AdFection: Targeted ads turned into a pipeline for zero-click mercenary spyware

Oh darn, maybe we should just ban the entire online advertising industry. Gosh, what value we'd lose if we couldn't have our personalized attention destroying glitter boxes.

My opinion on web infra patronage has shifted over time, I used to generally accept that for small websites to exist advertising was a necessary evil since they were too niche to have a real revenue source. Then I ran one and I realized that there's far more labor costs involved in maintaining a site than infra costs and that for niche hobbies and communities ten bucks can just find its way into a central pot every month to keep the lights on by those with a bit more to spare.

I am now of the opinion that web communities can survive in the same way arts and other liberal pursuits have always survived. People with a bit more to spare put more into the pot to create the community they want to exist in and "freeloaders" is an alien concept to the genuinely interested since that money is being spent to create a place where meeting can take place without a financial requirement.

AdTech engineer here (some 13 years in the industry). A couple of notes:

- The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.

- To the point below that "ad providers should be held responsible." There is no such thing as "ad provider." The AdTech ecosystem is teeming with different niches and business models - see the famous LUMAscapes diagrams: https://lumapartners.com/lumascapes/ . The sheer volume of traffic makes it virtually impossible to vet even a fraction of it. Google has thrown a lot of compute power to pre-scan 3p creatives and even then bad actors can sneak through. Add to this a lot of sophistication on their side (from different landing pages based on the perception of the type of user to farming throw-away advertiser accounts aimed at running just one campaign like that to hijacking legit accounts through sophisticated technical and people engineering means). In the end, politicians full of indignation do what politicians always do - sue or fine Google and call it a victory, whereas the true bad actors just keep going.

Obviously not the first time an Israeli tech firm is responsible for these types of exploits, and at this point I'd go so far as saying that any Israeli-based tech company (especially cyber security ones, of which they have a strong industry) should be considered beholden to the government of Israel and hence, probably not trustworthy. How could you be sure whether they will act like a trustworthy independent entity, or compromise your data for the benefit of the state?

Actual report from Citizen Lab:

* https://citizenlab.ca/research/how-discover-tech-turned-targ...

My question is, why is Israel so good at this? It seems to be at least the 4th cyber power of the world, after the US, Russia and China, if not actually on par or better.

I guess it is because it has been under the threat of larger enemies from its birth, so it must leverage whatever it has to survive. And once you grow an organization and let it loose, you don't have much control over it anymore, and it grows in the wild like a flower.

It is standard that companies within a country act in the interests of its security services. Israel has a lot of ad-tech companies and thus it makes sense that they are roped into serving Israel's security services.

It is no different that Israel's location tracking of StarLink terminals worldwide: https://www.newarab.com/news/israel-tech-firms-can-locate-an...

This is the same issue that the US government has with Chinese networking companies, it is too easy for the Chinese government to pressure these Chinese networking companies to put in back doors in the interests of national security. The US likely knows this because it pressures its own companies in similar ways.

Y'all will be shocked at how much of the VPN space is owned/controlled by Israel.

https://share.gemini.google/DbWctQhiJXMh

Israel has been a nexus of cybercrime for as long as they've been on the internet at all.

https://en.wikipedia.org/wiki/Download_Valley

Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.

Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.

It's really sad this got taken off the front page (347 points, posted 2 hours ago at the time of this comment). Israel is deeply intertwined with the tech industry and they use tech extensively in extremely hostile ways. It's relevant to this site discussion and the votes demonstrate that. There's no reason to hide the elephant in the room, let's address it, now is the time.

This is even crazier than the last time Citizen Lab found an Israeli zero-click spyware (Pegasus). You could call it a sequel

As much as it sucks for the ecosystem that's built itself up around the world wide web, good ad blockers and fingerprinting protection are as important as firewalls and antiviruses now. There's no more babies in this fetid bathwater.

Targets could have been identified using pretty basic advertising and marketing techniques. Bid requests broadcast IP, device details, and ad IDs to every bidder. Intersecting topic audiences across a few months of Al Jazeera stories could narrow that audience to a few individuals. The ad ecosystem already does set-intersection de-anonymization to identify interests and profile customers.

https://404privacy.com/blog/how-israel-used-ad-auctions-to-d...

"Researchers also recommend that users at high risk of targeting use ad blockers, disable ad tracking, and regularly reset mobile ad IDs.". Not "recommend". Everyone must use uBlock Origin or at least some type of ad blocker in every device.

Then also mandatory pi-hole on every house.

Even if you are used by Windows OS, you must use an adblocker. Even if you use Chrome. On every browser.

It's kinda funny that a website with an article titled "Online ads weaponised to deliver ‘zero-click’ spyware" immediately loads a splash that asks users with adblock installed to disable it.

>During our analysis of the Controlium platform, we observed that the source code mentioned an endpoint called “/csv-download”, which accepted start and end date parameters. When we sent normal HTTP GET requests to this endpoint without any password, special headers, or authentication token, we received logs showing which users had logged in to Controlium, and from which IP addresses.

Absolute morons.

So reading the article, it feels a bit confusing what zero click exploit they are talking about. It sounds like they are talking about CVE-2021-21166, but if they really are talking about an exploit from 5 years ago, i feel like their intro paragraph is rather misleading.

Ads providers should be held responsible for delivering malware. All the tracking (that includes fingerprinting for clients that do not want to be tracked) should also be illegal.

How is this acceptable for society goes beyond me. And then corporations blame individuals when they get scammed. It is your fault that we have all your information and leak it everywhere, when it is not just directly sold.

And add jail time to fines. Fines means nothing for the rich.

If you work for an ad tech firm you are one of the baddies.

Awful lot of words here, but not much explanation of the actual capabilities of the "zero-click spyware". Tacking on the phrase "zero-click" suggests some kind of browser exploit, but it seems like this is just the same sort of thing as tracking cookies, third-party telemetry etc.

How does this actually work? Are they talking about browser fingerprinting or something else?

Looking at the bright side, we might just be able to make people really dislike ads.

It's fun to see adtech digging a hole for themselves ...

archived, no ads or trackers: https://nonograph.com/online-ads-weaponised-to-deliver-zero-...

Would installing ad-blocker software give me any protection from this stuff?

How paranoid should one be of, say for example, a wasm vulnerability exploited on zero day by a bad JS ad?

I am scared for my parents to get exposed to this kind of thing from bad ad network actors. Does anyone have some practical concrete recommendations they took? Like I don't think they can install ublock origin and whitelist sites on demand in Firefox they way I do.

The only practical thing right now is to make sure they don't have the money on device and have 2 fac for email and bank accounts. But every now and then there are phishing attamepts that they could fall prey to.

Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle...

The CTO happens to have worked for Radware

https://radware.com/

https://www.innovid.com/about-us/news/mediaocean-completes-a...

I’m a little confused how mobile ad targeting ends up as a DLL hijack?

Incredible that they don't clearly say what the exploit is and what OS/hardware/apps is/are vulnerable. Still, quite a lot of interesting info about the modern ad delivery networks sewer system...

The article contains no information on which browsers are impacted, what exploit is being used, if it has been patched, etc? Does anyone know more about how this ad network is exploiting browsers to install spyware on the users machine?

You have to go about 5 pages deep on any search, anywhere, before you find something positive about "israel"

I would be interested in knowing which devices were (or still are) vulnerable to these zero click exploits. And how those exploits (used to) work, specifically.

Very strong reason for everyone to install ad-blockers on all of their devices.

Of course, who else could it be.

The fact one of the spyware cos was named after the fish that swims up your dick hole is too funny

uBlock Origin ftw

This is what ad networks are for, by the way

I doubt it's that easy to click on a link and install malware without the user knowing. Most browsers are highly secure and finding a zero day isn't that easy these days because both sides use A.I. to find vulnerabilities and to secure against them.

Do ad blockers protect against this?

Curious if GrapheneOS phones were also vulnerable to this.

Wild guess even if not in this particular case it's best to consider the possibility as non theoretical.

Earlier link:

https://news.ycombinator.com/item?id=50101813

The headline is "Online ads weaponised to deliver ‘zero-click’ spyware, researchers say"

Once again proving that ads are an unacceptable security threat. All those sites now deploying ad-blocker blockers should assume liability for whatever ad software they force their readers to run.

I wonder who they were facilitating the targeting for given the target countries.

Apps should be required to disclose every single ad network they use as part of their app store disclosures. I want a lot more transparency as to where the ads are coming from inside the app itself.

I've witnessed consumer apps throwing quite heinous malware/sketchware advertisements and watched the banners rotate between 4-5 different ad vendors to keep things hot and spicy.

It doesn't make sense how this is even possible.

if anyone is well versed with this tech; can this be used to target regular people? how can an average joe protect themselves from this?

Quite amusing that the Crusader states have exchanged horses, swords and shields for spinny chair, ads, and adblockers.

Wonder what the world's most boring ideological argument will bring us in the year 3027.

Citzen Lab isn't always the most reliable source: https://researchonline.lse.ac.uk/id/eprint/118492/

All ads should have to appear in an <advertisement> node, and users should have the option of disabling javascript within an advertisement. Make it the fucking law.

Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle... The CTO happens to have worked for Radware

https://radware.com/

https://www.innovid.com/about-us/news/mediaocean-completes-a...

tel aviv impressed

Whenever I think of Israeli ad tech one company always springs to mind, which creates some of the worst garbage on the whole Internet.

https://www.taboola.com/

This crap is the worst of the worst.

Title is: Online ads weaponised to deliver ‘zero-click’ spyware, researchers say

In fact, just update the url and title to the report:

How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware

https://citizenlab.ca/research/how-discover-tech-turned-targ...

I don't see any ads, so ...

Chance of sanctions?

> Related work by the research group Confiant also suggests that Discover-Tech’s ads have been shown to users of the networks of government entities in Europe and the US, as well as the UN, Nato, the international criminal court and the International Atomic Energy Agency.

Yet we don't sanction Israel nor hold them accountable in any way. Of course they're spying on members of the UN and ICC, of course. Israel is at war with the entire world right now, and my politicians continue to support them. Thankfully many people have woken up, but the situation is dire.

Why would anyone trust any Israeli cybersecurity firm at this point? Any website or service knowingly utilizing their services is a huge risk. They're already deeply embedded in federal and local governments so there is a strong sense of doom.

Hacker News sure loves to single out one specific country and blanket label. I remember when comments like those in this thread directed against Russia after the Ukraine war heated up were shut down by Dang. But blanket generalizations against Israel?

Dang's official position by the way https://news.ycombinator.com/item?id=48100358 let's see how this thread goes.

A later submission has more comments: https://news.ycombinator.com/item?id=50103000 , 57 comments 1 hour ago

[dead]

[dead]

[dead]

[flagged]

[flagged]

Imagine if Iran did this... Or China, or Russia. But hey, it's Israel - all laws, rules, norms and ethics is suddenly suspended - so everything is ok!

You can have peace or Israel, not both.

Probably happens with Russia, US, etc as well, but the "hasbara" campaigns through the years have the effect of making people assume the mossad is all powerful etc etc. You inspire fear on your enemies, but also your friends.

edit: and I have been hasbar'd now for simply stating the fact that making people fear you instead of love you has consequences. oh well.