Hacker News

Prior to online ads, that is ads that existed on TV, print media, etc, ads were properly vetted. Very few outright scams made it through.

So, it’s definitely possible, especially with human review and static ads. No code. It might not be possible at scale. To me, that’s just not an excuse. If you can’t do something safely at scale, then you shouldn’t. If that means generalized online ads can’t exist then… so be it.

Online ads are definitely still possible. For example, im sure Disney reviews and approves all ads that run on Disney plus. So just do that, and if you can’t do that for e.g. YouTube then dont.

> There is no such thing as "ad provider."

If a website serves me malware, the website's owner should be liable to me. They may then be able to sue someone else, in turn. But I chose to interact with them and then they chose to outsource stuff to crooks.

This would be complicated to implement. But it's absolutely doable.

This was my main question as well. I read the report, but I'm still not clear on what the browser vulnerability is. This clearly seems like something browser vendors should be able to patch, correct?

The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited. The step-by-step info graphic in the article literally skips over how the infection actually occurs.

Your appeal to authority as an "AdTech Engineer" works against you when support your own industry. You have a conflict of interest. Of course you will try to do damage control and PR.

I would sooner trust a Chinese company than an Israeli company. Is there any country less trustworthy and more hostile to users?

> should be considered beholden to the government of Israel

Do we have evidence this is a state operation versus a criminal group?

Many, many, many Fortune 500 companies use Israeli cybersecurity services.

I guess that your concerns are not aligned with reality, or the benefits far outweigh whatever it is you think may happen.

(Talking as an Israeli working in cybersecurity)

Don't forget the compounding effect. Say, one country (or city or community) decides to invest their efforts into area X (e.g. clock making in Switzerland). They do it and become better and better. As long as they keep doing that they can become #1 in the world. Regardless of any reasons "why them".

There's no reason Netherlands are better at chip lithography except that they're doing it (Dutch agriculture success can be attributed to good soils/climate/geolocation, but not chips). There's no reason Hollywood is better at filmmaking. Kinda chaos theory -- small changes to initial state leads to huge changes in the later outcomes.

Multiple reasons. America gives Israel special protection for everything they do, Ashkenazi and general Jewish culture values education more than anyone outside of East Asia, and a lot of Soviet Jewish scientists had to work for the military so they came to Israel with cryptography or spy tech experience.

Back when I was a tech journalist, back in the 90s I visited Israel once and interviewed a number of their tech companies - admittedly most in the cyber-security space.

They ascribed a lot of the tech innovation to conscription - lots of the founders had learned a lot while in technical posts in the army and put that to use when they left.

> why is Israel so good at this?

Unit 8200 [1]. Also, Israel doesn't extradite its own citizens and seems to turn a blind eye to criminals doing nonsense abroad. (Similar to Russia and China.)

[1] https://en.wikipedia.org/wiki/Unit_8200

Country that prizes education and is constantly under threat. Plus, most folks do serious time in the army and only after that do they go to college.

A few potential possibilities that may or may not be popular here.

- Compulsory military service means the government captures the best and brightest of the country.

- An extraordinarily outsized number of nobel prizes belong to Ashkenazi Jews, and other indicators of intelligence (lack of propensity for violent crime, lifetime earnings, etc) are also quite high for the whole group.

> it has been under the threat of larger enemies

It has always been at odds with its neighbors and has persecuted its occupied people, for far too long. It has further facilitated other tyrant governments in the control of their people. The cyberwarfare industry in Israel is directly part of the controlled Defense Industry.

It is not under threat. It has sought to be a formidable threat to everyone.

It’s an interesting question. I would also guess that this kind of behaviour would be illegal for private companies in many countries even if you don’t do it domestically.

We have had viruses leaked by other countries in the past, with US and Germany coming to mind. If I remember right it was around 2005-2010 when democratic nations officially started to state that they had a right to use malware against criminals and military targets, and from that on it has just kept going. As I recall, Bruce Schneier and FSF made a bit of articles and talks where they tried to get people to understand that once democratic nations starts to use malware offensively they also generally stop protecting their citizens from those security holes.

That we don't hear about it more often seems to me that nations that develop this stuff seem to have gotten better in making malware more precise in what they target and less leaky to the general population, but it could also be that media just don't report about it as much. When a gangs anonymous chat get hacked, or a tor hidden service website get taken down, news seems more interested in talking about the crime than what security vulnerability that the police used.

And also it has help, it is unlikely it acts alone. Example Stuxnet. Israel has the talent so they are a convenient and willing proxy too for getting shady shit done.

To a certain extent, i think its because Israel benefits from being seen as "scary" so there isn't as much pressure to keep this sort of thing on the down low, where in any other countries there is more pressure to keep grey-area stuff like this secret to prevent blowback.

Putting it amongst that cohort and suggesting it's a flower is definitely one reading I guess.

Given the number of enemies Israel has, it has to be prudent and explore every opportunity it has. One strategic mistake could be fatal.

Because Apple, Intel and Samsung have huge engineering labs there and employ IDF & intelligence people to work in those corporation’s labs. It means they have very detailed knowledge of their products as they have all internal documents and also design software & hardware.

That is why both Apple & Samsung have malware from Israel on their phones. The USA has the NSA building and exploiting products for surveillance and penetration globally.

Netanyahu recently was on a US broadcast, he held up a phone and stated to the reporter interviewing him, that Israel can penetrate any device obtaining it contents and then blackmail or discredit the owner of said device.

The USA now examines phones at airports to see if people are saying things the current administration doesn’t like.

Integrated selection pipeline spanning 15 years from age 4 up until age 18.

You conclude that they’re good at it because they keep getting caught? Fascinating.

They get away with genocide, it's no wonder that they can get away with this.

Because it's the only country allowed get away with stuff that would be an international scandal if a normal country did it.

“Threat of larger enemies” yeah that’s the direction the threat goes.

This, plus all jewish folks I've ever met are naturally smart (not genetically of course, more like societal pressures/expectations/upbringing), hard working like few others, and seem to genuinely veer towards numerical jobs - banking and finance, math, applied math like security, cryptography, trading and so on. Very similar to Iranians to be fair, if US and British MI6 wouldnt be meddling in Iranian internal politics and supporting corrupt shah to steal all the oil cheaply those 2 would be together a superpower on global scale. Israel was very very lucky to not have any oil on their territories.

Plus very much present in US politics and power circles for some reason.

2 examples out of many - my boss is a prime example, every thought somehow infused with money (I work in a bank). My ex gf was exactly the same (she is a successful commodity trader). Just very, very different mindset to the core to say typical european one (I mention folks who are europeans and I've never been to Israel, so extrapolating a bit here).

> has been under the threat of larger enemies from its birth

As everybody else in the planet. Israel is not special in that sense.

"threat of larger enemies from its birth"?

Israel is the one occupying and bullying its neighbors, spying on its "allies", doing air-strikes on neutral countries, attacking US research ships, and performing piracy and kidnapping in international waters.

The US, to its eternal shame, guarantees their security.

Israel is not particularly skillful: they're a little bully getting in some punches while a big bully holds back the rescuers. Ooh, tough guy!

It's the spy agencies you hear nothing of you should worry about.

OK, I read the report, but I'm still not clear on what the browser vulnerability is. This clearly seems like something browser vendors should be able to patch, correct?

The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited.

Difference being we're pretending that Israel is a democracy that values human rights, so nobody makes a real stink about it, unlike with China.

Bills like the US CLOUD Act (there are similar ones in the EU and China) force service providers to illegally spy on people overseas (via unauthorized use of anything they can access—consider Microsoft’s Windows backdoors).

I think the only technical solution available to individuals is to boycott non-verifiably e2ee services and corporate operating systems (especially including android).

Except this isn't the security services they are serving it's a mercenary spyware vendor.

This is abhorrent. Every government spying on everyone.. and who benefits from all of this?

Can we get an alien invasion already please, god

Why do some of the most evil tech companies, especially ones that use exploits and zero-days as part of their business model, disproportionately originate from the same small (population-wise) country? The company from the article, all the other examples everyone here lists, Candiru, NSO... All Israeli.

It was so successful that IronSource, one of those companies, ended up merging with Unity and I think they got like 25% of the company: https://en.wikipedia.org/wiki/IronSource

There's a reason for that. Israel is a test bed to remove freedoms world-wide through digital surveillance.

That explains a lot. You're basically just fishing for downloads in your target networks. You don't actually care if anyone clicks the ads in the installers, the sole purpose of the adware is to get arbitrary software running alongside the installer, so that you can compromise their machine.

That country has long been known as a haven for American pedophiles/criminals who end up fleeing the country.

They've also been a nexus of cyber security: Palo Alto Networks, Checkpoint, Wiz, etc are all Israeli companies.

Guess where the company big AI labs are using for security sandbox is from? The one that was involved in both big hacking scandals from "rogue agents" by OpenAI and Anthropic?

Also affordable generic drugs. YMMV.

>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.

Totally not useless. It costs a lot more to pay a spyware firm then to have an employee send an email / ask a judge (like that's even necessary).

I feel quite confident of my messages privacy on my Pixel with GrapheneOS given most people I message are on iPhones which are second in security to Pixels running GrapheneOS. Not to mention my threat model doesn't include mercenary spyware, as most people's doesn't.

>Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.

If you're talking about the sideloading restrictions those were intended to stop social engineering and scams, not from getting hacked via 0days.

>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.

Source? play services is privileged but not that privileged.

> useless as a way to prevent people from being hacked

From being hacked by others. Google was just trying to protect their property, which is the ability to spy on their users' every move. Google themselves really don't need to "hack" their users for that, they already have all the access and all the data they could ever want. And they also have the ability to brick their users' devices at a moment's notice the same as Apple does.

However, this hack could have happened whether sideloading was allowed or not.

In fact, following the OP's link to https://citizenlab.ca/research/how-discover-tech-turned-targ..., "the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries" so it's not just apps but ordinary websites you visit in your android chrome browser.

I'm sure Google's latest push to make it inconvenient to install apps from outside Google's Playstore, where Google charges a 30% commission, is going to solve that.

Is GrapheneOS affected?

Don't call it a comeback, I been here for years Rocking my peers and putting suckas in fear

Yes. Browsing without an adblocker is analogous to driving without a seatbelt. Sure, you can do it - but it's a terribly unsafe idea.

The separation between advertising and editorial has never been greater. Brought to you by the marketing wizards who saw you bought a vacuum cleaner on Amazon and concluded you love buying vacuum cleaners so here’s some more.

The site works much better with JS disabled.

I think it would be nice for them to be held accountable but I get the feeling this is part of a wider nation state intelligence apparatus and I doubt that they will hold themselves accountable.

nah, you'll never get there that way. Even if there was willpower to do it legislating these things is too hard.

What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).

If they win the landscape will change. It would set a precedent for civil liability for infecting your users even when it's not your content directly. That would likely spook the shit out of the market, security becomes a feature.

It seems like ads already violate the law via whatever that "unauthorized usage" law is that the government likes to throw around.

Too bad no one has the guts to enforce the law that way.

That would mean some google people going to jail...

All ads are malware.

> And add jail time to fines. Fines means nothing for the rich.

This, pretty much. Money removes consequence form your actions. If every time you screwed up, instead of being fined you had to wear a silly hat, go on TV and apologize, or get some time behind bars, even if it were 1 or 2 days it would be very effective.

The default setups are also _crazy_.

So you search for company A wanting to buy their product. You check out. Basically every setup I've audited has every tracking product ever for everything.

So you buy X, and the company sends that purchase event with your information to Meta, Google, TikTok, Applovin, Klaviyo, and 10 others.

This idea is hopelessly entrenched in every marketing department, who has leadership's ear: We HAVE to send EVERYTHING to EVERYONE otherwise our ROAS will go DOWN!

Every platform works this way, they're all set up to put giant red banners on your marketer's dashboards

"You could be getting 50% better results if you sent <customer_2nd_grade_report_card>!"

We should make targeted advertising illegal, full stop. This would remove so many perverse incentives in the system.

> How is this acceptable for society goes beyond me.

Easy, when your society glorifies and deifies greed, you can excuse literally any act so long as it makes enough money.

That's it. That's the entire explanation. It's capitalism and greed.

This is not the problem. You visiting any website can lead to your computer running the same code.

The main problem is that the exploits from js to code execution or data exfil are possible in the first place. The issue is that you have JS, which is generally pretty isolated, able to talk to bundled libraries (like libwebrtc), which often contain the exploits and share the same memory space. There needs to be a intermediate layer between JS talking to any such library, like process isolation with IPC for communication.

I'm not sure you understand what you're asking for, or if you do you have not followed the results of this to its conclusion

No, they’re using those same techniques,

and they’re just as troublesome as they were before,

to the degree they’re provably being used to decide who to send malicious payloads to…

Zero-click simply highlights if the user needs to actively interact with an element to get a malicious payload - or not.

This did get me interested in the specifics of the payload, though:

“It maintains persistence via COM hijacking by overwriting a legitimate COM class registry key’s DLL path with a first-stage DLL dropped in C:\Windows\system32\IME\, and it stores encrypted second-stage payloads in the configuration directory. A signed third-party driver (physmem.sys) enables kernel-level memory access and API call proxying to avoid detection. To preserve system stability, DevilsTongue reinjects the original COM DLL during hijacking, disguising this action through shellcode manipulation of the LoadLibraryExW return value. All additional payloads are decrypted and executed only in memory, allowing the malware to steal credentials from LSASS and browsers, access Signal messages, and use browser cookies to impersonate victims on platforms like Facebook, Gmail, and VK. The malware’s use of scrubbed metadata, encryption, and unique hashes for each file further complicates detection and analysis.”

from https://www.recordedfuture.com/research/tracking-candirus-de...

Keep reading:

https://citizenlab.ca/research/how-discover-tech-turned-targ...

Looks like it's much worse, they get more information due to exploits, and they can take full control of your machine.

Article on the CitizenLab website: https://citizenlab.ca/research/how-discover-tech-turned-targ...

There is a tinfoil narrative that suggest that entire formats are in bed with intelligence services. It sounds pretty wild, but other zero-click attack vectors have been possible through sabotaging the parsing of file formats. ie. send a message -> hacked. How? the message wasnt even opened. How is, an app like Messenger receives a photo attachment binary, tries to unpack it and in doing so receives an instruction that stops the parser and executes arbitrary instructions.

Here is a better article https://citizenlab.ca/research/how-discover-tech-turned-targ...

https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zer...

https://citizenlab.ca/research/how-discover-tech-turned-targ...

If I had to ponder a guess…

It’s to do with hiding malware/spyware in an image which ends up in your cache on device. I can’t go much further into details but all this takes is for you to visit a site that serves it via ad network.

Israel has been known to have some sneaky spyware in the past with Pegasus.

They use ad network to try to target individual user visiting a page (eg you know your target is a male, 60 years old, living in that area, with a few other checks you can almost uniquely identify your target)

Then the ad network delivers a targeted ad that exploits a vulnerability (eg a broken JPEG decoder that, when sent a bad image, allows to run arbitrary code on your machine), and from there you have access to the computer

How the ad-based spyware actually worked (from the Citizen Lab and Confiant reports):

- It came in through the front door. Discover-Tech ran its own ad-buying platform and was listed as a "certified" vendor by Google and IAB Europe for six years. Nothing was hacked to get in. It bid in ad auctions like any other buyer.

- The ads looked harmless. Plain banners for games, AliExpress deals and an IP-lookup site. Hidden inside each one was a small script that quietly phoned home when the ad loaded.

- Everyone who saw an ad was profiled. The script collected device details, IP addresses and, on many sites, the publisher's own cookies, sometimes including logged-in session tokens. Cookie-syncing with other ad networks built a huge identity graph.

- Only chosen targets got the payload. A gatekeeper server checked each device's ad ID and IP. Most people got nothing back. A selected target got code that handed them off to spyware maker Candiru, and the code was served only once, which made it very hard for researchers to capture.

- The handoff was built to defeat inspection. Encrypted channels, rotating hosting, anti-bot checks and even a fake "Copyright Google" comment to fool human reviewers.

- It worked. At least 45 devices at Al Jazeera were targeted, and spyware was recovered from an infected machine. Its ads also appeared on networks belonging to NATO, the UN, the European Parliament, the ICC and various defence ministries.

- The scale was huge. Billions of bids and ads in nearly 200,000 apps and websites, including Duolingo, Viber, Yahoo Mail, dating apps and period trackers, yet almost no sign of real advertisers or revenue.

Citizen Lab: https://citizenlab.ca/research/how-discover-tech-turned-targ...

Confiant: https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zer...

Citizen Lab also has a shorter executive summary: https://citizenlab.ca/research/exposing-adfection-executive-...

People have disliked ads since ads existed. Carl Sagan's 1985 book Contact includes a brazillionaire S.R. Hadden who made his fortune by inventing an adblocker for television. https://en.wikipedia.org/wiki/Contact_(novel)

For those who haven't learned their lesson yet, I doubt anything could move the needle.

The FBI has previously recommended running adblockers as a method to prevent malware and especially scamming. Nobody cares much.

It’s a low-hanging fruit that has high value, particularly for less savvy internet users. Scams have always been the biggest threat. I’d say the majority of internet ads are scams, and the platforms often don’t make it clear what is or is not an ad.

But, we always knew the risk of malware was there. In the modern age, ads are basically never delivered as static assets. They’re delivered as small applications, with code. So, we’re relying on our sandboxing mechanics to work perfectly, and predictably they don’t. The solution is to block the code altogether; to block ads.

If only! I think we can no longer afford to ignore all these security threats and should make online advertising wholesale illegal. But I won't hold my breath.

It seems to be app-based. So DNS blocking could work; it's easily circumvented by the platforms, but it's rarely circumvented. like mobile games with those ads.

You should threat model, but if you want to maximally protect yourself, use Vanadium or Brave Browser and GrapheneOS and no privacy invasive apps.

https://www.privacyguides.org/en/basics/threat-modeling/

I wonder how we're going to unwind this mess in the upcoming years. It seems as if there was a concerted effort to plan this all out before Trump got elected, and then everything fell into place. They obviously have a post Trump plan ready to go. I partially blame the left(really the moderates) in the U.S. For being so unbelievably complacent that it led us to this mess. I just wonder how we're going to unwind this. Nothing lasts forever, but the transition in between states always tends to be disrupting.

This was my first question as well. There’s a big gap between “ad network delivers JS” and a zero-click browser exploit. CitizenLab has done some great research including OSINT on the former, but there’s a conspicuous gap between it and the DLL ending up on the victim’s machine.

There are mentions of CVEs in that article with Chrome exploits.

mobile ads can deliver JS-based exploits

Seems like a second-order effect to me, and this report is a good example

they do have a really big and well stocked skin bank! Its positive as long as you don't start asking where it came from :P

Committing a genocide does typically reduce one's cachet.

Plus a dns based blocker for other apps. Android has an option ready for that, iPhone it will be like VPN.

And wBlock on Safari.

It’s not “easy”, it requires a complex infrastructure of exploit devs (who can sell their findings for millions in some cases) and the companies who package these exploits together with implants and sell them.

https://www.packetlabs.net/posts/demystifying-the-market-for...

"Most browsers are highly secure"... erm no

One side uses AI to find them. The other side probably needs to keep the holes open for NSA, as the multiple 0 click root exploits that happened in the past to the iPhone with very similar techniques suggest.

> Reuters has reported that billions of dollars’ worth of Meta’s ad revenue comes from ads for scams, illegal gambling, pornography and other banned content. In the US, ICE and other government agencies have bought software that uses ad tech data to track people’s movements.

I don't know if an ad blocker protects against Discover-Tech’s Controlium but in general you'd be a fool to allow ads in your browser in at this point. The ad industry is pretty shady all round.

On web, likely. If it's in app mobile then no. Run a DNS ad blocker.

The incentives are lopsided, there’s so much money to be made by selling access to you and your devices, and controlling you, than just taking your money.

Classic; when you can't kill the message, kill the messenger. [0]

[0] https://en.wikipedia.org/wiki/Shooting_the_messenger

Absolutely terrible companies. Another one is https://fingerprint.com/ but iirc they don't do ad targetting.

"uBlock Origin has prevented the following page from loading:"

Zero

Israel keeps being dick earns reputation.

Based on responses from roughly 46,700 people assessing 129 countries, Israel ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.

https://www.middleeastmonitor.com/20260513-israel-becomes-wo...

We don't sanction Israel because we are doing it too. Any country with the same capabilities are doing the same thing.

That conflates the state with a business headquartered in it. It begs the question of what the sanctions would be for: is the argument that this firm is an arm of Israel, that Israel turns a blind eye to abusive businesses, or something else?

> Israel is at war with the entire world right now

Israel is at war with Hamas, Iran and its proxies and allies.

My Democratic Rep (who is a Zionist) voted with the Republican Party to financially sanction and impose visa restrictions on members of the International Criminal Court for issuing an arrest warrant for Netanyahu, so the ICC could hold Netanyahu for trial.

I will never vote for this particular (D) candidate again. Fortunately, the (L) candidate seems reasonable.

If indeed your representatives support Israel or the genocide in Gaza, I urge you to consider voting 3rd party. In two-party elections, candidates mostly just try to be a little better than their opponent. What forces them to do more isn’t a third party actually winning. It’s a real risk that enough fed-up voters will go third-party and cost them the election. This is basic game theory optimization.

They do. But "no jews - no news".

Criticism isn't evidence of persecution. If Israel wants to be criticized less, it should better itself.

Seems like the title was too spicy / people couldn’t behave, post rank obliterated https://news.social-protocols.org/stats?id=50103000

Hope we follow guidelines under this link or “then nobody gets it!”

Thanks - we'll merge them.