Posted by jcomp 12 hours ago
https://www.theverge.com/tech/1011956/discover-tech-zero-cli...
Article on the CitizenLab website: https://citizenlab.ca/research/how-discover-tech-turned-targ...
I think lots of it has to do with how well the hasbara covers up the scandals from the wider publics perception, combined with the cultural bandwagon of considering them an ally even when their repeated actions say otherwise.
edit: also the idea that they have such good tech and its a pragmatic decision ignores the history of how and who they got it from and the intentions for it. I say this as someone who worked directly with Mellanox for example, before aquisition by Nvidia... I always thought kernel level shims for networking stacks from an Israeli company was dangerous... but the speeds!!!
Then the ad network delivers a targeted ad that exploits a vulnerability (eg a broken JPEG decoder that, when sent a bad image, allows to run arbitrary code on your machine), and from there you have access to the computer
It’s to do with hiding malware/spyware in an image which ends up in your cache on device. I can’t go much further into details but all this takes is for you to visit a site that serves it via ad network.
Israel has been known to have some sneaky spyware in the past with Pegasus.
- It came in through the front door. Discover-Tech ran its own ad-buying platform and was listed as a "certified" vendor by Google and IAB Europe for six years. Nothing was hacked to get in. It bid in ad auctions like any other buyer.
- The ads looked harmless. Plain banners for games, AliExpress deals and an IP-lookup site. Hidden inside each one was a small script that quietly phoned home when the ad loaded.
- Everyone who saw an ad was profiled. The script collected device details, IP addresses and, on many sites, the publisher's own cookies, sometimes including logged-in session tokens. Cookie-syncing with other ad networks built a huge identity graph.
- Only chosen targets got the payload. A gatekeeper server checked each device's ad ID and IP. Most people got nothing back. A selected target got code that handed them off to spyware maker Candiru, and the code was served only once, which made it very hard for researchers to capture.
- The handoff was built to defeat inspection. Encrypted channels, rotating hosting, anti-bot checks and even a fake "Copyright Google" comment to fool human reviewers.
- It worked. At least 45 devices at Al Jazeera were targeted, and spyware was recovered from an infected machine. Its ads also appeared on networks belonging to NATO, the UN, the European Parliament, the ICC and various defence ministries.
- The scale was huge. Billions of bids and ads in nearly 200,000 apps and websites, including Duolingo, Viber, Yahoo Mail, dating apps and period trackers, yet almost no sign of real advertisers or revenue.
Citizen Lab: https://citizenlab.ca/research/how-discover-tech-turned-targ...
Confiant: https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zer...
Citizen Lab also has a shorter executive summary: https://citizenlab.ca/research/exposing-adfection-executive-...
Edit:
the TFA answers: "Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user." Its wild! I thought the ads are sanitized, go through a CDR of sorts, and whatever javascript is permitted is authored by ad networks, not the buyers. Sheesh. Thats just RCE.
RTB (real-time bidding) does not incentivise publishers to care about what ads are actually being shown to individual users, so long as CPM is maximised.
> Don't post generated text or AI-edited text. HN is for conversation between humans.
It’s a low-hanging fruit that has high value, particularly for less savvy internet users. Scams have always been the biggest threat. I’d say the majority of internet ads are scams, and the platforms often don’t make it clear what is or is not an ad.
But, we always knew the risk of malware was there. In the modern age, ads are basically never delivered as static assets. They’re delivered as small applications, with code. So, we’re relying on our sandboxing mechanics to work perfectly, and predictably they don’t. The solution is to block the code altogether; to block ads.
The ad-tech network probably does make it easier, because any page that includes their ad network could deliver the malicious ad.
Streaming services used to be bad enough with ads in the shows, now they put an ad on the screen when you pause it. Peacock just started putting ads in the login screen.
If we don't stop this, pretty soon they're going to have ads in the stars as satellite constellations arrange themselves to sell you Twitter subscriptions. They're not going to stop even when there's an ad no matter where you look.
I'm reminded of the ending of the 2008 film Hancock in which Hancock defaced the moon with a corporate logo. But it was okay because it was "for a good cause".
Putting a static, printed poster on a wall is in no way analogous to surveillance.
I am scared for my parents to get exposed to this kind of thing from bad ad network actors. Does anyone have some practical concrete recommendations they took? Like I don't think they can install ublock origin and whitelist sites on demand in Firefox they way I do.
The only practical thing right now is to make sure they don't have the money on device and have 2 fac for email and bank accounts. But every now and then there are phishing attamepts that they could fall prey to.
You should threat model, but if you want to maximally protect yourself, use Vanadium or Brave Browser and GrapheneOS and no privacy invasive apps.
The CTO happens to have worked for Radware
https://www.innovid.com/about-us/news/mediaocean-completes-a...