Signal messages, and use browser cookies to impersonate victims on platforms like Facebook, Gmail, and VK. The malware’s use of scrubbed metadata, encryption, and unique hashes for each file further complicates detection and analysis.”
from https://www.recordedfuture.com/research/tracking-candirus-de...
Keep reading:
https://citizenlab.ca/research/how-discover-tech-turned-targ...
Looking at the bright side, we might just be able to make people really dislike ads.
People have disliked ads since ads existed. Carl Sagan's 1985 book Contact includes a brazillionaire S.R. Hadden who made his fortune by inventing an adblocker for television. https://en.wikipedia.org/wiki/Contact_(novel)
For those who haven't learned their lesson yet, I doubt anything could move the needle.
The FBI has previously recommended running adblockers as a method to prevent malware and especially scamming. Nobody cares much.
It’s a low-hanging fruit that has high value, particularly for less savvy internet users. Scams have always been the biggest threat. I’d say the majority of internet ads are scams, and the platforms often don’t make it clear what is or is not an ad.
But, we always knew the risk of malware was there. In the modern age, ads are basically never delivered as static assets. They’re delivered as small applications, with code. So, we’re relying on our sandboxing mechanics to work perfectly, and predictably they don’t. The solution is to block the code altogether; to block ads.
It's fun to see adtech digging a hole for themselves ...
If only! I think we can no longer afford to ignore all these security threats and should make online advertising wholesale illegal. But I won't hold my breath.
archived, no ads or trackers: https://nonograph.com/online-ads-weaponised-to-deliver-zero-...
Would installing ad-blocker software give me any protection from this stuff?
It seems to be app-based. So DNS blocking could work; it's easily circumvented by the platforms, but it's rarely circumvented. like mobile games with those ads.
You should threat model, but if you want to maximally protect yourself, use Vanadium or Brave Browser and GrapheneOS and no privacy invasive apps.
https://www.privacyguides.org/en/basics/threat-modeling/
How paranoid should one be of, say for example, a wasm vulnerability exploited on zero day by a bad JS ad?
I am scared for my parents to get exposed to this kind of thing from bad ad network actors. Does anyone have some practical concrete recommendations they took? Like I don't think they can install ublock origin and whitelist sites on demand in Firefox they way I do.
The only practical thing right now is to make sure they don't have the money on device and have 2 fac for email and bank accounts. But every now and then there are phishing attamepts that they could fall prey to.
Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle...
The CTO happens to have worked for Radware
https://radware.com/
https://www.innovid.com/about-us/news/mediaocean-completes-a...
I wonder how we're going to unwind this mess in the upcoming years. It seems as if there was a concerted effort to plan this all out before Trump got elected, and then everything fell into place. They obviously have a post Trump plan ready to go. I partially blame the left(really the moderates) in the U.S. For being so unbelievably complacent that it led us to this mess. I just wonder how we're going to unwind this. Nothing lasts forever, but the transition in between states always tends to be disrupting.
I’m a little confused how mobile ad targeting ends up as a DLL hijack?
This was my first question as well. There’s a big gap between “ad network delivers JS” and a zero-click browser exploit. CitizenLab has done some great research including OSINT on the former, but there’s a conspicuous gap between it and the DLL ending up on the victim’s machine.
There are mentions of CVEs in that article with Chrome exploits.
mobile ads can deliver JS-based exploits
The article contains no information on which browsers are impacted, what exploit is being used, if it has been patched, etc? Does anyone know more about how this ad network is exploiting browsers to install spyware on the users machine?
Incredible that they don't clearly say what the exploit is and what OS/hardware/apps is/are vulnerable. Still, quite a lot of interesting info about the modern ad delivery networks sewer system...
You have to go about 5 pages deep on any search, anywhere, before you find something positive about "israel"
Seems like a second-order effect to me, and this report is a good example
they do have a really big and well stocked skin bank! Its positive as long as you don't start asking where it came from :P
Committing a genocide does typically reduce one's cachet.
I would be interested in knowing which devices were (or still are) vulnerable to these zero click exploits. And how those exploits (used to) work, specifically.
Very strong reason for everyone to install ad-blockers on all of their devices.
Of course, who else could it be.
The fact one of the spyware cos was named after the fish that swims up your dick hole is too funny
uBlock Origin ftw
Plus a dns based blocker for other apps. Android has an option ready for that, iPhone it will be like VPN.
And wBlock on Safari.
I doubt it's that easy to click on a link and install malware without the user knowing. Most browsers are highly secure and finding a zero day isn't that easy these days because both sides use A.I. to find vulnerabilities and to secure against them.
It’s not “easy”, it requires a complex infrastructure of exploit devs (who can sell their findings for millions in some cases) and the companies who package these exploits together with implants and sell them.
https://www.packetlabs.net/posts/demystifying-the-market-for...
"Most browsers are highly secure"... erm no
One side uses AI to find them. The other side probably needs to keep the holes open for NSA, as the multiple 0 click root exploits that happened in the past to the iPhone with very similar techniques suggest.
Do ad blockers protect against this?
> Reuters has reported that billions of dollars’ worth of Meta’s ad revenue comes from ads for scams, illegal gambling, pornography and other banned content. In the US, ICE and other government agencies have bought software that uses ad tech data to track people’s movements.
I don't know if an ad blocker protects against Discover-Tech’s Controlium but in general you'd be a fool to allow ads in your browser in at this point. The ad industry is pretty shady all round.
On web, likely. If it's in app mobile then no. Run a DNS ad blocker.
This is what ad networks are for, by the way
Curious if GrapheneOS phones were also vulnerable to this.
Wild guess even if not in this particular case it's best to consider the possibility as non theoretical.
Earlier link:
https://news.ycombinator.com/item?id=50101813
The headline is "Online ads weaponised to deliver ‘zero-click’ spyware, researchers say"
Once again proving that ads are an unacceptable security threat. All those sites now deploying ad-blocker blockers should assume liability for whatever ad software they force their readers to run.
I wonder who they were facilitating the targeting for given the target countries.
Apps should be required to disclose every single ad network they use as part of their app store disclosures. I want a lot more transparency as to where the ads are coming from inside the app itself.
I've witnessed consumer apps throwing quite heinous malware/sketchware advertisements and watched the banners rotate between 4-5 different ad vendors to keep things hot and spicy.
The incentives are lopsided, there’s so much money to be made by selling access to you and your devices, and controlling you, than just taking your money.
It doesn't make sense how this is even possible.
if anyone is well versed with this tech; can this be used to target regular people? how can an average joe protect themselves from this?
Quite amusing that the Crusader states have exchanged horses, swords and shields for spinny chair, ads, and adblockers.
Wonder what the world's most boring ideological argument will bring us in the year 3027.
Citzen Lab isn't always the most reliable source: https://researchonline.lse.ac.uk/id/eprint/118492/
Classic; when you can't kill the message, kill the messenger. [0]
[0] https://en.wikipedia.org/wiki/Shooting_the_messenger
All ads should have to appear in an <advertisement> node, and users should have the option of disabling javascript within an advertisement. Make it the fucking law.
Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle... The CTO happens to have worked for Radware
https://radware.com/
https://www.innovid.com/about-us/news/mediaocean-completes-a...
tel aviv impressed
Whenever I think of Israeli ad tech one company always springs to mind, which creates some of the worst garbage on the whole Internet.
https://www.taboola.com/
This crap is the worst of the worst.
Absolutely terrible companies. Another one is https://fingerprint.com/ but iirc they don't do ad targetting.
"uBlock Origin has prevented the following page from loading:"
Title is: Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
In fact, just update the url and title to the report:
How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
https://citizenlab.ca/research/how-discover-tech-turned-targ...
I don't see any ads, so ...
Chance of sanctions?
Zero
> Related work by the research group Confiant also suggests that Discover-Tech’s ads have been shown to users of the networks of government entities in Europe and the US, as well as the UN, Nato, the international criminal court and the International Atomic Energy Agency.
Yet we don't sanction Israel nor hold them accountable in any way. Of course they're spying on members of the UN and ICC, of course. Israel is at war with the entire world right now, and my politicians continue to support them. Thankfully many people have woken up, but the situation is dire.
Israel keeps being dick earns reputation.
Based on responses from roughly 46,700 people assessing 129 countries, Israel ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
https://www.middleeastmonitor.com/20260513-israel-becomes-wo...
We don't sanction Israel because we are doing it too. Any country with the same capabilities are doing the same thing.
That conflates the state with a business headquartered in it. It begs the question of what the sanctions would be for: is the argument that this firm is an arm of Israel, that Israel turns a blind eye to abusive businesses, or something else?
> Israel is at war with the entire world right now
Israel is at war with Hamas, Iran and its proxies and allies.
My Democratic Rep (who is a Zionist) voted with the Republican Party to financially sanction and impose visa restrictions on members of the International Criminal Court for issuing an arrest warrant for Netanyahu, so the ICC could hold Netanyahu for trial.
I will never vote for this particular (D) candidate again. Fortunately, the (L) candidate seems reasonable.
If indeed your representatives support Israel or the genocide in Gaza, I urge you to consider voting 3rd party. In two-party elections, candidates mostly just try to be a little better than their opponent. What forces them to do more isn’t a third party actually winning. It’s a real risk that enough fed-up voters will go third-party and cost them the election. This is basic game theory optimization.
Hacker News sure loves to single out one specific country and blanket label. I remember when comments like those in this thread directed against Russia after the Ukraine war heated up were shut down by Dang. But blanket generalizations against Israel?
Dang's official position by the way https://news.ycombinator.com/item?id=48100358 let's see how this thread goes.
Criticism isn't evidence of persecution. If Israel wants to be criticized less, it should better itself.
Why would anyone trust any Israeli cybersecurity firm at this point? Any website or service knowingly utilizing their services is a huge risk. They're already deeply embedded in federal and local governments so there is a strong sense of doom.
A later submission has more comments: https://news.ycombinator.com/item?id=50103000 , 57 comments 1 hour ago
Seems like the title was too spicy / people couldn’t behave, post rank obliterated https://news.social-protocols.org/stats?id=50103000
Hope we follow guidelines under this link or “then nobody gets it!”
Thanks - we'll merge them.
Imagine if Iran did this... Or China, or Russia. But hey, it's Israel - all laws, rules, norms and ethics is suddenly suspended - so everything is ok!
They do. But "no jews - no news".
You can have peace or Israel, not both.
Probably happens with Russia, US, etc as well, but the "hasbara" campaigns through the years have the effect of making people assume the mossad is all powerful etc etc. You inspire fear on your enemies, but also your friends.
edit: and I have been hasbar'd now for simply stating the fact that making people fear you instead of love you has consequences. oh well.