AdFection: Targeted ads turned into a pipeline for zero-click mercenary spyware
citizenlab.ca
citizenlab.ca
I guess it is because it has been under the threat of larger enemies from its birth, so it must leverage whatever it has to survive. And once you grow an organization and let it loose, you don't have much control over it anymore, and it grows in the wild like a flower.
In that one incident, they killed and injured more than double the number killed and injured by Al Qaeda in the attack on the USS Cole.
That’s as much as your mom knows.
Yes.
What’s this have to do with the people you don’t hear talking about him being mostly totally ignorant about the person and subject?
But yeah the country under an eternal international microscope is the one “getting away with it.”
...Did you just emerge from a bunker that you entered in 1946? Here in 2026 we're on quite a losing streak against MUCH weaker opponents. I mean I get it, you're doing the "Jewish conspiracy" thing and reality, truth, words having meanings are all inconsequential to you, but you have to try harder than this.
Though this may be changing now with Trump and the israelification of america.
Come on... Snowden told us that we were all being spied on and we made some movies, some books, a lot of blog posts and that was it.
Abu Ghraib? The people literally on film doing things were prosecuted, and it was passed off as an essentially low-level problem.
Gitmo still exists and has prisoners.
We invaded Iraq on a lie, literally lied to the UN about a nuclear threat that didn't exist. Elected that guy a second time, just like Reagan and Nixon and Trump.
What we're good at is public debate that goes nowhere and losing wars in the Middle East.
It's hard to tell, on the surface it looks a lot like the usual "Sinister conspiracy" stuff that leaks out of sewer gratings online.
[0] https://www.goodreads.com/quotes/12250339-david-ben-gurion-w...
2. Israel is embedded in US politics. So US government is allowed to purchase this from Israeli contractors but I doubt they would be allowed to purchase sensitive stuff like from a neutral country like UAE.
So, the US is the customer and also protects Israel so Israel has built an entire industry around it.
Russia, China and America each have notable offensive cyberwarfare capabilities. (Pyongyang is a nuclear-armed cybercrime ring at this point.)
China doesn't have large sanctions because it plays a key role in the economy, but the US had massive regime change intelligence operations against them in the 90s, but they failed and were dismantled.
Israel is not particularly skillful: they're a little bully getting in some punches while a big bully holds back the rescuers. Ooh, tough guy!
"The people I don't like are always unskilled." You shouldn't hate your enemies; it affects your judgement.
Israel is the one occupying and bullying its neighbors, spying on its "allies", doing air-strikes on neutral countries, attacking US research ships, and performing piracy and kidnapping in international waters.
They ascribed a lot of the tech innovation to conscription - lots of the founders had learned a lot while in technical posts in the army and put that to use when they left.
https://en.wikipedia.org/wiki/Unit_8200
>The unit is composed primarily of 18–21 year olds. As a result of the youth of the soldiers in the unit, and the shortness of their service period, the unit relies on selecting recruits with the ability for rapid adaptation and speedy learning. Afterschool programs for 16–18 year olds, teaching computer coding and hacking skills, also serve as feeder programs for the unit. Former Unit 8200 soldiers have founded and hold top positions in many international IT companies, including in Silicon Valley.
>According to the Director of Military Sciences at the Royal United Services Institute in 2015, "Unit 8200 is probably the foremost technical intelligence agency in the world and stands on a par with the NSA in everything except scale."
I would recommend you to visit Israel and traditional orthodox jews. Women are serving as "birthing machines", constantly pregnant, and doing all house chores. Education for women is strongly discouraged. Men are "studying", but useless memorizing of old texts.
Normal education in western sense is strongly discouraged in traditional jewish culture!
https://www.timesofisrael.com/israel-plummets-to-worst-ever-...
Yes, orthodox jews are a significant part of the population (~1.4 million in 2025 [1]), and I wouldn't go there looking for modern ideas like women's rights, but go a couple km in any direction and you'd find completely different people, living modern lives just like in the rest of the western world. Schools, research universities (Tel Aviv University, Waitzmann Institue of Science, Technion), tech companies, startups, makerspaces, and many more.
As I understand it, they know God's not stupid and sees right through this sort of thing, but they believe God put rules like "stay indoors on the Shabbat" in place so that He could entertain Himself by watching the creative loopholes humans come up with. Other Shabbat loopholes include putting things on timers the day before, paying a non-Jew to do things that Jews are forbidden to do, or legally transferring ownership of the cupboard full of bread to a non-Jew for the one day a year when Jews aren't allowed to own bread.
And as I understand it, they do this with all things, from a young age. Cultivating this mindset definitely has something to do with their cybersecurity prowess.
As an atheist Jew, it's weird to me as well...
> stay "indoors" on, I think it was, the Shabbat
Can't say I'm familiar with that one. What I'm generally familiar with is that you're not allowed to "work" on Shabbat, and the definition of work is extremely broad. For example, lighting a fire is considered work, turning a light switch on creates a tiny spark between the contacts, that counts as fire, so it's work.
This extends to pretty much every electrical device, so for those who observe Shabbat, using a computer or phone, turning the AC on or off, is all disallowed.
As a result there are many workarounds as you've described, timers, non-Jews (though you can't ask directly! You can say "it's hot in here", but not "Please turn the AC on"), fridges without a light bulb inside, and more.
> they do this with all things, from a young age.
Religious families do, to varying degrees. But I've met plenty of extremely talented programmers and hackers who do not follow any of the Jewish law.
Edit: Just noticed your username, I also want to say I really like your projects on YouTube!
There's no reason Netherlands are better at chip lithography except that they're doing it (Dutch agriculture success can be attributed to good soils/climate/geolocation, but not chips). There's no reason Hollywood is better at filmmaking. Kinda chaos theory -- small changes to initial state leads to huge changes in the later outcomes.
Same thing with Israel -- if they had some easier way to make moneys they would go for it. But constant demand from their defense kept if afloat.
If you want to do something artistic or start a business based around Art, Montreal is perfect for it, for the very same reason above.
Initially the govt invested in the arts to preserve French culture, which resulted in a lot of art infrastructure being made, cheap ateliers, fabric suppliers, paint suppliers, &c. Which attracted a lot of artists, which then increases the demand for the art infrastructure, which makes the city easy to make art in.
It makes it stupid easy to make stuff and find the skilled artisans you need to make it. Much easier than any other Canadian city I've lived in.
West coast filmmakng started in the Bay Area (at the time the largest conurbation in the west) but moved south because of the year 'round weather.
But why the west? Because Edison controlled the filmmaking patents and demanded not just royalties but script oversight as well. By moving west, they could ignore the patents because they were simply too hard to enforce from such a long distance.
So ironically, given how things worked out, IP piracy is at the root of Hollywood.
The only reason I even commented was because IP issues are popular and relevant on HN
Plus very much present in US politics and power circles for some reason.
2 examples out of many - my boss is a prime example, every thought somehow infused with money (I work in a bank). My ex gf was exactly the same (she is a successful commodity trader). Just very, very different mindset to the core to say typical european one (I mention folks who are europeans and I've never been to Israel, so extrapolating a bit here).
It has always been at odds with its neighbors and has persecuted its occupied people, for far too long. It has further facilitated other tyrant governments in the control of their people. The cyberwarfare industry in Israel is directly part of the controlled Defense Industry.
It is not under threat. It has sought to be a formidable threat to everyone.
See professor john mearsheimer on the history & future of israel
https://www.youtube.com/live/z8wooQEYyzc?si=_STtJSdEjDUwIl72
What I meant was, I don’t think Israel is the only guilty party in that decades old conflict, nor the only side with agency to choose how to react in the conflict.
Read the Hamas charter, Iran’s statements about Israel, etc. Israel is not unique in choosing violence.
- 1948 - Egypt, Syria, Jordan, Iraq, and Lebanon invade Israel
- 1956 - Israel invades the Sinai
- 1967 - Israel preemptively strikes Egypt in response to military buildup
- 1973 - Egypt and Syria invade Israel
- 1982 - Israel invades Lebanon
- 2006 - Hezbollah attacks IsraelNo. Israel invaded Mandatory Palestine. The arab states invaded and took Palestine. Egypt took Gaza. Jordan took the west bank. Israel took the rest. And the partition plan from the UN was never implemented. #conspiracy #tooEasyToBeCoincidental
> - 1973 - Egypt and Syria invade Israel
No again. Egypt invaded the Sinai, its territory as recognized internationally, yet taken by Israel in 1967. Syria invaded Golan Heights, again its own territory as recognized internationally even today, yet taken by Israel in 1967.
> - 2006 - Hezbollah attacks Israel
No again. Israel invaded Lebanon in 2006. Hezbollah demanded its soldiers back per agreement, and Israel was breaking its agreement. Hezbollah invaded Lebanese territory, given to them by Syria, yet occupied by Israel.
As everybody else in the planet. Israel is not special in that sense.
Over the last 50 years, the probability of anyone invading france, canada, australia, etc has been next to 0. The only countries that really had to worry are the ones that straddle the regions of influence during the cold war.
Good for them. They learned to cooperate with their neighbors, created alliances and friends, and restrained to kill other people.
If you have one enemy, the enemy is the problem
If everybody else is your enemy, YOU are the problem.
Check your behavior and see if you can improve as human being.
Pre-1967 Israel didn't control the West Bank or Gaza. So most of the bad stuff people claim about Israel today didn't really exist.
Yet all its neighbours wanted to destroy it.
Lebanon who in theory should have no dispute with Israel bombarded it with ten's of thousands of rockets, mortars, anti-tank munitions etc. After Oct 7th.
The bit you're missing in your overly simplistic analysis is that Israel is really surrounded/attacked by a single religious/political ideology. There is no "everybody else here".
Israel has stolen as much military and industrial secrets from US as they could grab. Has violated every international law. There are strong suspicions to be behind Epstein honey trap for riches and politicians all around USA and Europe. Has funded Hamas. Has an horrible relationship with human rights, longer than the bible. Has called non Jews "human animals", and acted accordingly, even to the point of doing competitions about "who can destroy more kneecaps or shoot more testicles in a week", among starving people that were trying to obtain food none less. Has treated 5Yo children like partridges in a hunting party. Has killed thousands of journalists, doctors, nurses and NGO staff without even trying to pretend that they care. Has put spy devices in friend's phones each time they could. Was caught messing with the elections in UK. Has used, discarded, and left each politician that supported them, alone and hanging dry in the elections, from Biden, to Trump, to Merz.
US does not want the demise of Israel, but Israel does not even try to pretend that they respect the opinion of US. Even after all this time, is all grab and cash. And US is always cleaning the mess that they left behind.
And the only thing that we can hear from them is "Why everybody hates us?" Really?. Clean your acts first.
"Has violated every international law". Baseless. Violates less "international laws" than most western countries, not to speak of the rest of the world. I mean "international law" isn't really a thing, it's a series of treaties.
Called non-Jews "human animals". Just the Hamas and the perpetrators of Oct 7th. And rightly so. I mean animal is a compliment to those people. (all humans are animals really).
I don't know where you're getting all of this from. But it's an alternate reality. It is not factual. It is putting Israel under a microscope when most of the world behaves much worse. There are dozens of countries with much worse human rights violations than Israel is even accused of. And many of those accusations are outright lies. That's not to say every Israeli soldier is perfect or that Israel is perfect, but it's certainly better than e.g. anything the west did when it went after ISIS/ISIL or Al Qaeda or pretty much any other war waged by the west. And the west is better than the rest of the world by far.
"Has killed thousands of journalists, doctors, nurses and NGO staff without even trying to pretend that they care." -> totally false again. Many of these were Hamas combatants, e.g.: https://www.idf.il/en/mini-sites/the-press-files/does-the-id...
You are just echoing propaganda here. And that's the reality of why people hate Israel. Because they are bombarded by propaganda that tells them to hate Israel. If you actually are able to zoom out of that you will see it as well. That plus antisemitism.
EDIT: You are right that Israel isn't spending a ton of cycles trying to get e.g. Europe and Americans to "like it". Between the choice of e.g. winning the war in Gaza and e.g. giving up to Biden's demands (e.g.) Israel has chosen that it must win the war. The American left, media, and universities, e.g. are structurally biased against Israel. They are regurgitating cold war USSR narratives. This is the result of more than two decades of anti-Israeli propaganda. Israel sometimes has to cut its losses. It can't out compete the resources of Qatar, Russia, and China e.g. who are out to splinter the US by whatever means possible. It could do better but between "making friends" and a decisive win against Hamas which is crucial for its future security it will pick the decisive win.
Look at the media coverage regarding Israel's continued pressure on Hamas since the ceasefire. Israel keeps eliminating Hamas commanders, it's eliminating people who were part of the Oct 7th raid into Israel, it's eliminating infrastructure used for military purposes, it's eliminating people who have held hostages. What the media is reporting is simply that Israel is "violating the ceasefire" and "killing Palestinians". That narrative is false. If you believe it then you're going to "hate Israel" as you are programmed to do. But Israel like any other country has the right to win against Hamas in this war Hamas started.
EDIT2: Also reality is complex. So we do have things like an extremist right wing government who is turning a blind eye to violence against Palestinians in the West Bank. However that tends to be blown out of proportion. We see western media simply not reporting on Palestinian violence against Israelis. Just like they didn't report Hezbollah's attacks on northern Israel. The evacuation of the population there. And generally anything that puts Israel in a possible light as being the one defending itself. So if you consume simply a one sided picture you're going to end up with a one sided picture view. And the wrong view. You won't understand e.g. why Israel went into Lebanon if you never heard about the scale of attacks on Israel originating from Lebanon. Israel isn't always right, and ofcourse attacks on innocents are never justified, but those are some small pieces of a big picture, and you're only getting those pieces. From Gaza you are basically getting 100% Hamas controlled views which the media repeats as facts (journalists, doctors, etc.). When media talks about Palestinians in the west bank it also immediately whitewashes everyone into civilians. In fact there are armed factions operating in the West Bank and a lot of the overall violence (not the settlers vs. random innocent) is towards dismantling those.
Here's some actual data, human rights index: https://ourworldindata.org/grapher/human-rights-index-vdem?t...
Worst ten:
North Korea 0.08 0.02 -0.06 -71%
Afghanistan 0.12 0.04 -0.08 -67%
Eritrea 0.05
Nicaragua 0.08
Myanmar 0.10
Turkmenistan 0.11
Laos 0.16 0.14 -0.02 -9%
Palestine/Gaza 0.17
Tajikistan 0.17
Equatorial Guinea 0.17
But haters will hate.
Because morality is a numbers game?
If Israel nuked everyone but one of their enemies, would they be in the right, as then they would have only one enemy?
Depends. Their current friend will most likely become their enemy by then too.
TBH, considering the number of dead in palestine and the number of people in europe/us who literally lost everyone who ever mattered to them, the number of "terrorist" attacks seems relatively low.
If your point is the world is unfair, then yes obviously that is true, nobody disputes that.
But hey, having your capital cities bombed is expensive, transport is cheap, and so it's easier to bully countries in a different continent, eventually bomb and invade them, becuase you're pretty sure they won't be able reach you back home with conventional war means (planes, rockets, tanks,...).
And yes, it's relevant, some politicians in one of those "safe" countries decided to bomb some country in a different continent, and you, a normal football fan or a party goer get killed when those people come and fight back in "unconventional means" (eg 2015 in paris). Somehow no one treats those as "we're at war with them, we bombed them first, they're just fighting back".
Wat.
Sure, maybe if NATO stopped the USSR in the Fulda Gap. But you know that the USSR's war plans definitely involved invading France, right?
And don't make the mistake of judging probability with the benefit of hindsight, that'd be a terrible intellectual tarpit to fall into.
- Compulsory military service means the government captures the best and brightest of the country.
- An extraordinarily outsized number of nobel prizes belong to Ashkenazi Jews, and other indicators of intelligence (lack of propensity for violent crime, lifetime earnings, etc) are also quite high for the whole group.
That we don't hear about it more often seems to me that nations that develop this stuff seem to have gotten better in making malware more precise in what they target and less leaky to the general population, but it could also be that media just don't report about it as much. When a gangs anonymous chat get hacked, or a tor hidden service website get taken down, news seems more interested in talking about the crime than what security vulnerability that the police used.
Unit 8200 [1]. Also, Israel doesn't extradite its own citizens and seems to turn a blind eye to criminals doing nonsense abroad. (Similar to Russia and China.)
"Unit 8200 was established in 1952," and apparently the Technion – Israel Institute of Technology was founded in 1912 [2]. I don't think Israel became a tech centre until the 1980s or 90s.
I'm not an expert on this. But similar to how military spending created Silicon Valley, I think Israeli military structure created its tech industry.
[1] Wikipedia
[2] https://ats.org/explore/videos/1912-today-the-institution-th...
That is why both Apple & Samsung have malware from Israel on their phones. The USA has the NSA building and exploiting products for surveillance and penetration globally.
Netanyahu recently was on a US broadcast, he held up a phone and stated to the reporter interviewing him, that Israel can penetrate any device obtaining it contents and then blackmail or discredit the owner of said device.
The USA now examines phones at airports to see if people are saying things the current administration doesn’t like.
American money, tech and intel, plus they are vastly overstaffed for the size of territory they want to defend.
The wig fallacy is in full effect here.
Look to the Netherlands, UK, Scandinavia and others for governments who aren’t getting caught doing this.
- The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.
- To the point below that "ad providers should be held responsible." There is no such thing as "ad provider." The AdTech ecosystem is teeming with different niches and business models - see the famous LUMAscapes diagrams: https://lumapartners.com/lumascapes/ . The sheer volume of traffic makes it virtually impossible to vet even a fraction of it. Google has thrown a lot of compute power to pre-scan 3p creatives and even then bad actors can sneak through. Add to this a lot of sophistication on their side (from different landing pages based on the perception of the type of user to farming throw-away advertiser accounts aimed at running just one campaign like that to hijacking legit accounts through sophisticated technical and people engineering means). In the end, politicians full of indignation do what politicians always do - sue or fine Google and call it a victory, whereas the true bad actors just keep going.
So, it’s definitely possible, especially with human review and static ads. No code. It might not be possible at scale. To me, that’s just not an excuse. If you can’t do something safely at scale, then you shouldn’t. If that means generalized online ads can’t exist then… so be it.
Online ads are definitely still possible. For example, im sure Disney reviews and approves all ads that run on Disney plus. So just do that, and if you can’t do that for e.g. YouTube then dont.
I think your answer gives us a clue about what went wrong and where.
The fact that internet advertising is run by the big US tech behemoths, makes them difficult to go after by countries that have previously had sane advertising standards. The lack of US regulation is the winning car in the race to the bottom.
That's the first point. Now, who should be responsible for getting the ads? The website? That will absolutely kill the monetization model and it is simply unrealistic. Which means, that responsibility now should be pinned on someone else. Who would that be? My point being that no one there has an inherent lawful obligation to provide such vetting, which would be a) costly and b) only applicable to one player (out of many).
And then we get to bad actors. If I were a really motivated bad actor as early as in 2005, I was serving different creatives and different landing pages to different audiences - a perfectly well-behaved ones to Google's crawlers (again, Google does A LOT to fight malware), a questionable quality clicky ones to general audiences and maybe malware-ridden ones to specifically targeted audiences. And you would not be able to catch me in real time - only after the fact, once the campaign was run and someone looked at the evidence (assuming it was collected, which it isn't normally)
There is no universe in which 'gosh it's just too hard' is the correct answer.
I'm assuming that means ad impressions and not unique ads.
And again, we are talking about logical creative (the actual visible part). Click URLs and such will definitely be different.
Perhaps the actual problem then are these monolith platforms that have done such a good job "eating the world" that they can no longer properly function.
I'm critically uninterested in the fictions of the business idiot class. I'm sure for many purposes it's important for all the papers to have the proper LLC's on them. For the purpose of burning it to the ground though, it's not overly important.
They 'solved scale' for being able to profit from it though.
The Web used to be a great place before surveillance capitalism and adtech took over. Some of us remember it. People participated because they wanted to. People contributed content because they enjoyed it. The incentive was a sense of community and contribution and shared knowledge - and usually there was no expectation of direct financial gain. Basic hosting was included in everyone's normal ISP plan. SEO wasn't a thing. Blogspam just to generate pages to host ads wasn't a thing. AI slop just to generate even more pages to host ads wasn't a thing. And there was still more genuine and worthwhile content out there than anyone could read in a lifetime.
If 95% of the modern Web disappeared tomorrow and all that was left was what people or organisations were still willing to contribute because they enjoyed it and/or it provided some direct benefit then the Web would probably be a much better place. I cite as exhibit A the fact that we're all here posting our thoughts on HN - itself a site that has always run without any of the intrusive advertising we're talking about - without any compensation or reward other than the enjoyment of the discussion and perhaps the chance to learn something new.
I see no reason to tolerate any sort of online advertising that conflicts with the above ideals. We should simply set rules that decide what is acceptable and drop legal nukes on any company - or indeed any entire business model or industry - that fails to comply. Low key advertising for YC's next round? I doubt a single contributor here minds the little banner that pops up at certain times of year. In-your-face auto-play videos that accidentally (or not - it doesn't matter) advertise something dangerous before your kid's favourite show plays? Sue everyone and punish the offending businesses without mercy. It's really not that complicated.
Continued lack of regulation, throwing up ones hands and saying "well, it's too big now" will not allow it to be solved.
What has been 'normalised' in the online advertising industry sets my teeth on edge as someone with some amount of security and privacy awareness. Hence I go out of my way to block as much of it as possible, for myself and family and friends.
Even the FBI and NSA make public their recommendation to run ad blockers as a safety requirement for internet browsing. I would have thought this may be some kind of red flag to say that maybe you're doing something not quite as well as would be satisfactory.
We can just decide that if you can't afford a person to vet the ad, it's not allowed to run.
Yes. That will destroy the current online advertising industry. As tempting as it is to say "that's the point", that is in fact not the point. The point is, we are completely in our rights as a society to say through regulation that if you can't vet an ad with a human, you can't run it, and the capital structure can damned well do what it does best and accommodate that whether they like it or not. We absolutely can write laws that say that Google is to some extent directly liable for the ads they run. Nothing is stopping us, at least in principle.
Does that mean it will be a lot harder for the advertising industry? Yes. So be it. That is not a reason this can't happen. Is it expensive for them? Yes. I don't care that this means that they won't be able to run anywhere near as many ads.
It is not a stopper that it would be really hard for them. It should be harder than it is. It should not be profitable to build a vast surveillance apparatus to squeeze literal fractions of a penny at a time out of us. It should not be profitable to have this massive machine that can push such targeted malware at as.
We're not talking about some minor tweaks that they can toss a few AI tokens at. We're talking about regulation that would rewrite the entire social contract of advertising. A social contract that we have not really signed, either individually or collectively. We can do that. We can rewrite the contract. It's a permissible thing.
We don't have to have a massive surveillance state just to serve us ads. We don't have to have sports gambling advertising on television. We don't have to have billboards on our highways. We don't have to have extra-cheap mailing rates for ads. We don't have to have Roblox and other video game systems exploiting our children's psychologies with deceptive game currency practices and gambling mechanics. We don't have to have state-sponsored gambling running what everyone knows is a backdoor tax on the poor. None of these things are physically inevitable. None of these things are socially inevitable. There are reasons why these things do exist, which economists and game theorists and political theorists have various words for, but none of the reasons are because they are mandatory and we're just stuck with them forever because there are no other possible worlds.
Which you can absolutely do, when you are Disney (read, agencies fight to run a campaign with you). When you are, let's say, TechCrunch, the situation changes - you can still strike some deals but a lot of your demand is not the same grade.
They're pointing out the article lacks substance implied by its title, and essentially that it would be nice to see the actual bad actors being prosecuted instead of the middleman. Both positive things to hear for me? Who cares if they work for the industry.
(The former thing is positive because it saves me time reading the article for information that won't be there.)
To paraphrase Churchill, it is a terrible model but others are worse.
If a website serves me malware, the website's owner should be liable to me. They may then be able to sue someone else, in turn. But I chose to interact with them and then they chose to outsource stuff to crooks.
This would be complicated to implement. But it's absolutely doable.
Then there are all kinds of fun scenarios - from drive-by malware to landing page malware to malware served after clicking an ad ON A LANDING PAGE. Who would assume responsibility for those?
Bottom line, this is not much different from "regular" crime. It happens. Governments employ police and various deterrents to reduce it. But it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness.
My main concern is supply chain attacks. I'm afraid, the frequency and sophistication of such attacks will only increase, thanks to really powerful LLMs. From there - to running keyloggers and stealing your bank credentials etc.
When I worked at an adtech company almost ten years ago, this sort of shit was the exact concern of me and my colleagues. We've had time to do better but guess we're just fucked.
"But not because of <industry I am employed by>"
As for the ad provider, it is trivial to not deliver criminal payloads if your business starts from the assumption that doing so is costly instead of something you can foist on society for your own benefit.
Why? An insurance product wouldn't wipe out ad revenues.
> this is not much different from "regular" crime. It happens
Why do you think parking lots have signs that say they aren't responsible for goods stolen out of cars parked there? Because that liability, by default, exists. And if a parking lot is a robbery hotspot, and the owners don't bother putting up cameras or whatnot, they'll absolutely start facing lawsuits and investigations.
> it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness
Nobody argued as much. That doesn't mean we give negligent actors monetizing malware a free pass.
Exactly. It moves the economic incentives from "serve the ads from the highest bidder and turn a blind eye to the fact that that's a scammer/malware" to "drop an ad platform that can't or won't keep the scammers/malware out".
Or even better, refusing to use ad platforms that let the ads serve arbitrary code. There is no strict reason why an ad can't be an image (re-rendered by the platform) and a link. Slapping scripts all over the place just makes it easier to collect data (among other things to verify that all the companies involved in serving your ad aren't cheating you, because the ecosystem is full of scammers in all directions).
The deterrent here would be prosecuting the accomplices involved in, and directly getting paid for, the crime.
How can you exercise situational awareness against a zero-day attack?
There are several parties who have an opportunity to detect that problem before it causes serious damage to people visiting a website. The visitors themselves are not among them. Trying to make those visitors responsible for the consequences is nonsensical.
And this would motivate fundamental change in the industry to be able to track down the bad actors.
KYC exists for various industries in order to track down the person responsible for bad actions. Implement KYC for the advertising chain, or something equivalent, to ensure there's a validly registered sue-able entity at the end of it.
> be mindful and exercise situational awareness
I'm not going to say victim blaming, but a good percentage of the population just aren't capable of this, especially with "the sheer scale" of advertising they're exposed to. It's exhausting to be on guard for the entirety of your life.
Might as well say: don't use the internet. That might actually be the best advice to come from all this.
The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited. The step-by-step info graphic in the article literally skips over how the infection actually occurs.
No, it doesn't. Your company is too much of a cheap fuck to do it and would rather offload that cost on society, no matter how bad the effects of it is.
>There is no such thing as "ad provider."
Only when it's to your advantage, because you're very happy to refer to yourself as an ad provider in every single marketing piece.
>AdTech engineer here (some 13 years in the industry)
You've made the world miserable for the past 13 years and have the gall to come over and pretend you're a poor innocent little thing who can't do nothing UwU there's just too much how could we be held responsible.
It’s a choice, and on the other side of that choice is profit.
I also have a choice. I choose to filter out as many ads I can. That is my vetting process.
How do you even plan to explain it to your grand-children?
But sure, "free content cos adverts", you keep believing that for as long as you can, I jumped ship after 13 years of it, which ironically appears to be how long you've been in the industry.
Let me just say though - adverts can still support free content without all the absolutely scummy things the adtech industry does. You don't have to track users across everything you can possibly track them across to still make money - my former company at one point was going to partner with Shazam to track people via transponders in bus-stop / train station billboards.
That's not "supporting the free Internet", that's "making some amoral shareholders richer".
Hopefully you'll figure out the difference with a few more years under your belt.
If anything, the ad industry helps kill honest contributions because they financially reward dishonest ones who are better at playing the SEO game or other such tactics than they are at giving visitors what they are actually looking for.
And at the end of the day, ad-supported content isn't free at all because we all pay for it in the end - and much more than what the website receives because there are entire industries inbetween that take their cut.
After all, this website doesn't have (traditional) ads
Their argument was often that the complexities and volume of data, messages, devices just made it impossible for them to help law enforcement even when justified. Almost as if they were apologetic -- they simply cannot help!
But I was in a room once with a very senior police official, prosecutor and several telco reps when the simple question was asked: why is it not impossible then also to do billing?
Every time the conversation moved away from this point, it was forced to return by the non telco members: they knew it would cost money for the telco to help. And any argument against that was simply foregoing that cost at the expense of the safety or well-being of the public, and was unacceptable.
You may feel (in my example) their are many arguments against state surveillance, but the core truth is that all of these ad providers could indeed have systems that at least attempt to prevent this kind of activity -- it would just reduce profits to do so.
Lastly on the zero click lack of detail: it's kind of irrelevant. The exploit might be complicated, but the vector is clear -- the ad network.
It read to me like it was assumed to be using OS/browser/application-level exploits to get further access to target devices. I suspect the CitizenLab report is light on details in particular because they don't actually know them:
> In most cases, the user who sees the ad is not selected for targeting, and the server will not return any JavaScript to be executed.
> A large number of ads placed by Discover-Tech contain a script tag pointing back to what the company refers to as a “NOAS server” (also called a “getAd server”). This tag causes the ad, when rendered, to connect back to Discover-Tech, submit advertising identifiers for the user (either a cookie ID or a mobile ad ID), and automatically execute any JavaScript code returned. The NOAS server decides, apparently based on a combination of the source IP address and the advertising identifiers, whether the target is eligible to receive any JavaScript. If so, then code is returned. If not, a 0-byte response is returned. The NOAS server is a key part of Discover-Tech’s strategy, allowing Discover-Tech to avoid directly sharing malicious code, or even pointers to malicious code, with the companies who serve and display the ads.
It would break the long tail of the ad ecosystem, but a bunch of people think the tradeoff is fine.
Given how much of online advertising is now in walled gardens rather than display ads, I think this shows this is more doable than the people who are part of the open ecosystem want it to be.
Ads drive the internet. Sorry, but it's true. And you, the technical people, have no real idea of the scale. I don't like ads, but was amused when I had to turn off all my blockers to get stuff done. Many people in the adops world dislike ads, but money.
The point he's making is simple: the ad networks are not responsible for the ad payload. And you might argue the point, but your arguments are worthless. Even finding the entity responsible for the payload will be difficult, and they're probably overseas. Are you going to sue them? No, you're not. Can you actually prove damages, even if you did decide to sue? Probably not.
The structure in the article sounds nefarious, but it's literally the adtech stack. The only thing the company must be doing that's abnormal is tracking all the users in one specific IP range and associating it was a company, likely with their emails. I never touched the targeting section of the stack, but I presume that's possible but not "normal."
But they did explain some of the infection nonetheless. A COM exploit on Windows for one.
Browsers are pretty well insulated from arbitrary code execution on the host machine, but I bet android has more vulnerabilities. It wasn't long ago that the webp zero day could pwn anyones device who just looked at an infected webp. (Also Israeli spyware, I believe). Similarily, if Windows apps have ad banners, there could be zero days there as well.
The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited.
Though, there is a browser patch for this, don't advertise so much identifiable information that an advertiser can identify a user or their employer. That's the defense, but it'll never happen.
Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
From being hacked by others. Google was just trying to protect their property, which is the ability to spy on their users' every move. Google themselves really don't need to "hack" their users for that, they already have all the access and all the data they could ever want. And they also have the ability to brick their users' devices at a moment's notice the same as Apple does.
Totally not useless. It costs a lot more to pay a spyware firm then to have an employee send an email / ask a judge (like that's even necessary).
I feel quite confident of my messages privacy on my Pixel with GrapheneOS given most people I message are on iPhones which are second in security to Pixels running GrapheneOS. Not to mention my threat model doesn't include mercenary spyware, as most people's doesn't.
If you're talking about the sideloading restrictions those were intended to stop social engineering and scams, not from getting hacked via 0days.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Source? play services is privileged but not that privileged.
No, those restrictions were intended to keep Android users in the playstore ghetto (which is suffed to the gills with scams.)
In fact, following the OP's link to https://citizenlab.ca/research/how-discover-tech-turned-targ..., "the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries" so it's not just apps but ordinary websites you visit in your android chrome browser.
No info on if a recent version patches this?
It also mentions a "Windows DLL" - so they're somehow infecting Windows desktop too?
It is no different that Israel's location tracking of StarLink terminals worldwide: https://www.newarab.com/news/israel-tech-firms-can-locate-an...
This is the same issue that the US government has with Chinese networking companies, it is too easy for the Chinese government to pressure these Chinese networking companies to put in back doors in the interests of national security. The US likely knows this because it pressures its own companies in similar ways.
I think the only technical solution available to individuals is to boycott non-verifiably e2ee services and corporate operating systems (especially including android).
just to confirm your info... https://buenosairesherald.com/society/argentine-teenager-pla...
If you put out a fire how many are you allowed to set while people applaud selectively?
I don’t think they’re striking a good balance between how invasive they are compared to the real results they deliver.
If the world moved that way overnight, I wonder where digital spy budgets would go. Into traditional techniques, cracking encryption, banning encryption, or a more educated guess?
In addition Israel is an apartheid state with many undemocratic features:
https://static1.squarespace.com/static/66a134337e960f229da81...
America was a democracy while we were exterminating our native population. Democracy is a system of government. Voters can democratically vote for terrible things.
Israeli Arabs are allowed to vote.
> Israel is an apartheid state
This is a valid argument, though still stretched–America didn't cease to be a democracy while we occupied Germany and Japan.
> America was a democracy while we were exterminating our native population.
I would argue that it was not for the very same reasons (and of course there were many other classes not allowed to vote at the time). Killing someone robs them of their right to vote.
Sure. But this also describes a lot of well-accepted democracies' histories.
Perhaps you're thinking of a liberal democracy?
> would argue that it was not
Sure, according to a personal definition that countries cease to be democracies any time they go to war (or more narrowly, commit war crimes), Israel is not a democracy...
> there were many other classes not allowed to vote at the time
Most democracies also prohibit children and non-citizens from voting. The term you may be looking for is full democracy. And I think most people and experts agree Israel is not a full democracy [1].
[1] https://en.wikipedia.org/wiki/The_Economist_Democracy_Index
I mean we're talking about all Black people, Indigenous people and women! I think arguing semantics isn't helpful.
Israel is an illegitimate state practicing crimes against humanity. That some of the colonizers can vote isn't really relevant. I actually think this can help us reflect on the true nature of the US as well and push for things like land back to Indigenous people and reparations for Black people.
Yes. Athens was similar–a minority of the population could vote. It was a deeply flawed democracy, but a democracy nonetheless.
> That some of the colonizers can vote isn't really relevant
Literally America! Also all of Europe depending on when you draw the line. Also all of the Middle East for the same reason. (Also most extant Native American tribes.) Hell, even in Palestine we can only say more than 50% of the population traces from Bronze-Age heritage.
By your definition, democracy does not exist and cannot exist in most parts of the world.
> this can help us reflect on the true nature of the US
It really can't if we're redefining precedented terms. America, like Israel, is a flawed democracy.
In the case of Israel these 'non-citizens' are under brutal military occupation where each day Israel steals more and more of their land. There's no 'home country' they could return to because Israel is occupying it. They're not illegal immigrants. They ARE home and yet being treated by Israel like invaders.
Which is illiberal and flawed. It doesn't mean Israeli citizens don't democratically choose their leaders.
Note that this cuts both ways. If Israel isn't a democracy, the Israeli people have no moral culpability in their state's actions because we have no way of knowing if they actually support it.
> There's no 'home country' they could return to because Israel is occupying it
Agree this is tragic. But again, historically not unique. Displaced people have existed across the history of democracy.
Something being wrong doesn't automatically make it all kinds of wrong. Israel illegally occupying the West Bank and Gaza and having unresolved reparations around the Nakba doesn't have much relevance to whether it's a democracy. Just whether it's a liberal or full one. (Among all of the other issues.)
Democracy doesn't mean voters can't choose to be awful.
I am happy to call Israel an ethno-supremacist, apartheid democracy if you want.
> Agree this is tragic. But again, historically not unique.
Sure, the Holocaust was 'historically not unique' too. Aren't we meant to be moving forward as humanity? Slavery was legal for most of history too.
The Palestinians don't have any moral culpability in their own genocide and ethnic cleansing. That's the point, they can't vote on their own land.
What it has to do with Israel?
Seriously, are you older than 5?
I can’t really have a conversation with someone who doesn’t know the history of Palestine. I suggest starting with the basics if you’re honest about wanting to know more:
You really don't know history, the Germans lived there hundreds of years.
You are really 5 years old. Aren't you?
Can we get an alien invasion already please, god
Absolute morons.
Exploding pagers. Israel literally killed people with consumer tech.
They use this software to find and kill people. Which they then publicly brag about. How much more hostile do you want to be?
There is no limit. The request is not coming from genuine curiosity — they are asking for a stricter definition so that they can attack any one that you provide, no matter how sensible. The befuddlement is deliberate.
EDIT: I looked at your comment history and it's full of snarky comments like the one you made here. You're either trolling or you lack a serious self-awareness in your contributions to this platform. Maybe time to step back and examine if it's worth even being on here if you can't control your emotions and have a civil conversation instead of these virtual drive-by shootings where you don't even engage with the actual person you're commenting about. This is not Reddit.
If I was to say which countries do the most to restrict digital freedom, I'd say look at this table: https://eylenburg.github.io/countries.htm
If I was to say what companies have done the most to take the most privacy from the most people, it would be American big tech like Google and Meta.
There's some okayish software from Israel I can think of, like Zcash.
These Israeli ones are literal criminal companies. What Meta does should be illegal. Both are immoral.
A single spyware against a journalist is much worse than a single Facebook user, but for the total impact on society, they both destroy democracy and human rights significantly.
>I would sooner trust a Chinese company than an Israeli company
As for trust, with privacy I'm a big proponent of avoiding it. Use E2EE or self host if you have to. The country does not matter so much.
We all end up running closed source code somewhere
If you do you'll be much better off avoiding Israeli tech
As a rule if you boycott everything Israeli it'll be smarter, more ethical, and safer
Israel has openly and publicly threatened western politicians and citizens that don't aid their agenda however, many times. Like Russia, they have also shot down commercial airliners.
Unlike Russia, they have killed American sailors whilst directly attacking American naval assets.
Vote me down all you want for saying something about Israel that's not super negative, but it's not a "which country do I dislike most" competition when it comes to facts.
Also, meta discussion about down votes is against him policy, yet magically you're exempt, typical of **
Israel being a (disfunctional and rather illiberal at this point) democracy, means it's much better for it's own citizens (excluding Arabs ofc), but says nothing about the people outside. Same for the US BTW.
Israel still have the reputation of being part of the ‘free world’ in the collective mind.
that is more dangerous.
At this point, I don’t agree. I’m an immigrant living in the US currently. From an infosec and real-world consequences perspective, I have much less reason to fear what the Chinese government or corporations could do with my information than what either the current US government or its major tech corporations might do.
> Israel still have the reputation of being part of the ‘free world’ in the collective mind.
That collective mind is cognitively challenged and extremely ignorant, but it doesn’t mean I have to be.
seems to me like lots of people are wary of ever criticizing or changing their mind about Israel, because their population once was the target of arguably the most heinous genocide in history, so far, which i'm of course very sorry for. must've caused some heavy, multi-generational trauma, other than that i can't explain why they're acting the way they do. don't make the mistake of translating official government statements or looking at population surveys, truly horrific, barbaric stuff. but of course the only terrorists in all of this are their neighbors which they keep in open-air prisons they at this point have bombed to rubble.
us, the general public, is more or less atomized and the whole idea of it existing, but having an opinion outside "those who know" is precisely the way they manufacture it, thus people may believe all they want, but think that it is common knowledge that Israel can commit crimes due to victimhood in the past etc - nobody needs to believe this, only to think that others do
Today, I saw an American news reporter got beaten up on the ground by 50 Israeli colonists.
That fact alone would get media, government most us citizens angry with pitch forks.
There is some very strong lobbying at multiple levels.
If I were engaged in anything hostile to Israel I utterly would not trust Israeli stuff. But Israel is normally quite careful about target selection, if I was not engaged in anything hostile to Israel I would expect anything they slip in to be secure and to not do any harm beyond it's existence. A scene from Lebanon not too long ago makes it very clear: A whole bunch of people milling about, setting up for selfies and the like--then we see the building behind destroyed by an airstrike. Clearly all those people around knew the building was going to be destroyed and they trusted Israeli accuracy enough to be standing not too far from where the bomb would land.
China, though, I would utterly not trust target selection or security against misuse.
I guess that your concerns are not aligned with reality, or the benefits far outweigh whatever it is you think may happen.
(Talking as an Israeli working in cybersecurity)
It's possible for this to be true, and that they spy on said companies on behalf of the government of Israel. It makes it easier to do so.
Do we have evidence this is a state operation versus a criminal group?
* The state of Israel does authorize spyware sales (eg NSO Group has to get a license from the Ministry of Defense, and Israel's Defense Export Control Agency states that its decisions take national security / foreign policy into account).
* In the case of Pegasus, NYT had reported that Netanyahu intervened to make an exception allowing sale of Pegasus to Saudi Arabia (as political leverage). NSO group execs used Israeli diplomatic passports when they traveled and stayed at the Israeli embassy.
* The government doesn't crack down on these industries, which it would do if it really considered them criminal.
* In this particular case, one of the main targets was Al Jazeera, which seems unlikely that a criminal company would want to target vs. a state actor.
So yea, the government seems to allow these companies to engage in what other countries would consider criminal activity. You can then kind of choose your spot on the spectrum of: "I think this is some broad conspiracy the government purposefully designed for large-scale espionage" or just "The Israeli government thinks it would be good to have great cybersecurity skills in the country so they bend the rules a little".
A good well-researched read is The Palestine Laboratory by Antony Loewenstein.
It’s to do with hiding malware/spyware in an image which ends up in your cache on device. I can’t go much further into details but all this takes is for you to visit a site that serves it via ad network.
Israel has been known to have some sneaky spyware in the past with Pegasus.
Article on the CitizenLab website: https://citizenlab.ca/research/how-discover-tech-turned-targ...
I think lots of it has to do with how well the hasbara covers up the scandals from the wider publics perception, combined with the cultural bandwagon of considering them an ally even when their repeated actions say otherwise.
edit: also the idea that they have such good tech and its a pragmatic decision ignores the history of how and who they got it from and the intentions for it. I say this as someone who worked directly with Mellanox for example, before aquisition by Nvidia... I always thought kernel level shims for networking stacks from an Israeli company was dangerous... but the speeds!!!
- It came in through the front door. Discover-Tech ran its own ad-buying platform and was listed as a "certified" vendor by Google and IAB Europe for six years. Nothing was hacked to get in. It bid in ad auctions like any other buyer.
- The ads looked harmless. Plain banners for games, AliExpress deals and an IP-lookup site. Hidden inside each one was a small script that quietly phoned home when the ad loaded.
- Everyone who saw an ad was profiled. The script collected device details, IP addresses and, on many sites, the publisher's own cookies, sometimes including logged-in session tokens. Cookie-syncing with other ad networks built a huge identity graph.
- Only chosen targets got the payload. A gatekeeper server checked each device's ad ID and IP. Most people got nothing back. A selected target got code that handed them off to spyware maker Candiru, and the code was served only once, which made it very hard for researchers to capture.
- The handoff was built to defeat inspection. Encrypted channels, rotating hosting, anti-bot checks and even a fake "Copyright Google" comment to fool human reviewers.
- It worked. At least 45 devices at Al Jazeera were targeted, and spyware was recovered from an infected machine. Its ads also appeared on networks belonging to NATO, the UN, the European Parliament, the ICC and various defence ministries.
- The scale was huge. Billions of bids and ads in nearly 200,000 apps and websites, including Duolingo, Viber, Yahoo Mail, dating apps and period trackers, yet almost no sign of real advertisers or revenue.
Citizen Lab: https://citizenlab.ca/research/how-discover-tech-turned-targ...
Confiant: https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zer...
Citizen Lab also has a shorter executive summary: https://citizenlab.ca/research/exposing-adfection-executive-...
Edit:
the TFA answers: "Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user." Its wild! I thought the ads are sanitized, go through a CDR of sorts, and whatever javascript is permitted is authored by ad networks, not the buyers. Sheesh. Thats just RCE.
RTB (real-time bidding) does not incentivise publishers to care about what ads are actually being shown to individual users, so long as CPM is maximised.
> Don't post generated text or AI-edited text. HN is for conversation between humans.
Then the ad network delivers a targeted ad that exploits a vulnerability (eg a broken JPEG decoder that, when sent a bad image, allows to run arbitrary code on your machine), and from there you have access to the computer
Then also mandatory pi-hole on every house.
Even if you are used by Windows OS, you must use an adblocker. Even if you use Chrome. On every browser.
I've witnessed consumer apps throwing quite heinous malware/sketchware advertisements and watched the banners rotate between 4-5 different ad vendors to keep things hot and spicy.
A regulation here that applies to all app stores is even business friendly as an appstore which wanted to do this already wouldn’t be punished by trying to do this on their own, for the reasons you mentioned.
Streaming services used to be bad enough with ads in the shows, now they put an ad on the screen when you pause it. Peacock just started putting ads in the login screen.
If we don't stop this, pretty soon they're going to have ads in the stars as satellite constellations arrange themselves to sell you Twitter subscriptions. They're not going to stop even when there's an ad no matter where you look.
I'm reminded of the ending of the 2008 film Hancock in which Hancock defaced the moon with a corporate logo. But it was okay because it was "for a good cause".
Putting a static, printed poster on a wall is in no way analogous to surveillance.
The ad-tech network probably does make it easier, because any page that includes their ad network could deliver the malicious ad.
How is this acceptable for society goes beyond me. And then corporations blame individuals when they get scammed. It is your fault that we have all your information and leak it everywhere, when it is not just directly sold.
And add jail time to fines. Fines means nothing for the rich.
People in the US have a unique window of opportunity starting TODAY (Oct 2026) in many places with early voting. I implore everyone who is able to vote in the midterms to do so.
What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).
If they win the landscape will change. It would set a precedent for civil liability for infecting your users even when it's not your content directly. That would likely spook the shit out of the market, security becomes a feature.
Attacking a single website does nothing. If you bankrupt the site, there are millions more sites. If you attack the ad provider, bankrupting it, and shutting it down, millions of sites are now protected.
Your logic just doesn't compute
I think you're also confusing multiple malicious activities occurring on the web. Data harvesting is another thing that needs to be banned into oblivion. Rarely are sites doing that natively. It is being done as a second part of service the site wants. A site/app wants naturally wants to seen analytics about how visitors are using the site/app, so they include some third party tool that provides that data to an extent at the cost of collecting/keeping that data for their own use. Want to make it easy for users to interact with social platforms regarding your site/app, they now get to collect/keep that data. That's a different thing than being served malicious ads.
"I'll pay you if you run this software on your visitors' computers without asking questions" is not a "service" you sign up for. People don't pay you as a service. That's about as shady a deal as it sounds.
It's fully possible to individually negotiate with someone that wants to publish an ad on your site. If you choose to take money from literally anyone who wants to do so, then why would you not be accountable when they inevitably use you to target users for fraud? You chose to take their money and not even look at what you were publishing.
Sure it did. The content coming from elsewhere doesn’t change their decision to include it when the user loads their page.
It just makes the decision wildly important.
This is no different than the “I’m too big, can’t tell what my subsidiaries are doing!” wink
Pay attention, do due diligence to do things correctly, or don’t do them.
It shouldn't fall on the person just going to a website to track down the vendors and third parties the website contracts with.
The ad platform that allows malware to be served to anyone is at fault.
As is the individual website that has selected to allow a 3rd party's code to be delivered to your machine without controlling that risk, often for very silly reasons.
Laughable. As countless class action lawsuits have demonstrated the victims are never made whole (https://instituteforlegalreform.com/wp-content/uploads/2020/...), the criminals get a slap on the wrist fine that is a tiny fraction of the profit they made doing crime, and the lawyers walk away with pockets filled with cash while nothing changes. (https://link.springer.com/article/10.1007/s10611-024-10170-w)
Fine's and class action lawsuits don't work. Throw some CEOs in jail and things will actually change.
This mentality of "it's to hard" doesn't get things done.
I do agree that some greedy lawyers and civil liability would solve this, but that's not a long term solution at all.
So you search for company A wanting to buy their product. You check out. Basically every setup I've audited has every tracking product ever for everything.
So you buy X, and the company sends that purchase event with your information to Meta, Google, TikTok, Applovin, Klaviyo, and 10 others.
This idea is hopelessly entrenched in every marketing department, who has leadership's ear: We HAVE to send EVERYTHING to EVERYONE otherwise our ROAS will go DOWN!
Every platform works this way, they're all set up to put giant red banners on your marketer's dashboards
"You could be getting 50% better results if you sent <customer_2nd_grade_report_card>!"
Too bad no one has the guts to enforce the law that way.
The main problem is that the exploits from js to code execution or data exfil are possible in the first place. The issue is that you have JS, which is generally pretty isolated, able to talk to bundled libraries (like libwebrtc), which often contain the exploits and share the same memory space. There needs to be a intermediate layer between JS talking to any such library, like process isolation with IPC for communication.
Easy, when your society glorifies and deifies greed, you can excuse literally any act so long as it makes enough money.
That's it. That's the entire explanation. It's capitalism and greed.
Not quite. Most people in society are completely oblivious to this happening. And their lack of awareness is why the exploiters don't face more public opposition.
This, pretty much. Money removes consequence form your actions. If every time you screwed up, instead of being fined you had to wear a silly hat, go on TV and apologize, or get some time behind bars, even if it were 1 or 2 days it would be very effective.
It’s a low-hanging fruit that has high value, particularly for less savvy internet users. Scams have always been the biggest threat. I’d say the majority of internet ads are scams, and the platforms often don’t make it clear what is or is not an ad.
But, we always knew the risk of malware was there. In the modern age, ads are basically never delivered as static assets. They’re delivered as small applications, with code. So, we’re relying on our sandboxing mechanics to work perfectly, and predictably they don’t. The solution is to block the code altogether; to block ads.
You should threat model, but if you want to maximally protect yourself, use Vanadium or Brave Browser and GrapheneOS and no privacy invasive apps.
The CTO happens to have worked for Radware
https://www.innovid.com/about-us/news/mediaocean-completes-a...
But there is nothing explaining how the DLL becomes zero-click compromised by the ad.
No, their attribution is much more robust than this. Neglecting those details to oversimplify your explanation is intellectually dishonest.
> there is nothing explaining how the DLL becomes zero-click compromised [...]
They do, just a little later in that same section: "Both samples use a COM hijack for persistence [...]" through a malicious DLL.
I completely and fundamentally disagree that there is such a robust attribution. I read the section thoroughly and my explanation is not at all oversimplified. Please cite the details that you believe to be relevant here.
> They do, just a little later in that same section: "Both samples use a COM hijack for persistence [...]" through a malicious DLL.
This is not even remotely an explanation of what happened. Giving a name to a phenomenon does not explain it. This does not say how the COM hijack is effected; it does not say how any code escapes the browser sandbox at all; it does not point at a browser vulnerability. Even following through a link to their previous article, the only CVE citations they give are for local privilege escalations (which are described in a very generic way in the CVE database) which would still require a sandbox escape. And even then, it isn't necessarily relevant, as they merely claim "The functionality broadly overlaps with the functionality of the Candiru chain from our 2021 report."
and they’re just as troublesome as they were before,
to the degree they’re provably being used to decide who to send malicious payloads to…
Zero-click simply highlights if the user needs to actively interact with an element to get a malicious payload - or not.
This did get me interested in the specifics of the payload, though:
“It maintains persistence via COM hijacking by overwriting a legitimate COM class registry key’s DLL path with a first-stage DLL dropped in C:\Windows\system32\IME\, and it stores encrypted second-stage payloads in the configuration directory. A signed third-party driver (physmem.sys) enables kernel-level memory access and API call proxying to avoid detection. To preserve system stability, DevilsTongue reinjects the original COM DLL during hijacking, disguising this action through shellcode manipulation of the LoadLibraryExW return value. All additional payloads are decrypted and executed only in memory, allowing the malware to steal credentials from LSASS and browsers, access Signal messages, and use browser cookies to impersonate victims on platforms like Facebook, Gmail, and VK. The malware’s use of scrubbed metadata, encryption, and unique hashes for each file further complicates detection and analysis.”
from https://www.recordedfuture.com/research/tracking-candirus-de...
Memory safety, and a number of other glaring holes in common stacks, are ignored by the general public for the same psychological and effort-related reasons that people secure their whole lives with easily-picked Schlage locks, or windows/doors that can be defeated in under 5 seconds, often silently.
Most genuinely do not or can not believe tragedy can find them - until it has.
I'm not exactly surprised that vulnerabilities like this are possible. I just wanted the details. Thank you. "WebRTC was vulnerable and allowed access to a longer exploit chain" is the important part in my view.
> Memory safety, and a number of other glaring holes in common stacks, are ignored by the general public
I would venture that "the general public" has no concept of "memory safety" in the first place.
All a game, with liabilities abstracted away to customer service and two factor texts.
Maybe Google, Yandex, etc. will decide this is the last straw and finally get serious about filtering malicious ads out of their services. Past history indicates they won't. I feel sorry for anyone who depends on ad revenue, but not sorry enough to expose people I care about to this crap.
As I skimmed the CitizenLab report, it was particularly interesting to see the history of the company and how they may have been acquired specifically to use as a covert operation.
https://404privacy.com/blog/how-israel-used-ad-auctions-to-d...
I am scared for my parents to get exposed to this kind of thing from bad ad network actors. Does anyone have some practical concrete recommendations they took? Like I don't think they can install ublock origin and whitelist sites on demand in Firefox they way I do.
The only practical thing right now is to make sure they don't have the money on device and have 2 fac for email and bank accounts. But every now and then there are phishing attamepts that they could fall prey to.
It's tough. One option is to hope/assume that exploits only compromise user accounts rather than the whole computer.
In that case you can blacklist the banking website from the day-to-day browser as a reminder to switch to the other account, and configure the other account's browser so that it can do little else.
Without an ad blocker, they will be exposed to such an amount of social engineering (ranging from dropshipping sites, to subscription scams, to scam shops that don't ship at all but steal your CC data, to fake sites for government services, to attempts to trick you into installing malware) that you can't expect them to resist it. If installing uBO seems hard, resisting this or cleaning up the consequences is harder.
The amount of "hey have you heard of this great new product I saw" <photo of a handwritten note of the content of a scam site> went down from weekly to near zero once I got a relative to use an ad blocking browser.
Given whom did this attack, I would not be surprised if it was used as intel for strikes on journalists.
There are reliable sources from inside the Israeli Intelligence apparatus that have stated on record that decisions were made to sacrifice 500+ innocent civilians to carry out a strike on one human target. I bet such a strike would be more likely if spyware indicated that one of the innocents was an "enemy" journalist.
In fact, just update the url and title to the report:
How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
https://citizenlab.ca/research/how-discover-tech-turned-targ...
Then you can drastically reduce the mobile in browser block list which helps a lot with battery
> We found two world-readable Apache Druid instances running on Discover-Tech’s website mtrtb[.]com. The druid.mtrtb[.]com endpoint contains bidding data for Discover-Tech’s MyDSP platform
I don't know if an ad blocker protects against Discover-Tech’s Controlium but in general you'd be a fool to allow ads in your browser in at this point. The ad industry is pretty shady all round.
One must wonder how many were genuine vs an influence op.
The whole point of an influence op is to find a bunch of useful idiots to provide a large multiplicative factor.
And that's the problem with arguing that something is an influence op, because it is going to be mostly genuine people by the time it gets to you, even though you're not wrong.
https://www.packetlabs.net/posts/demystifying-the-market-for...
"About: Old programmer Tel Aviv, Israel"
Most of the information coming from Israel about Israel seems unreliable, too.
No, I will never fund TikTok. This article must have struck a nerve with yourself identity. Speaks volumes about your void of humanity.
[0] https://yalebooks.yale.edu/book/9780300253375/culture-in-naz...
Wonder what the world's most boring ideological argument will bring us in the year 3027.
Wild guess even if not in this particular case it's best to consider the possibility as non theoretical.
2) Adblockers
https://news.softpedia.com/news/The-Jester-Presents-Project-...
Back in 2012 The Jester claimed he used targeted spyware to target Mir Islam or Josh the God leader of UGNazi which according to him led to his arrest, though law enforcement never confirmed it.
Interestingly enough they have his laptop he used for a while in a museum.
https://www.spymuseum.org/exhibition-experiences/about-the-c...
Found his blog post about it:
This crap is the worst of the worst.
https://www.innovid.com/about-us/news/mediaocean-completes-a...
Yet we don't sanction Israel nor hold them accountable in any way. Of course they're spying on members of the UN and ICC, of course. Israel is at war with the entire world right now, and my politicians continue to support them. Thankfully many people have woken up, but the situation is dire.
Based on responses from roughly 46,700 people assessing 129 countries, Israel ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
https://www.middleeastmonitor.com/20260513-israel-becomes-wo...
A Discover-Tech ad impression does not in and of itself confirm targeting or infection with spyware.
That might be why the authors, in that disclaimer:
• used "in and of itself" without a footnote
• downplayed "confirm targeting" by sticking "or infection with spyware" into the same sentence.
I will never vote for this particular (D) candidate again. Fortunately, the (L) candidate seems reasonable.
If indeed your representatives support Israel or the genocide in Gaza, I urge you to consider voting 3rd party. In two-party elections, candidates mostly just try to be a little better than their opponent. What forces them to do more isn’t a third party actually winning. It’s a real risk that enough fed-up voters will go third-party and cost them the election. This is basic game theory optimization.
My opinion on web infra patronage has shifted over time, I used to generally accept that for small websites to exist advertising was a necessary evil since they were too niche to have a real revenue source. Then I ran one and I realized that there's far more labor costs involved in maintaining a site than infra costs and that for niche hobbies and communities ten bucks can just find its way into a central pot every month to keep the lights on by those with a bit more to spare.
I am now of the opinion that web communities can survive in the same way arts and other liberal pursuits have always survived. People with a bit more to spare put more into the pot to create the community they want to exist in and "freeloaders" is an alien concept to the genuinely interested since that money is being spent to create a place where meeting can take place without a financial requirement.
And the only 'users' of these websites will be rich people? Because the moment a paywall goes up on a website it becomes unusable for a large portion of the planet.
But that aside, I think what we would see is a lot more Facebookification. A bunch of walled gardens that you pay a subscription for and then you get access to a whole slew of sites that FB buys up. Of course, they will make sure every site ends up toeing their line too.
If you ban online advertising, every publisher you know and like will either exit the market or need to use a paywall (which are famously… popular and successful for niche publishers? No.)
You can call online advertising loathsome if you want (indeed a lot of it sucks - no argument!) but it pays for content that everyone consumes. (Unless you only use HN, which is 99% of the time a collection of links to other sites with ads or paywalls or both.)
Regulate online advertising - fine. But “banning” it (what would that even involve?) is not a serious suggestion.
> If you ban online advertising, every publisher you know and like will either exit the market or need to use a paywall (which are famously… popular and successful for niche publishers? No.)
OK.
It's a fine model so long as you don't need it to scale to one million active users.
* https://citizenlab.ca/research/how-discover-tech-turned-targ...
Hope we follow guidelines under this link or “then nobody gets it!”
Based on responses from roughly 46,700 people assessing 129 countries, X ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
https://www.middleeastmonitor.com/20260513-israel-becomes-wo...
Thanks by the way for introducing me to that graph. I didn't know that anyone collected that kind of stuff.Games are an underrated vector for similar campaigns.
Edit: for the doubters, malware-via-game has already been happening https://www.malwarebytes.com/blog/news/2025/07/steam-games-a...
NK likely also gets a bit of a boost because of the extended length of mandatory service. Males on technical teams have to serve for 13 years.
Russia has historically not had mandatory universal conscription.
A lot of the immediate neighbors attacked Israel at its birth, and further away countries just seem to hate Israel due to religion/ethnicity/populism (?), countries like Pakistan, Malaysia, etc.
That easy huh
She said, "Gary, I saw this very interesting documentary about Hitler's shenanigans." [audience laughter] Shenanigans! [he chuckles] Not even close!
And, as a Jew, I'm obviously not oversensitive, but when people trivialize Hitler's monkey-business... [audience laughter] When the Nazis' hijinks, tomfoolery, and ballyhoo is understated, I feel it does a disservice to the millions who were, ahhh, inconvenienced by Hitler's mischief! [audience laughter]
Tomato, tomahto. Shenanigans, genocide.
(Gary Gulman bit)
funding Israel violates the separation of church and state.
That's not really an accurate characterization of the situation as much of the land was uninhabited/unregistered and/or state owned. The Negev desert for example is a large percentage of the total land area and was effectively uninhabited and not privately owned. Land ownership records at the time were also not particularly clear and often there were disputed claims. Also Israel has about 20% Arab/Palestinian citizens so it's not like they ethnically cleansed everyone like Egypt/Jordan did with the Jews in Gaza and the West Bank when Israel gained independence.
Like immagine if the rhetoric of Turkey was constantly talking about expanding to Greece and how the land of Greece is historically the Turks. Obviously that would make any Greek uneasy.
And the Greeks are historically famous for being quite laissez-faire when it comes to their eastern borders.
You can literally count with both hands the amount of people in Israel that advocate for “greater Israel”
States like Israel formally define their borders via mechanisms like peace deals that include bilateral recognition of agreed upon borders, like Israel has with Egypt and Jordan.
You can't realistically define borders properly otherwise, trying to define borders via unilateral declaration doesn't really work when there are 2 states next to each other, the borders ultimately need to be negotiated bilaterally between those states with both sides recognizing the same borders.
It's still a major propaganda point for Hezbollah.
[1] https://en.wikipedia.org/wiki/Shia_villages_in_Palestine
Lets zoom out: The whole world is about to enter a massive economic calamity, all because Americans got tricked into to electing the current knucklehead in the White House who took a ~$300 million bribe from an Israeli supporter to start this war.
None of those other conflicts will affect the entire world as what Israel has done.
From what you've said. It sounds like America is to blame here, tbh. $300mil is chump change in international bribery/development. If your establishment sells itself so cheaply, that's on America.
Besides, what's happening in Iran is minuscule compared to what happened during the 'War on Terror'. Play imperial games, win imperial prizes.
>Besides, what's happening in Iran is minuscule compared to what happened during the 'War on Terror'. Play imperial games, win imperial prizes.
Disagree, Those wars were confined to an adversary that was already a few rungs down on the ladder and couldn't crash the world economy. Iran is larger than Iraq + Afghanistan combined, has very large mountainous terrain which has a lot of easy hiding spots for drones/launchers, has the fourth largest collection of trained staff in the field of nuclear science (more than France) and even became space launch capable in 2009.
Thats is like night and day difference between Iraq/Afghanistan.
America needed to push cheap credit to boost confidence after 9/11, oil prices skyrocketed and haven't really come back down, hugely expensive wars were funded on debt. It's arguable that these all directly contributed to the GFC in substantial ways.
Global confidence in American leadership plummetted since these wars, and opened the door for China and 'multi-polarity' to enter the stage which has caused a new wave of proxy wars as powers are trying to get a piece of the new round of global empires. We have Russia making moves (apparently also kickstarted by Gadaffi's death), UAE and Turkey playing games in the Sahel, dicerolled team selections in Libya, China testing the waters in Myanmar and Laos, fuckeries in Venezuela and Cuba, Syria, Azerbaijan....
If anything, Israel have been baited into their current actions just like America were as new and old powers try and undo 'centuries of shame', etc.
Jan. 6th wasn't enough to disqualify him from a second term. The Epstein files weren't enough to get him removed from power. ICE wasn't enough to get him removed from power. Blatant disregard for the courts, threatening allies, arbitrary and insane tariff policies weren't enough to get him removed from power. No President in the history of the United States has been as secure in his position as Donald Trump is. The Supreme Court even went out of its way to make him immune from prosecution for any crime he might possibly commit while in office.
Israel may have (probably did) talk Trump into the war but Americans are the reason Trump was in that position to begin with, and he is there because Americans want him there.
The fact that they are still trying last minute fuel price manipulation in the hopes of converting some people into Trumps good graces proves that you are wrong. The country is very large. In 300+ million people you will find a large distribution of people in terms of skills and ability to discern fact from fiction. The bottom 10% of the distribution is still ~30 million people. Some % of these people vote. Lets not even consider the bottom 50% percentile.
>Jan. 6th wasn't enough to disqualify him from a second term. The Epstein files weren't enough to get him removed from power. ICE wasn't enough to get him removed from power. Blatant disregard for the courts, threatening allies, arbitrary and insane tariff policies weren't enough to get him removed from power.
You are conflating two different things. This is a failure of the system. This takes time to reform. There are attempts going back years. When you have so many layers of people who benefit from the existing status quo the only way you speed up the fix this without decades of sludging through roadblocks is if a national calamity happens that finally forces change(economic or other challenge). Otherwise too many people are insulated from the downsides of the system until they aren't anymore and then something changes.
>but Americans are the reason Trump was in that position to begin with, and he is there because Americans want him there.
Objectively this is a stated fact (unless you believe the election was rigged). But it glosses over so much nuance and context.
The same can be said of Brexit, Victor Orban, AfD, etc. All of these bad things were, nevertheless, boosted by Russian ops with the same general strategic goal in mind.
Israel has a lot of enemies that going against them. Which is why they have incentive to be good at this - to attack back. Corporate attempts are just ways to make money.
I'm going to stay out of the political issue of what any actor should do.
Why do you think that is?
lol downvotes
Certainly some is antisemitism. To imply, as you have, that there is 0% legitimacy to any other reasons to hate the behavior of the current Israeli government is just as pro-genocide as you claim antisemitism.
Most people I know who oppose Israel's actions in Gaza have no problem with Jewish people; many themselves are Jewish.
In my political opinion Israel is an artificially created state which is why it's so unstable and we should simply walk away and cut our losses on this. I believe my opinion is the prevailing populist opinion too so y'all have to contend with that.
There needs to be some compromise between our points of view or else we'll continue to get more war and violence. I think our country needs to recognize our responsibility for this mess and should offer land in North America of equivalent value for any Zionist refugees and then leave the poor people of that land alone. I ultra extremists would feel right at home in the Catskills lol.
...are also widely considered bad actors. Yet, it isn't "islamophobia" when you criticize Iran or "anti-Orthodox" when you call Russia to account.
Curiously, however, when you similarly criticize the actions of this specific Israeli government and its leaders, you are slandered with the term "antisemite" and there are orgs that exist to doxx you and get you fired from your job.
Isn't that weird?
Thankfully, in many such cases, we can call the skyman to rescue:
What is hateful to you, do not do to your neighbor. That is the whole Torah; the rest is the explanation of this—go and study it!
I see lots of (maybe un-carefully-worded, maybe?) bashing of the actions of the current Israeli government, and its defense forces and intel apparatus.
That's 100% fair game, anywhere on the planet.
What's I don't see is the rank antisemitism you claim, except for a few outlier recently-created accounts.
The most despicable thing I see at scale in the conversations is the attempt to silence critics of Israel with slanderous accusations of antisemitism. It used to work, as a tactic, but it (like the "racism card") has been vastly overplayed and is rapidly losing its value.
I didn't attempt to silence anyone. I simply called out what I see. Silencing is what HN does when they moderate the Ukraine Russian discussions different than their newer standard for Israel Palestine.
https://news.ycombinator.com/item?id=50112408
"it's the shiftiness of jews'. Racism doesn't exist anymore, and calling these discussion anti-semitic is me just shielding isreal as a tactic. Fuck off.
>Racism doesn't exist anymore
Who said that?
>calling these discussion anti-semitic is me just shielding isreal as a tactic.
Yes, when the discussion is about the current government of Israel, the IDF, its intel apparatus, and their actions.
>Fuck off.
When you have no point, use anger.
Can't find the quoted phrase in the referred comment: did you just make it up or did he edit it out? Other than that, he made some observations about Judaism. Off-topic perhaps but nowhere near racist. Fuck off.
here's a nice response for you 'it's the shiftiness of jews'. There's your totally not racist as fuck/antisemitic dot connecting.
https://news.ycombinator.com/item?id=50112408
I kinda wish these threads wouldn't get 'cleaned up' so we can see the actual totally 'not antisemitic' HN discourse plain as day. I'm sure the above comment will get removed/cleaned up and you can go back to 'connecting the dots around crime statistics isn't a core part of racist cannon'.
Finding an understanding patterns and acting according to them is the most logical and natural thing a human or any life form can do. You would call someone speciest for not hugging a bear just to feel ideologically pure.
You might also look into the tale of the boy who cried wolf. The more you keep shoutin "antisemtism" in an attempt to shut down criticism the more people will learn to just ignore that word or ascribe to it a meaning far different from the one you want.
Pegasus: How a Spy in Your Pocket Threatens the End of Privacy, Dignity, and Democracy by Lauret Richard
If Mossad is willing to give you a hundred million to make your startup a spyware company, you're obviously going to agree.
what a sad take.
Only Jewish pedophiles & criminals. Israel will not let in random non-Jewish criminals to flee prosecution, only those who are provably Jewish are granted citizenship and non-extradition.
It's fairly common in Europe[0].
[0] https://en.wikipedia.org/wiki/Jus_sanguinis#Leges_sanguinis_...
This is clearly a racial ideology.
> Converts to Judaism who wish to immigrate to Israel are evaluated on a case-by-case basis by the Israeli Interior Ministry, which determines whether the conversion was sincere in its view
The reasoning behind the 1970 amendment is usually traced to the Nuremberg Laws. Nazi Germany defined a Jew for the purposes of persecution as anyone with a Jewish grandparent. The amendment drew Israel’s circle of protection at the same radius: if having one Jewish grandparent was enough to be persecuted, it should be enough to be given refuge.
It is not a great law but it is what genocide is agreed to be and it is not based on amount. It's all about intent which is very hard to prove.
It's one thing to accuse Israelis of paranoia, hypocrisy, or even genocide, and it's another to deny that the primary motivation to have Israel be a jewish ethno-state was to have a refuge from persecution.
Talk to any Jew who has left the cult; they’re huge racists foundationally, no group is comparable.
The ethnic cleansing that happened when Israel gained independence was not in just one direction, Israel also did allow plenty of Arab/Palestinians to stay and gave them citizenship where feasible. It's not surprising however that Israel doesn't currently offer citizenship to a population that largely doesn't think Israel should even exist. States don't normally give citizenship to their non-citizen enemies.
> They also allow people to convert to Judiasm and enter, so it actually has nothing to do with their ethnicity and is solely based on religion.
It's not solely based on religion. It's also quite rare for people to convert to Judaism in general so that exception has little practical implications.
edit: and I have been hasbar'd now for simply stating the fact that making people fear you instead of love you has consequences. oh well.