Spyware can infect your phone or computer via the ads you see online – report
theconversation.com
theconversation.com
> What sets Insanet’s Sherlock apart from Pegasus is its exploitation of ad networks rather than vulnerabilities in phones. A Sherlock user creates an ad campaign that narrowly focuses on the target’s demographic and location, and places a spyware-laden ad with an ad exchange. Once the ad is served to a web page that the target views, the spyware is secretly installed on the target’s phone or computer.
That last sentence is simply impossible without an unpatched vulnerability on the device. If something is actually installed on the device, the vulnerability allowing this will eventually be patched.
1. This hack is not a result of a device vulnerability.
2. That whatever technique is being used to install spyware cannot be defended against (i.e. with an OS patch).
That is simply impossible if an actual executable is installed on the device.
Even if worse came to worst and there was a bug on the parent page that let the ad JS access its parent page context, it should still be sandboxed to just that page.
There's one exception, if there's a vulnerability in the hard-coded ROM or the silicon itself. One was found not long ago and enabled newer iPhones to be jailbroken. It lacks persistence and requires lightning port access, but it can't be patched.
A no-click remote ACE at the unpatchable physical level would be the mother of all zero days, and too valuable to use for all but the highest of targets.
Let's say this exploit did exist, and it was better for some reason. Then maybe I shouldn't use it, instead I use a cheap one time use exploit on a target that would cause it to be patched anyway.
so. many. IOS. vulns.
what is going on over there at Apple?
Plus, many of the highest value targets are likely iPhone users, so bad guys target where there is the biggest payoff.
Also probably wasm for a finer-graded sandbox if rewrite is currently impracticable.
https://hacks.mozilla.org/2021/12/webassembly-and-back-again...
If the module memory corrupt for whatever reason. At least you would be able to unload it as a whole without pollution.
Does this have to do with the 0-day exploit in WebP that is causing a huge mess for the entire ecosystem?
Everyone seems to be fixated on "ads shouldn't be able to run JavaScript" and the like.
What exactly is that JavaScript in the ad taking advantage of? Why would it matter that it's an ad and not just a website?
If ads can do it, web pages can do it.
While I agree the attack vector is pretty awful, I was just curious exactly what the exploit was. The article doesn't even mention it.
It links to Apple, which is likely that 0-day 0-click that Pegasus uses (BLASTPASS). They report that as a flaw in PassKit though, which would not affect Android or Windows.
That's why I was thinking the WebP overflow?
That is actually worse, and makes the discussion here even more off-topic, because that has nothing to do with JavaScript. I has to do with decoding WebP images.
You owe the advertisers nothing.
But with the risks involved (malicious ads and being tracked), everything is blocked. It is "risk blocking" not "ad blocking". Not seing ads is just a side-effect.
A newspaper will refuse to print unacceptable ads. Some ad-tech will deliver anything. Some websites use ads from ad-tech that delivers anything.
Maybe there is a niche market opportunity for a guaranteed-safe-notracking ad-tech company to reach the target demographic of people blocking ads to reduce risk and avoid tracking. It would require cooperation with ad-blockers to provide a switch to drop to risk-blocking though.
The current ad-tech model needs to change and is due for disruption. Advertising is everywhere and it’s out of control. There seem to be more ads than ever, in every medium and in every square inch of surface area. In most cases, the ads are unwanted and not even relevant.
Our attention is being stolen and massive amounts of money are being wasted by companies with a legitimate interest to make sales. The bottom-line is that consumers are being victimized by the constant bombardment of advertising. And the companies that sell products/services, who need to build awareness and grow sales, are being taken advantage of by the ad-tech giants.
A new model is needed and we are actively working on a solution called Sellff Offers. This solution allows sellers and buyers to connect directly, without the middleman. Sellff Offers inverts the current ad-tech model in three significant ways: [1] Opt-in, [2] Privacy friendly, and [3] Pays cash rewards.
Here is an example Offer [ https://sellff.com/$/ron.michel/offer/ewVkr ]. You choose whether to view the Offer. Your data and activity is not collected/shared/sold if you view the Offer. And, you are compensated for your time if you decide to participate in the Offer.
Complaining about the current broken ad-tech model does not help to fix it. You need to take action to bring about the change you want to see. If you have an interest in building a new digital marketing/promotions solution, we would like to speak with you. Regardless, we are very excited to see the growing consumer awareness of the dangers of ad-tech and the interest in alternatives ways to connect buyers and sellers.
At this point we can only assume that every ad is malicious. It doesn't matter if they are designed to sell a product or service. They'll still collect/extract data about you at every opportunity.
At best, they're attempts to manipulate us. That might mean making us feel insecure about ourselves or our lifestyle so that they can trick is into giving them money. It might mean outright lying to us and feeding our fears to push us to support a certain politician or law. It might be promoting outright scams.
Surveillance advertising needs to die. Paying people to view ads alone won't remove the harms advertising can cause, but at least it's a "pull" vs "push" model which I approve of since it can be safely ignored by anyone unwilling to subject themselves to manipulation and exploitation.
You should consider a strict code of conduct for what types of ads you will/won't allow on your platform to keep the worst of it away. Fact-checking and vetting takes time and money, but it would keep your service from being used to spread disinformation and scams and could help prevent some of the harms.
Goog's Ad network had a pretty shoddy history with ads that redirect users automatically, but I had the feeling they got on top of this. It seems like something that could be stopped automatically.
As for website owners who are running unscrupulous ad networks, that's on them.
As other have said, this is a key reason to block ads.
Is there a difference if you want your ad to appear inside apps rather than the web?
Ads don't need JavaScript or anonymity. Then ad providers can easily filter out those most dangerous, and remain in compliance. Regulators can easily scan for violators.
If I go to example.com I don’t want JavaScript from other hosts loading and running. This could probably be a simple browser extension honestly - might give it a try. It’ll break a good chunk of sites but I don’t think it’d break them too much?
Although it does completely break CDNs so probably an allow list would be necessary.
Though, I really don't like this propisition because it just means google will require websites to host google-provided JavaScript from their domain.
It is moral and ethical to block all ads and scripts from adtech companies. Contributing to ruining their way of life is a socially-responsible behavior. Failure to do so results in behaviors like this.
You get what you deserve if you don't block ads.
I was with you until this piece. Not everyone is well educated enough on the nefarious nature of targeted online advertising and the technical processes of blocking them on each platform.
In some EU countries we have pretty strict regulations on what ads are allowed, where they're allowed and for what they're allowed, precisely because not everyone can "mentally ignore" them and people can be easily influenced.
So you can't just say "well, it's you're own fault you got addicted to opioids/gambling/drinking/smoking, so you get what you deserve", when the whole city is plastered with ads for such accessible addictions. "Got a tooth-ache? Ask your doctor about OxyContin." "Got trouble paying the bills? Get a loan with 500% interest rate from us on the spot." "Wanna look cool? Smoke Bullshit cigars."
Usually, the less educated and less well-off people are, the more vulnerable to nefarious and predatory advertising they tend to be, so it's the responsibility of us as a society to take legal steps of ensuring the regulation and blocking of targeted web ads at communal/societal level instead of leaving it to the individuals and the mercy of the "free market".
The statement was directed to the audience, IE HN. I have confidence that everyone on HN is capable of installing those browser plugins and comprehending the complex clusterfuck that is uMatrix.
I don't have a solution for the less-technical folks right now. The best I can do is encourage people who ARE capable of responding reasonably to that message to help the people who don't. uBlock Origin is already pretty friendly, but uMatrix is a nightmare.
Unclear from your comment who the target audience was, but to me it would be equally inflammatory regardless. The non-tech-savvy users are a way bigger and more vulnerable target than just the HN userbase which is a microscopic minority on global level.
Eh, agreed. Kinda detracts from the point. I've gotten pretty vehement about the topic over the last few years I guess.
Encouraging those who can to do is also a component of grassroots change. I don't think it took much charity to interpret their comment as being directed toward HN, and only a little more to imagine how pushing tech people to use/develop/polish ad blocking tools can result in the spread of such things.
Seems like you're working hard to be upset.
I think it can be made to do the same things as uMatrix with advanced mode (I use medium mode on uBlock) - or am I wrong on this? Ive never used uMatrix before
I think I actually started out with uMatrix first so I've mostly relied on it to do most of the heavy lifting.
They suggested regulation as is done in Europe. Perhaps that's worthy of consideration since hope and power users aren't stopping this problem
The problem we're facing is that adtech is a multibillion dollar industry with the will and means to actively research and develop new and exciting ways to bypass legislation.
I can't control the legislation beyond who I vote for, and none of the voting options I'm given seem aware of how the internet works, so I am left with the avenue of "Angrily tell people on the internet to stop doing that" and try to encourage attrition as much as I can.
It cant for existing profitable business models. You couldnt ban the google owned nuclear SLBM fleet if it already existed and represent the most profitable sector of the economy. Inertia exists and the more profitable the topics the harder it is to break from a central position. It would be economic suicide on a national level.
You would get some paper tiger checks and balances entrenching googles nuclear fleet monopoly.
Of course we can ban that. :laughs in EU:
There just isn't the political will behind it like it is on things like ICE cars or nuclear energy, because unlike the latter things, the politicians and voters don't understands it well enough to be outraged about it.
edit: Saw your nuclear energy edit too late. Thats a great example for protectionism / having a frame for subsidies. We still require energy, that section of the GDP didnt just evaporate.
Car legislation is likewise just a driver for higher consumption.
You would need something equally profitable to do for the sub fleet supply chain to ban it.
When I set a computer for any of my friends and family, I drop uBlock Origin on it and show them briefly how it works, usually using cnn or similar sites an example. It solves 99% of any computer problems they run into.
There was a time when Chrome started to be bundled with every freeware out there. Most of the people where I did IT-Support ended up using chrome at some point. They didn't even realize when or how they changed a browser. Some didn't even know what a browser IS. They just open "the internet".
I had installed Firefox with proper protection before that.
I ended up with a bunch of users who used chrome without adblocker, downloading crap.
In the end, I diverted the chrome shortcut to Firefox, which is good enough with ublock. Wouldn't install them, Brave. Don't want them to come back to me asking about that crypto custerfu.
Especially the way it started. It's till out there. The internet never forgets.
This is really "our" problem. If the audience here doesnt find fixes its unrealistic to expect that of regulators. This is a systemic issue caused by the economic structure that cant be fixed by yet another law.
If everyone blocked ads then it wouldn't be so profitable. The reason it's so profitable is that very few internet users actually have ad-blockers in place.
There is a giant industry here. Any attempt at top down regulation will fail at that and get either regulatory captured or poked holes through for the big players.
And it's not like ad-tech is an important industry that's mandatory for a healthy society like healthcare, energy, transportations, education, environment, agriculture, etc. We can easily survive without them being so wealthy and powerful. We might even be in a happier place with them defanged, even if their shareholders wouldn't.
You miss my point completely and i am unsure how to reword it.
Yes they are exclusively big players already, thats why it wont work through top down regulation and requires user action.
We might be better off without them, but i dont see how that could ever happen through top down regulation. The economic and political incentives are way to strong and bureaucracies way to unwilling and incompetent. You cant destroy such profitable business models through regulation, they have to much pull here. At best you get regulatory capture. It will be another iteration of "safe/privacy on paper" allowing for higher profits and more entrenched monopolies for said megacorps.
Intention is not a valid metric, outcome is.
Wrong. Top down regulations definitely work. :laughs-in-EU: That's how we banned Apple's proprietary connector, ICE car sales starting 2030, and how (for better or worse) some countries banned nuclear. What makes you think we can't ban targeted ad-tech the same way?
There just isn't the political will behind it like it is on things like ICE cars or nuclear energy, because unlike the latter things, the politicians and voters don't understand it well enough to be outraged about it, so they keep slipping under the radar for now, but there's no guarantee this will go on forever.
Nobody deserves to have their computer compromised - whether they block ads or not is irrelevant. Saying otherwise is victim blaming. It's the same as saying that a woman who walks down the street in attractive clothing deserves to be raped, and society is making some pretty strong statements about that sort of thinking these days.
I suppose Mozilla gets a lot of Google money to not let that happen (?)
The purely ethical solution here is just not using sites that have ads if you're opposed.
I don't care.
Adtech is a pursuit that has turned into a scientifically-quantified attempt to subvert the executive function of other human beings with the aim of getting them to perform actions they would otherwise not perform.
If you can't survive without engaging in amoral psychological manipulation of other human beings, you don't deserve to be paid, and your way of life should collapse.
Find a different job.
Let's not forget that this article is about adtech being used to distribute malware.
Noscript isn't worth having in favor of uMatrix, IMO.
I hope you do great contributions to the cause if you are already at the point of victim blaming.
If you dont want one and keep your agency, be less dumb. This is a functional description not a moral argument. If somebody has to fix it for your, your say in the matter will drastically reduce.
It's easy to forget this when every article has a web archive link bypassing a paywall, or you watch YouTube with Sponsorblock, but ultimately someone has to pay the bill at the end of the day. An individual writing an investigative piece over months incurs a lot of expenses, the 10 minute YouTube video you watched probably took many hours or days to produce, the storage and bandwidth cost of the 4K video you watched is not nil.
An ideal world would have properly regulated ads on platforms like YouTube and Adwords held to the same standards as some European ad agencies. But since we don't live in an ideal world, pay for a subscription to a newspaper you read a lot. Give someone you enjoy like $5 on Patreon, maybe more if they're not the type to double dip with sponsorship spots AND have a Patreon (personal pet peeve) and immediately unsubscribe, that's worth several thousand ad-supported views depending on their CPM. Like having LTS versions? Donate to the devs or don't be surprised when they burn out[0].
Currently, almost everything you enjoy on the internet is made by other humans. Support them in doing so.
[0]: https://arstechnica.com/gadgets/2023/09/linux-gives-up-on-6-...
I explicitly reject this idea.
What did media do for centuries? They had a brick and mortar sales operation that went out and sold advertisements, took in creative, and than ran those ads inline. For those not big enough to support this, there are agencies that will do the entire thing for you.
This idea that we need to allow untrusted third parties to run code on our computer because poor website operators would just have no other way to make money is bogus. This is particularly true for journalists who should be extremely uncomfortable that google has full access to their articles and can manipulate them before they're shown to end users.
In an ideal world, people would take and make 100% of the advertising money for themselves, and pennies-on-the-dollar advertising aggregators would have no reason to exist.
For reference, I work at a smallish media company doing high quality news and content. We have a small and strapped sales team. They sell what they can but the buyers have the same conundrum. They aren't all looking for partners when they can just buy traffic at predictable prices and put their faith in brand safety tools. They want to maximize their efficiency of their ad spend and that usually doesn't involve looking for partners and relationships when they can just click a button and get more views. The result is that we've been hit by malicious ads more than once.
I remember what the internet was like before the adtech hegemony was so entrenched.
I was happier with my internet experience back then.
I legit do not care if every service on the internet that relies on ads ceased. If it all went away tomorrow, I'd be fucking fine. Sure, I'd have to find something to occupy my time that isn't Daily Youtube Binge, but that'd be a /healthy/ outcome for me.
I'm fine with going back to paying 5 bucks a month to self-host content I want to share. The newstertainment industry with all their paywalls don't actually provide much value to my life, and if they went away, I'd be fine as well, and so would you (probably?). I'm fine with paying 5 dollars a month for a reliable search engine, too. I've been collecting the patreons of every youtube channel I follow and pretty quick here I'm going to be setting aside part of my monthly budget to it. Supporting healthy monetization schemes is part of my beliefs.
Hell, I'd be 100% happy to participate in a good-faith attempt to charge me a small fee PER ARTICLE I READ (similar to how I was happy to pay for music when it became possible to buy individual tracks and not entire albums), but the industry collectively failed to grab its sac and make that change already, so I don't care about them or how Kantian philosophy applied to what I believe would ruin their way of life. That is, in fact, the point.
Adtech is amoral, and it disgusts me how we've normalized it to the point we have.
a little click / tap - open up options - send a small payment (paypal, venmo, crypcoin, more) - setup a regular support (patreon, superfans, etc), - watch an ad (able to choose type of ad and content to watch or avoid) - share this content via ..social, your site, etc.. remix.. - give a like / subscribe / follow on ..
(the site owner can choose defaults / add info maybe)
and a bridge for people to add money into a bucket that can be translated to wherever.. I've run into people online I needed to send money to (and offline too) where figuring out how to get money from me to them is just crazy.
I believe the problems with micropayments in the past have been mainly with not accepting enough payment gateways - having a search / suggest option would make it easier.
Some people are happy to do this or that if you make it easier to do that or this, but often it's not.
Is there a portal we can click to that does some basic how to get a few dollars from [where you are] to [where it's going] the easiest, least cost, most secure / less worry?
This is different for many people and places.
ai - give me a coffee cup mixed with light bulb and coin and bucket with speech bubbles that pop up with..
Depends on your moral code, I think? Who made you a moral authority? You don't get a say in what I consider moral.
I'm sorry for the aggressive tone of my post, but people telling me what I should think are a pet peeve of mine.
Morality necessarily comes from authority. Otherwise, it's nothing but a preference or a fashion. Everyone may have a different view of morality, but the whole point of morality is objective, if it is to have any comprehensible definition. Hence it is correct to state one's morality with authority if one truly believes it.
That’s not true at all
> Otherwise, it's nothing but a preference or a fashion
Morality is definitely a stronger belief than a mere preference, but it’s still subjective.
> the whole point of morality is objective, if it is to have any comprehensible definition
I don’t understand where you’re coming from here. Morality has nothing to do with objectivity.
I don't care what you consider moral. If you don't like it, you can do as you please. I would have thought that would have been obvious, since this is the internet and the only control over you I have is through text on the screen.
Repeating this is tiresome; take your aggressiveness and peevishness elsewhere, because I'm about as obligated to care about them as you are to consider what I say moral. You're not sorry, so you shouldn't say so, which is a pet peeve of MINE.
They've had about 30 years to correct course and self-regulate, and not only can the adtech industry not help themselves but companies like The Google have proven that they'll be complicit with the swindle if they can get away with it.
If fast-forwarding through ads on your DVR isn't stealing, then neither is using uBlock Origin. In fact, the morality behind web ads means that the right thing to do is to make ads, especially malicious ads, not profitable.
Everyone agrees the early internet and web was different. The auto-load resources "feature" was intended, or even Javascript, for a web that was experimental and fun to use.
These features are now used almost invariably for commercial purposes. Most of that is surveillance.
Without auto-load resources and Javascript, the user dials one number and only connects to one number. Most advertising and tracking stops working. When visiting sites submitted to HN, I'm not using a browser that auto-load resources or runs Javascript, hence there is no need for me to "block" ads; I control what request.
People have been expending vast amounts of energy trying to counter "automatic" behaviour of the browser they choose to use. Perhaps the challenge is a new type of "fun". Otherwise, why use a browser that one cannot control. Find an open source browser. Remove the offensive "features". Re-compile. Done.
This is exactly what I did with the browser I'm using to type this comment.
Not everything that is "popular" is good. Perhaps that's an effect of advertising. Several so-called "tech" companies want the public, including government officials, to believe that advertising dollars are necessary to sustain a useful computer network.^1 Feel free to debate.
Everything that is good does not need advertising. UBlockOrigin is one example. By generally all accounts, it's great and, AFAIK, it is not supported by advertising.
1. The truth however is that advertising dollars are only necessary to sustain those companies.
In case you missed it, this thread is about adtech. Google ads are deployed on more than just Google products, so when you say, "You don’t have to use google products, right?", what you should really be saying is "You don't have to use half the internet, right?"
Which is definitely true, I suppose.
Gmail < Fastmail
YouTube < YouTube Premium
Search < Kagi
Maps is Google's last stand. At least Apple has offline maps as does Organic Maps, but Google Maps is superior.
I don't know that this counts as an alternative...
Anyway, what you described is exactly what I'm doing today with Google Maps mostly replaced by Apple Maps.
It does work and I don't feel like I'm missing anything, but it took years for me to gradually move over. Even with fastmail, I have _hundreds_ of accounts that still use my @gmail.com address (with the email forwarded to Fastmail).
For the average person: they simply aren't going to care enough to try.
In the context of Googles advertising practices I think it should count. If you pay for YouTube premium you won't be bothered by their ads anymore.
They're an attack vector, and ads should be treated like the security/privacy threats that they are.
AND - the owners of the (relatively) few web sites that most people visit are far more invested in staying malware-free, vs. the Ad companies letting ~anyone on the planet run js in ads, at "what's their credit card good for?" scale.
It’s one of the reasons I do not turn on personalized ads anywhere.