What can we expect from the most unpopular country in the world:
Based on responses from roughly 46,700 people assessing 129 countries, X ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
I'm of the belief that when that happens, it is state-sponsored bots messing with the voting. Sometimes when I make a comment on political matters, it gets waves of upvotes and downvotes.
Thanks by the way for introducing me to that graph. I didn't know that anyone collected that kind of stuff.
Apps should be required to disclose every single ad network they use as part of their app store disclosures. I want a lot more transparency as to where the ads are coming from inside the app itself.
I've witnessed consumer apps throwing quite heinous malware/sketchware advertisements and watched the banners rotate between 4-5 different ad vendors to keep things hot and spicy.
The incentives are lopsided, there’s so much money to be made by selling access to you and your devices, and controlling you, than just taking your money.
Indeed, it seems there are some externalities that a 100% free market doesn’t protect against for which regulation is probably the best tool.
A regulation here that applies to all app stores is even business friendly as an appstore which wanted to do this already wouldn’t be punished by trying to do this on their own, for the reasons you mentioned.
Ads providers should be held responsible for delivering malware. All the tracking (that includes fingerprinting for clients that do not want to be tracked) should also be illegal.
How is this acceptable for society goes beyond me. And then corporations blame individuals when they get scammed. It is your fault that we have all your information and leak it everywhere, when it is not just directly sold.
And add jail time to fines. Fines means nothing for the rich.
If such a thing were passed, it can't apply retroactively. But yes, google people would go to jail when they inevitably flout it as they are accustomed to doing. We should make this happen.
People in the US have a unique window of opportunity starting TODAY (Oct 2026) in many places with early voting. I implore everyone who is able to vote in the midterms to do so.
You will have to look at the candidates in your area and do your due diligence. Its unlikely a given candidate will be perfect, but there is generally tremendous differences between them as far as overall posture on privacy and surveillance.
Not tremendous differences, mass surveillance of the people is one of the few issues that are truly bipartisan, but there's candidates better than others.
None of them, but if one did I bet they'd get support from voters and less bribes from the tech industry. As long as politicians value the bribes more than the support the people will never get representation. We should probably pass laws that stop companies from stuffing the pockets of politicians with money, but what politician is going to support a law that takes their bribe money away?
nah, you'll never get there that way. Even if there was willpower to do it legislating these things is too hard.
What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).
If they win the landscape will change. It would set a precedent for civil liability for infecting your users even when it's not your content directly. That would likely spook the shit out of the market, security becomes a feature.
Why the website instead of the ad provider? The website didn't server the ad. The ad provider did and should be the responsible part to ensure what it provides is not malicious.
Attacking a single website does nothing. If you bankrupt the site, there are millions more sites. If you attack the ad provider, bankrupting it, and shutting it down, millions of sites are now protected.
IMO the ad provider is fully at fault for allowing script tags and other potentially vulnerable features in ads. Why can't the ads just be static? I mean I get why they want it, but it should not be allowed, and IMO that's where the ad provider is almost fully at fault
Sure it did. The content coming from elsewhere doesn’t change their decision to include it when the user loads their page. It makes it wildly important.
This is no different than the “I’m too big, can’t tell what my subsidiaries are doing!” wink
Pay attention, do due diligence to do things correctly, or don’t do them.
Ideally, you'd sue the website because the website is responsible for everything that shows up on the website they control, and the website would turn around and sue their ad provider because they paid that ad provider for a service that wasn't malware delivery and as a result of that ad providers crimes (or negligence) the website now has legal costs and harm to their reputation.
It shouldn't fall on the person just going to a website to track down the vendors and third parties the website contracts with.
The lawyers should name everyone involved with unauthorized access to your computer as defendants , the obviously innocent parties can be dropped before it gets to trial.
I don't understand how you could arrive at this perspective. If you're doing business with ExampleCorp and one of their subcontractors malfeasantly mishandles things, would you say that ExampleCorp had nothing to do with it? If not, why does that change when the interaction happens via example.com?
I don't think we should try to split accountability at all here.
The ad platform that allows malware to be served to anyone is at fault.
As is the individual website that has selected to allow a 3rd party's code to be delivered to your machine without controlling that risk, often for very silly reasons.
> What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).
Laughable. As countless class action lawsuits have demonstrated the victims are never made whole, the criminals get a slap on the wrist fine that is a tiny fraction of the profit they made doing crime, and the lawyers walk away with pockets filled with cash while nothing changes.
Fine's don't work. Throw some CEOs in jail and things will actually change.
You're wrong on legislating these things. If the ad network is forced into KYC for their ad distributions and they are excluded from safe harbor, like a TV network would be, then I guarantee those ads cease to exist.
This mentality of "it's to hard" doesn't get things done.
I do agree that some greedy lawyers and civil liability would solve this, but that's not a long term solution at all.
I think it would be nice for them to be held accountable but I get the feeling this is part of a wider nation state intelligence apparatus and I doubt that they will hold themselves accountable.
So you search for company A wanting to buy their product. You check out. Basically every setup I've audited has every tracking product ever for everything.
So you buy X, and the company sends that purchase event with your information to Meta, Google, TikTok, Applovin, Klaviyo, and 10 others.
This idea is hopelessly entrenched in every marketing department, who has leadership's ear: We HAVE to send EVERYTHING to EVERYONE otherwise our ROAS will go DOWN!
Every platform works this way, they're all set up to put giant red banners on your marketer's dashboards
"You could be getting 50% better results if you sent <customer_2nd_grade_report_card>!"
This is not the problem. You visiting any website can lead to your computer running the same code.
The main problem is that the exploits from js to code execution or data exfil are possible in the first place. The issue is that you have JS, which is generally pretty isolated, able to talk to bundled libraries (like libwebrtc), which often contain the exploits and share the same memory space. There needs to be a intermediate layer between JS talking to any such library, like process isolation with IPC for communication.
Sure, but there's a big difference between going to a sketchy, malicious site vs a reputable site that does serve ads and now being at the mercy of any arbitrary crap in the ad you didn't choose to see
The barrier to vising a "sketchy website" is minimal. For example, its super easy to have an s3 bucket that serves static html content and get a user to click on it is minimal, not only does the url look valid, but its a common way of hosting content so https is not present.
Not quite. Most people in society are completely oblivious to this happening. And their lack of awareness is why the exploiters don't face more public opposition.
> And add jail time to fines. Fines means nothing for the rich.
This, pretty much. Money removes consequence form your actions. If every time you screwed up, instead of being fined you had to wear a silly hat, go on TV and apologize, or get some time behind bars, even if it were 1 or 2 days it would be very effective.
This was my first question as well. There’s a big gap between “ad network delivers JS” and a zero-click browser exploit. CitizenLab has done some great research including OSINT on the former, but there’s a conspicuous gap between it and the DLL ending up on the victim’s machine.
Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle...
I wonder how we're going to unwind this mess in the upcoming years. It seems as if there was a concerted effort to plan this all out before Trump got elected, and then everything fell into place. They obviously have a post Trump plan ready to go. I partially blame the left(really the moderates) in the U.S. For being so unbelievably complacent that it led us to this mess. I just wonder how we're going to unwind this. Nothing lasts forever, but the transition in between states always tends to be disrupting.
Awful lot of words here, but not much explanation of the actual capabilities of the "zero-click spyware". Tacking on the phrase "zero-click" suggests some kind of browser exploit, but it seems like this is just the same sort of thing as tracking cookies, third-party telemetry etc.
Yes, in fact I skipped to that section. It describes targeting, and then a vague mention of ad impressions leading to "connections" to a C2 server (but the simple fact of contacting a domain doesn't establish C2; anyone can send an AJAX request anywhere). Then they describe a "fingerprint" of servers which appears to consist of... HTTP responses with several blank fields and a claim of running on Apache. Then they say that they found a compromised DLL, which they attribute to the ads based on the DLL hard-coding some domains related to the ad campaign.
But there is nothing explaining how the DLL becomes zero-click compromised by the ad.
> No, their attribution is much more robust than this. Neglecting those details to oversimplify your explanation is intellectually dishonest.
I completely and fundamentally disagree that there is such a robust attribution. I read the section thoroughly and my explanation is not at all oversimplified. Please cite the details that you believe to be relevant here.
> They do, just a little later in that same section: "Both samples use a COM hijack for persistence [...]" through a malicious DLL.
This is not even remotely an explanation of what happened. Giving a name to a phenomenon does not explain it. This does not say how the COM hijack is effected; it does not say how any code escapes the browser sandbox at all; it does not point at a browser vulnerability. Even following through a link to their previous article, the only CVE citations they give are for local privilege escalations (which are described in a very generic way in the CVE database) which would still require a sandbox escape. And even then, it isn't necessarily relevant, as they merely claim "The functionality broadly overlaps with the functionality of the Candiru chain from our 2021 report."
Edit:
Coming back to take a specific stab at your specific question, browser extensions are one glaring possibility.
The shortest version on I can offer is that memory safety, and a number of other glaring holes in common stacks, are left for the same psychological and effort-related reasons that most people secure their home and everything in it with easily-picked Schlage locks,
windows, doors that can be defeated in under 5 seconds, often silently.
Most do not believe tragedy can find them - until it has.
> Most genuinely do not or can not believe tragedy can find them - until it has.
I'm not exactly surprised that vulnerabilities like this are possible. I just wanted the details. Thank you. "WebRTC was vulnerable and allowed access to a longer exploit chain" is the important part in my view.
> Memory safety, and a number of other glaring holes in common stacks, are ignored by the general public
I would venture that "the general public" has no concept of "memory safety" in the first place.
How paranoid should one be of, say for example, a wasm vulnerability exploited on zero day by a bad JS ad?
I am scared for my parents to get exposed to this kind of thing from bad ad network actors. Does anyone have some practical concrete recommendations they took? Like I don't think they can install ublock origin and whitelist sites on demand in Firefox they way I do.
The only practical thing right now is to make sure they don't have the money on device and have 2 fac for email and bank accounts. But every now and then there are phishing attamepts that they could fall prey to.
Install uBlock Origin and don't whitelist any sites. The default filter lists break almost nothing, only once you start including the "annoyances" lists etc. do you start running into significant breakage.
Without an ad blocker, they will be exposed to such an amount of social engineering (ranging from dropshipping sites, to subscription scams, to scam shops that don't ship at all but steal your CC data, to fake sites for government services, to attempts to trick you into installing malware) that you can't expect them to resist it. If installing uBO seems hard, resisting this or cleaning up the consequences is harder.
The amount of "hey have you heard of this great new product I saw" <photo of a handwritten note of the content of a scam site> went down from weekly to near zero once I got a relative to use an ad blocking browser.
As much as it sucks for the ecosystem that's built itself up around the world wide web, good ad blockers and fingerprinting protection are as important as firewalls and antiviruses now. There's no more babies in this fetid bathwater.
Incredible that they don't clearly say what the exploit is and what OS/hardware/apps is/are vulnerable. Still, quite a lot of interesting info about the modern ad delivery networks sewer system...
Why would anyone trust any Israeli cybersecurity firm at this point? Any website or service knowingly utilizing their services is a huge risk. They're already deeply embedded in federal and local governments so there is a strong sense of doom.
AdTech engineer here (some 13 years in the industry). A couple of notes:
- The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.
- To the point below that "ad providers should be held responsible." There is no such thing as "ad provider." The AdTech ecosystem is teeming with different niches and business models - see the famous LUMAscapes diagrams: https://lumapartners.com/lumascapes/ . The sheer volume of traffic makes it virtually impossible to vet even a fraction of it. Google has thrown a lot of compute power to pre-scan 3p creatives and even then bad actors can sneak through. Add to this a lot of sophistication on their side (from different landing pages based on the perception of the type of user to farming throw-away advertiser accounts aimed at running just one campaign like that to hijacking legit accounts through sophisticated technical and people engineering means). In the end, politicians full of indignation do what politicians always do - sue or fine Google and call it a victory, whereas the true bad actors just keep going.
Your appeal to authority as an "AdTech Engineer" works against you when support your own industry. You have a conflict of interest. Of course you will try to do damage control and PR.
I was surprised by the opening statement too. These guys are the literal scourge of the modern web and he's proud he's been at it for 13 years? Not sure we're on the same page, lol.
I don't have any conflict of interest. I'm proud of my work and I think it is great. I personally dislike ads as much as the other guy, but I am pragmatic and I have enough sense to understand that this economics has flourished because it maximizes common good: content creators are incentivised to produce good content and get properly and sustainably rewarded, regular users don't get nickel and dimed every time they load some web page.
To paraphrase Churchill, it is a terrible model but others are worse.
If a website serves me malware, the website's owner should be liable to me. They may then be able to sue someone else, in turn. But I chose to interact with them and then they chose to outsource stuff to crooks.
This would be complicated to implement. But it's absolutely doable.
No, it's not. It completely upsets the economics of content management and makes it absolutely impractical for content owners to monetize through ads. No ad revenue would be worth such liability.
Then there are all kinds of fun scenarios - from drive-by malware to landing page malware to malware served after clicking an ad ON A LANDING PAGE. Who would assume responsibility for those?
Bottom line, this is not much different from "regular" crime. It happens. Governments employ police and various deterrents to reduce it. But it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness.
I think we currently are - but not because of online ads. :-)
My main concern is supply chain attacks. I'm afraid, the frequency and sophistication of such attacks will only increase, thanks to really powerful LLMs. From there - to running keyloggers and stealing your bank credentials etc.
"in-part because of ads" seems more reasonable, tbh.
When I worked at an adtech company almost ten years ago, this sort of shit was the exact concern of me and my colleagues. We've had time to do better but guess we're just fucked.
What, your ad provider would just need to indemnify you for the consequences of their own fuckups. This is pretty basic stuff.
As for the ad provider, it is trivial to not deliver criminal payloads if your business starts from the assumption that doing so is costly instead of something you can foist on society for your own benefit.
> completely upsets the economics of content management and makes it absolutely impractical for content owners to monetize through ads
Why? An insurance product wouldn't wipe out ad revenues.
> this is not much different from "regular" crime. It happens
Why do you think parking lots have signs that say they aren't responsible for goods stolen out of cars parked there? Because that liability, by default, exists. And if a parking lot is a robbery hotspot, and the owners don't bother putting up cameras or whatnot, they'll absolutely start facing lawsuits and investigations.
> it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness
Nobody argued as much. That doesn't mean we give negligent actors monetizing malware a free pass.
> It completely upsets the economics of content management
Exactly. It moves the economic incentives from "serve the ads from the highest bidder and turn a blind eye to the fact that that's a scammer/malware" to "drop an ad platform that can't or won't keep the scammers/malware out".
Or even better, refusing to use ad platforms that let the ads serve arbitrary code. There is no strict reason why an ad can't be an image (re-rendered by the platform) and a link. Slapping scripts all over the place just makes it easier to collect data (among other things to verify that all the companies involved in serving your ad aren't cheating you, because the ecosystem is full of scammers in all directions).
The deterrent here would be prosecuting the accomplices involved in, and directly getting paid for, the crime.
But it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness.
How can you exercise situational awareness against a zero-day attack?
There are several parties who have an opportunity to detect that problem before it causes serious damage to people visiting a website. The visitors themselves are not among them. Trying to make those visitors responsible for the consequences is nonsensical.
And this would motivate fundamental change in the industry to be able to track down the bad actors.
KYC exists for various industries in order to track down the person responsible for bad actions. Implement KYC for the advertising chain, or something equivalent, to ensure there's a validly registered sue-able entity at the end of it.
> be mindful and exercise situational awareness
I'm not going to say victim blaming, but a good percentage of the population just aren't capable of this, especially with "the sheer scale" of advertising they're exposed to. It's exhausting to be on guard for the entirety of your life.
Might as well say: don't use the internet. That might actually be the best advice to come from all this.
This was my main question as well. I read the report, but I'm still not clear on what the browser vulnerability is. This clearly seems like something browser vendors should be able to patch, correct?
The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited. The step-by-step info graphic in the article literally skips over how the infection actually occurs.
>The sheer volume of traffic makes it virtually impossible to vet even a fraction of it
No, it doesn't. Your company is too much of a cheap fuck to do it and would rather offload that cost on society, no matter how bad the effects of it is.
>There is no such thing as "ad provider."
Only when it's to your advantage, because you're very happy to refer to yourself as an ad provider in every single marketing piece.
>AdTech engineer here (some 13 years in the industry)
You've made the world miserable for the past 13 years and have the gall to come over and pretend you're a poor innocent little thing who can't do nothing UwU there's just too much how could we be held responsible.
Not to jump on you after everyone else did (although I agree with them), but they didn't give you a solution. The solution is unfortunately for everyone a robust KYC regime. Then the linkages stop being impossible to track and instead become merely burdensome.
Obvious sarcasm aside, I compel you to ponder on this question next time you read "free" content on the web (a newspaper, a dedicated niche site or anything in between).
Former Adtech dev here - yeah, that justification worked for me for a while but when I was ordered to "just go look at this porn site and figure out what they're doing to open popunders despite the latest browser updates and then apply it to our adverts" too many times, I jumped ship.
But sure, "free content cos adverts", you keep believing that for as long as you can, I jumped ship after 13 years of it, which ironically appears to be how long you've been in the industry.
Let me just say though - adverts can still support free content without all the absolutely scummy things the adtech industry does. You don't have to track users across everything you can possibly track them across to still make money - my former company at one point was going to partner with Shazam to track people via transponders in bus-stop / train station billboards.
That's not "supporting the free Internet", that's "making some amoral shareholders richer".
Hopefully you'll figure out the difference with a few more years under your belt.
Most free works on the web is produced by users who receive absolutely zero ad money or any direct compensation whatsoever.
If anything, the ad industry helps kill honest contributions because they financially reward dishonest ones who are better at playing the SEO game or other such tactics than they are at giving visitors what they are actually looking for.
And at the end of the day, ad-supported content isn't free at all because we all pay for it in the end - and much more than what the website receives because there are entire industries inbetween that take their cut.
Honestly, if a bunch of adverts going away got rid of "free" content, would that be all that bad? Most of the quality free content does not have ads on it. Ad supported content, or at least those using traditional ad networks, tends to be bottom of the barrel.
After all, this website doesn't have (traditional) ads
This argument reminds me of when I dealt with telecommunication providers in a law enforcement context.
Their argument was often that the complexities and volume of data, messages, devices just made it impossible for them to help law enforcement even when justified. Almost as if they were apologetic -- they simply cannot help!
But I was in a room once with a very senior police official, prosecutor and several telco reps when the simple question was asked: why is it not impossible then also to do billing?
Every time the conversation moved away from this point, it was forced to return by the non telco members: they knew it would cost money for the telco to help. And any argument against that was simply foregoing that cost at the expense of the safety or well-being of the public, and was unacceptable.
You may feel (in my example) their are many arguments against state surveillance, but the core truth is that all of these ad providers could indeed have systems that at least attempt to prevent this kind of activity -- it would just reduce profits to do so.
Lastly on the zero click lack of detail: it's kind of irrelevant. The exploit might be complicated, but the vector is clear -- the ad network.
> The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.
It read to me like it was assumed to be using OS/browser/application-level exploits to get further access to target devices. I suspect the CitizenLab report is light on details in particular because they don't actually know them:
> In most cases, the user who sees the ad is not selected for targeting, and the server will not return any JavaScript to be executed.
> A large number of ads placed by Discover-Tech contain a script tag pointing back to what the company refers to as a “NOAS server” (also called a “getAd server”). This tag causes the ad, when rendered, to connect back to Discover-Tech, submit advertising identifiers for the user (either a cookie ID or a mobile ad ID), and automatically execute any JavaScript code returned. The NOAS server decides, apparently based on a combination of the source IP address and the advertising identifiers, whether the target is eligible to receive any JavaScript. If so, then code is returned. If not, a 0-byte response is returned. The NOAS server is a key part of Discover-Tech’s strategy, allowing Discover-Tech to avoid directly sharing malicious code, or even pointers to malicious code, with the companies who serve and display the ads.
I think the simple argument here is that the ad ecosystem should be rebuilt on the default assumption being that ad creatives should be an image and a link with no support for arbitrary rich content.
It would break the long tail of the ad ecosystem, but a bunch of people think the tradeoff is fine.
Given how much of online advertising is now in walled gardens rather than display ads, I think this shows this is more doable than the people who are part of the open ecosystem want it to be.
I and many people believe that google intentionally chooses to keep harmful ads (deceptive, scamming, or leading to malware) this is because it's often very blatant and often survives being reported
Google is able to provide an AI-generated answer for every query, yet somehow can't use the same AI to check whether the sponsored result is an obvious scam.
Not sure why this guy is getting a lot of shit. I play at adops, but I haven't done much with it since we set everything up.
Ads drive the internet. Sorry, but it's true. And you, the technical people, have no real idea of the scale. I don't like ads, but was amused when I had to turn off all my blockers to get stuff done. Many people in the adops world dislike ads, but money.
The point he's making is simple: the ad networks are not responsible for the ad payload. And you might argue the point, but your arguments are worthless. Even finding the entity responsible for the payload will be difficult, and they're probably overseas. Are you going to sue them? No, you're not. Can you actually prove damages, even if you did decide to sue? Probably not.
The structure in the article sounds nefarious, but it's literally the adtech stack. The only thing the company must be doing that's abnormal is tracking all the users in one specific IP range and associating it was a company, likely with their emails. I never touched the targeting section of the stack, but I presume that's possible but not "normal."
It seemed to be that they may not have disclosed everything they discovered, so as not to admit to their own "unauthorized access" to a computer. They stated they got credentials for the cnc server but using it would be unauth access - they implied they didn't.
But they did explain some of the infection nonetheless. A COM exploit on Windows for one.
Browsers are pretty well insulated from arbitrary code execution on the host machine, but I bet android has more vulnerabilities. It wasn't long ago that the webp zero day could pwn anyones device who just looked at an infected webp. (Also Israeli spyware, I believe). Similarily, if Windows apps have ad banners, there could be zero days there as well.
So reading the article, it feels a bit confusing what zero click exploit they are talking about. It sounds like they are talking about CVE-2021-21166, but if they really are talking about an exploit from 5 years ago, i feel like their intro paragraph is rather misleading.
Targets could have been identified using pretty basic advertising and marketing techniques. Bid requests broadcast IP, device details, and ad IDs to every bidder. Intersecting topic audiences across a few months of Al Jazeera stories could narrow that audience to a few individuals. The ad ecosystem already does set-intersection de-anonymization to identify interests and profile customers.
Oh darn, maybe we should just ban the entire online advertising industry. Gosh, what value we'd lose if we couldn't have our personalized attention destroying glitter boxes.
My opinion on web infra patronage has shifted over time, I used to generally accept that for small websites to exist advertising was a necessary evil since they were too niche to have a real revenue source. Then I ran one and I realized that there's far more labor costs involved in maintaining a site than infra costs and that for niche hobbies and communities ten bucks can just find its way into a central pot every month to keep the lights on by those with a bit more to spare.
I am now of the opinion that web communities can survive in the same way arts and other liberal pursuits have always survived. People with a bit more to spare put more into the pot to create the community they want to exist in and "freeloaders" is an alien concept to the genuinely interested since that money is being spent to create a place where meeting can take place without a financial requirement.
>I am now of the opinion that web communities can survive in the same way arts and other liberal pursuits have always survived.
And the only 'users' of these websites will be rich people? Because the moment a paywall goes up on a website it becomes unusable for a large portion of the planet.
Not at all, a few people pay to make it available as a service to others because they want it to exist. It's like this website - there are no (traditional) ads and most of us have paid nothing to use it. A small expenditure creates a good community for technical discussion that the hosts value existing and for being able to occasionally promote their ventures on.
It wouldn't work like that. Yes, there are some exceptions, but that wouldn't work for the vast majority of sites. The rest of them would end up being Facebook pages or Fandom wikis or similar.
I'm not certain how early you saw the internet - but a lot of people threw up websites hosted on consumer quality computers sitting in the corner of their room. Don't underestimate people.
Cool, cool… the “pot of money” model you’re proposing is possible right now, yet is used essentially nowhere outside of substack writers. That’s a very clear signal.
If you ban online advertising, every publisher you know and like will either exit the market or need to use a paywall (which are famously… popular and successful for niche publishers? No.)
You can call online advertising loathsome if you want (indeed a lot of it sucks - no argument!) but it pays for content that everyone consumes. (Unless you only use HN, which is 99% of the time a collection of links to other sites with ads or paywalls or both.)
Regulate online advertising - fine. But “banning” it (what would that even involve?) is not a serious suggestion.
I'm still of the opinion that the end of online advertising would be a significant net benefit to society, if for no other reason then the incentives to keep you interacting with a social network / website / app / media / etc. fade away.
> If you ban online advertising, every publisher you know and like will either exit the market or need to use a paywall (which are famously… popular and successful for niche publishers? No.)
Tons of webforums have donation links or premium memberships. People will pay for their name to be displayed in a different color and basically nothing else, and it's not super hard if you have a few hundred users to pay for servers this way.
It's a fine model so long as you don't need it to scale to one million active users.
For as clever as some of the spy techniques are, they sure don't seem to be very good on opsec.
> We found two world-readable Apache Druid instances running on Discover-Tech’s website mtrtb[.]com. The druid.mtrtb[.]com endpoint contains bidding data for Discover-Tech’s MyDSP platform
Taboola ads is zero click garbage which makes ones eyes bleed. This stuff is just a tad more sinister or a step further than that but along the same lines, more or less.
Back in 2012 The Jester claimed he used targeted spyware to target Mir Islam or Josh the God leader of UGNazi which according to him led to his arrest, though law enforcement never confirmed it.
Interestingly enough they have his laptop he used for a while in a museum.
The lesson from story: Install adblockers on all your devices
Given whom did this attack, I would not be surprised if it was used as intel for strikes on journalists.
There are reliable sources from inside the Israeli Intelligence apparatus that decisions were made to sacrifice 500+ innocent civilians to carry out a strike on one human target. I bet such a strike would be more likely if spyware indicated that one of the innocents was an "enemy" journalist.
143 comments
[ 1.7 ms ] story [ 34.0 ms ] threadThen you can drastically reduce the mobile in browser block list which helps a lot with battery
Hope we follow guidelines under this link or “then nobody gets it!”
Based on responses from roughly 46,700 people assessing 129 countries, X ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
https://www.middleeastmonitor.com/20260513-israel-becomes-wo...
I've witnessed consumer apps throwing quite heinous malware/sketchware advertisements and watched the banners rotate between 4-5 different ad vendors to keep things hot and spicy.
A regulation here that applies to all app stores is even business friendly as an appstore which wanted to do this already wouldn’t be punished by trying to do this on their own, for the reasons you mentioned.
How is this acceptable for society goes beyond me. And then corporations blame individuals when they get scammed. It is your fault that we have all your information and leak it everywhere, when it is not just directly sold.
And add jail time to fines. Fines means nothing for the rich.
People in the US have a unique window of opportunity starting TODAY (Oct 2026) in many places with early voting. I implore everyone who is able to vote in the midterms to do so.
What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).
If they win the landscape will change. It would set a precedent for civil liability for infecting your users even when it's not your content directly. That would likely spook the shit out of the market, security becomes a feature.
Attacking a single website does nothing. If you bankrupt the site, there are millions more sites. If you attack the ad provider, bankrupting it, and shutting it down, millions of sites are now protected.
Your logic just doesn't compute
Sure it did. The content coming from elsewhere doesn’t change their decision to include it when the user loads their page. It makes it wildly important.
This is no different than the “I’m too big, can’t tell what my subsidiaries are doing!” wink
Pay attention, do due diligence to do things correctly, or don’t do them.
It shouldn't fall on the person just going to a website to track down the vendors and third parties the website contracts with.
The ad platform that allows malware to be served to anyone is at fault.
As is the individual website that has selected to allow a 3rd party's code to be delivered to your machine without controlling that risk, often for very silly reasons.
Laughable. As countless class action lawsuits have demonstrated the victims are never made whole, the criminals get a slap on the wrist fine that is a tiny fraction of the profit they made doing crime, and the lawyers walk away with pockets filled with cash while nothing changes.
Fine's don't work. Throw some CEOs in jail and things will actually change.
This mentality of "it's to hard" doesn't get things done.
I do agree that some greedy lawyers and civil liability would solve this, but that's not a long term solution at all.
So you search for company A wanting to buy their product. You check out. Basically every setup I've audited has every tracking product ever for everything.
So you buy X, and the company sends that purchase event with your information to Meta, Google, TikTok, Applovin, Klaviyo, and 10 others.
This idea is hopelessly entrenched in every marketing department, who has leadership's ear: We HAVE to send EVERYTHING to EVERYONE otherwise our ROAS will go DOWN!
Every platform works this way, they're all set up to put giant red banners on your marketer's dashboards
"You could be getting 50% better results if you sent <customer_2nd_grade_report_card>!"
Too bad no one has the guts to enforce the law that way.
The main problem is that the exploits from js to code execution or data exfil are possible in the first place. The issue is that you have JS, which is generally pretty isolated, able to talk to bundled libraries (like libwebrtc), which often contain the exploits and share the same memory space. There needs to be a intermediate layer between JS talking to any such library, like process isolation with IPC for communication.
Easy, when your society glorifies and deifies greed, you can excuse literally any act so long as it makes enough money.
That's it. That's the entire explanation. It's capitalism and greed.
Not quite. Most people in society are completely oblivious to this happening. And their lack of awareness is why the exploiters don't face more public opposition.
This, pretty much. Money removes consequence form your actions. If every time you screwed up, instead of being fined you had to wear a silly hat, go on TV and apologize, or get some time behind bars, even if it were 1 or 2 days it would be very effective.
The CTO happens to have worked for Radware
https://radware.com/
https://www.innovid.com/about-us/news/mediaocean-completes-a...
Hahaha, mercenary spyware and integrity in the same sentence, jfc
https://citizenlab.ca/research/how-discover-tech-turned-targ...
But there is nothing explaining how the DLL becomes zero-click compromised by the ad.
No, their attribution is much more robust than this. Neglecting those details to oversimplify your explanation is intellectually dishonest.
> there is nothing explaining how the DLL becomes zero-click compromised [...]
They do, just a little later in that same section: "Both samples use a COM hijack for persistence [...]" through a malicious DLL.
https://attack.mitre.org/techniques/T1546/015/
I completely and fundamentally disagree that there is such a robust attribution. I read the section thoroughly and my explanation is not at all oversimplified. Please cite the details that you believe to be relevant here.
> They do, just a little later in that same section: "Both samples use a COM hijack for persistence [...]" through a malicious DLL.
This is not even remotely an explanation of what happened. Giving a name to a phenomenon does not explain it. This does not say how the COM hijack is effected; it does not say how any code escapes the browser sandbox at all; it does not point at a browser vulnerability. Even following through a link to their previous article, the only CVE citations they give are for local privilege escalations (which are described in a very generic way in the CVE database) which would still require a sandbox escape. And even then, it isn't necessarily relevant, as they merely claim "The functionality broadly overlaps with the functionality of the Candiru chain from our 2021 report."
and they’re just as troublesome as they were before,
to the degree they’re provably being used to decide who to send malicious payloads to…
Zero-click simply highlights if the user needs to actively interact with the malicious payload - or not.
The shortest version on I can offer is that memory safety, and a number of other glaring holes in common stacks, are left for the same psychological and effort-related reasons that most people secure their home and everything in it with easily-picked Schlage locks,
windows, doors that can be defeated in under 5 seconds, often silently.
Most do not believe tragedy can find them - until it has.
I'm not exactly surprised that vulnerabilities like this are possible. I just wanted the details. Thank you. "WebRTC was vulnerable and allowed access to a longer exploit chain" is the important part in my view.
> Memory safety, and a number of other glaring holes in common stacks, are ignored by the general public
I would venture that "the general public" has no concept of "memory safety" in the first place.
All a game, with liabilities abstracted away to customer service and two factor texts.
I am scared for my parents to get exposed to this kind of thing from bad ad network actors. Does anyone have some practical concrete recommendations they took? Like I don't think they can install ublock origin and whitelist sites on demand in Firefox they way I do.
The only practical thing right now is to make sure they don't have the money on device and have 2 fac for email and bank accounts. But every now and then there are phishing attamepts that they could fall prey to.
Without an ad blocker, they will be exposed to such an amount of social engineering (ranging from dropshipping sites, to subscription scams, to scam shops that don't ship at all but steal your CC data, to fake sites for government services, to attempts to trick you into installing malware) that you can't expect them to resist it. If installing uBO seems hard, resisting this or cleaning up the consequences is harder.
The amount of "hey have you heard of this great new product I saw" <photo of a handwritten note of the content of a scam site> went down from weekly to near zero once I got a relative to use an ad blocking browser.
- The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.
- To the point below that "ad providers should be held responsible." There is no such thing as "ad provider." The AdTech ecosystem is teeming with different niches and business models - see the famous LUMAscapes diagrams: https://lumapartners.com/lumascapes/ . The sheer volume of traffic makes it virtually impossible to vet even a fraction of it. Google has thrown a lot of compute power to pre-scan 3p creatives and even then bad actors can sneak through. Add to this a lot of sophistication on their side (from different landing pages based on the perception of the type of user to farming throw-away advertiser accounts aimed at running just one campaign like that to hijacking legit accounts through sophisticated technical and people engineering means). In the end, politicians full of indignation do what politicians always do - sue or fine Google and call it a victory, whereas the true bad actors just keep going.
To paraphrase Churchill, it is a terrible model but others are worse.
If a website serves me malware, the website's owner should be liable to me. They may then be able to sue someone else, in turn. But I chose to interact with them and then they chose to outsource stuff to crooks.
This would be complicated to implement. But it's absolutely doable.
Then there are all kinds of fun scenarios - from drive-by malware to landing page malware to malware served after clicking an ad ON A LANDING PAGE. Who would assume responsibility for those?
Bottom line, this is not much different from "regular" crime. It happens. Governments employ police and various deterrents to reduce it. But it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness.
My main concern is supply chain attacks. I'm afraid, the frequency and sophistication of such attacks will only increase, thanks to really powerful LLMs. From there - to running keyloggers and stealing your bank credentials etc.
When I worked at an adtech company almost ten years ago, this sort of shit was the exact concern of me and my colleagues. We've had time to do better but guess we're just fucked.
"But not because of <industry I am employed by>"
As for the ad provider, it is trivial to not deliver criminal payloads if your business starts from the assumption that doing so is costly instead of something you can foist on society for your own benefit.
Why? An insurance product wouldn't wipe out ad revenues.
> this is not much different from "regular" crime. It happens
Why do you think parking lots have signs that say they aren't responsible for goods stolen out of cars parked there? Because that liability, by default, exists. And if a parking lot is a robbery hotspot, and the owners don't bother putting up cameras or whatnot, they'll absolutely start facing lawsuits and investigations.
> it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness
Nobody argued as much. That doesn't mean we give negligent actors monetizing malware a free pass.
Exactly. It moves the economic incentives from "serve the ads from the highest bidder and turn a blind eye to the fact that that's a scammer/malware" to "drop an ad platform that can't or won't keep the scammers/malware out".
Or even better, refusing to use ad platforms that let the ads serve arbitrary code. There is no strict reason why an ad can't be an image (re-rendered by the platform) and a link. Slapping scripts all over the place just makes it easier to collect data (among other things to verify that all the companies involved in serving your ad aren't cheating you, because the ecosystem is full of scammers in all directions).
The deterrent here would be prosecuting the accomplices involved in, and directly getting paid for, the crime.
How can you exercise situational awareness against a zero-day attack?
There are several parties who have an opportunity to detect that problem before it causes serious damage to people visiting a website. The visitors themselves are not among them. Trying to make those visitors responsible for the consequences is nonsensical.
And this would motivate fundamental change in the industry to be able to track down the bad actors.
KYC exists for various industries in order to track down the person responsible for bad actions. Implement KYC for the advertising chain, or something equivalent, to ensure there's a validly registered sue-able entity at the end of it.
> be mindful and exercise situational awareness
I'm not going to say victim blaming, but a good percentage of the population just aren't capable of this, especially with "the sheer scale" of advertising they're exposed to. It's exhausting to be on guard for the entirety of your life.
Might as well say: don't use the internet. That might actually be the best advice to come from all this.
The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited. The step-by-step info graphic in the article literally skips over how the infection actually occurs.
No, it doesn't. Your company is too much of a cheap fuck to do it and would rather offload that cost on society, no matter how bad the effects of it is.
>There is no such thing as "ad provider."
Only when it's to your advantage, because you're very happy to refer to yourself as an ad provider in every single marketing piece.
>AdTech engineer here (some 13 years in the industry)
You've made the world miserable for the past 13 years and have the gall to come over and pretend you're a poor innocent little thing who can't do nothing UwU there's just too much how could we be held responsible.
It’s a choice, and on the other side of that choice is profit.
I also have a choice. I choose to filter out as many ads I can. That is my vetting process.
How do you even plan to explain it to your grand-children?
https://www.therage.co
But sure, "free content cos adverts", you keep believing that for as long as you can, I jumped ship after 13 years of it, which ironically appears to be how long you've been in the industry.
Let me just say though - adverts can still support free content without all the absolutely scummy things the adtech industry does. You don't have to track users across everything you can possibly track them across to still make money - my former company at one point was going to partner with Shazam to track people via transponders in bus-stop / train station billboards.
That's not "supporting the free Internet", that's "making some amoral shareholders richer".
Hopefully you'll figure out the difference with a few more years under your belt.
If anything, the ad industry helps kill honest contributions because they financially reward dishonest ones who are better at playing the SEO game or other such tactics than they are at giving visitors what they are actually looking for.
And at the end of the day, ad-supported content isn't free at all because we all pay for it in the end - and much more than what the website receives because there are entire industries inbetween that take their cut.
After all, this website doesn't have (traditional) ads
Their argument was often that the complexities and volume of data, messages, devices just made it impossible for them to help law enforcement even when justified. Almost as if they were apologetic -- they simply cannot help!
But I was in a room once with a very senior police official, prosecutor and several telco reps when the simple question was asked: why is it not impossible then also to do billing?
Every time the conversation moved away from this point, it was forced to return by the non telco members: they knew it would cost money for the telco to help. And any argument against that was simply foregoing that cost at the expense of the safety or well-being of the public, and was unacceptable.
You may feel (in my example) their are many arguments against state surveillance, but the core truth is that all of these ad providers could indeed have systems that at least attempt to prevent this kind of activity -- it would just reduce profits to do so.
Lastly on the zero click lack of detail: it's kind of irrelevant. The exploit might be complicated, but the vector is clear -- the ad network.
It read to me like it was assumed to be using OS/browser/application-level exploits to get further access to target devices. I suspect the CitizenLab report is light on details in particular because they don't actually know them:
> In most cases, the user who sees the ad is not selected for targeting, and the server will not return any JavaScript to be executed.
> A large number of ads placed by Discover-Tech contain a script tag pointing back to what the company refers to as a “NOAS server” (also called a “getAd server”). This tag causes the ad, when rendered, to connect back to Discover-Tech, submit advertising identifiers for the user (either a cookie ID or a mobile ad ID), and automatically execute any JavaScript code returned. The NOAS server decides, apparently based on a combination of the source IP address and the advertising identifiers, whether the target is eligible to receive any JavaScript. If so, then code is returned. If not, a 0-byte response is returned. The NOAS server is a key part of Discover-Tech’s strategy, allowing Discover-Tech to avoid directly sharing malicious code, or even pointers to malicious code, with the companies who serve and display the ads.
It would break the long tail of the ad ecosystem, but a bunch of people think the tradeoff is fine.
Given how much of online advertising is now in walled gardens rather than display ads, I think this shows this is more doable than the people who are part of the open ecosystem want it to be.
Ads drive the internet. Sorry, but it's true. And you, the technical people, have no real idea of the scale. I don't like ads, but was amused when I had to turn off all my blockers to get stuff done. Many people in the adops world dislike ads, but money.
The point he's making is simple: the ad networks are not responsible for the ad payload. And you might argue the point, but your arguments are worthless. Even finding the entity responsible for the payload will be difficult, and they're probably overseas. Are you going to sue them? No, you're not. Can you actually prove damages, even if you did decide to sue? Probably not.
The structure in the article sounds nefarious, but it's literally the adtech stack. The only thing the company must be doing that's abnormal is tracking all the users in one specific IP range and associating it was a company, likely with their emails. I never touched the targeting section of the stack, but I presume that's possible but not "normal."
But they did explain some of the infection nonetheless. A COM exploit on Windows for one.
Browsers are pretty well insulated from arbitrary code execution on the host machine, but I bet android has more vulnerabilities. It wasn't long ago that the webp zero day could pwn anyones device who just looked at an infected webp. (Also Israeli spyware, I believe). Similarily, if Windows apps have ad banners, there could be zero days there as well.
https://404privacy.com/blog/how-israel-used-ad-auctions-to-d...
My opinion on web infra patronage has shifted over time, I used to generally accept that for small websites to exist advertising was a necessary evil since they were too niche to have a real revenue source. Then I ran one and I realized that there's far more labor costs involved in maintaining a site than infra costs and that for niche hobbies and communities ten bucks can just find its way into a central pot every month to keep the lights on by those with a bit more to spare.
I am now of the opinion that web communities can survive in the same way arts and other liberal pursuits have always survived. People with a bit more to spare put more into the pot to create the community they want to exist in and "freeloaders" is an alien concept to the genuinely interested since that money is being spent to create a place where meeting can take place without a financial requirement.
And the only 'users' of these websites will be rich people? Because the moment a paywall goes up on a website it becomes unusable for a large portion of the planet.
If you ban online advertising, every publisher you know and like will either exit the market or need to use a paywall (which are famously… popular and successful for niche publishers? No.)
You can call online advertising loathsome if you want (indeed a lot of it sucks - no argument!) but it pays for content that everyone consumes. (Unless you only use HN, which is 99% of the time a collection of links to other sites with ads or paywalls or both.)
Regulate online advertising - fine. But “banning” it (what would that even involve?) is not a serious suggestion.
> If you ban online advertising, every publisher you know and like will either exit the market or need to use a paywall (which are famously… popular and successful for niche publishers? No.)
OK.
It's a fine model so long as you don't need it to scale to one million active users.
> We found two world-readable Apache Druid instances running on Discover-Tech’s website mtrtb[.]com. The druid.mtrtb[.]com endpoint contains bidding data for Discover-Tech’s MyDSP platform
https://news.softpedia.com/news/The-Jester-Presents-Project-...
Back in 2012 The Jester claimed he used targeted spyware to target Mir Islam or Josh the God leader of UGNazi which according to him led to his arrest, though law enforcement never confirmed it.
Interestingly enough they have his laptop he used for a while in a museum.
https://www.spymuseum.org/exhibition-experiences/about-the-c...
Given whom did this attack, I would not be surprised if it was used as intel for strikes on journalists.
There are reliable sources from inside the Israeli Intelligence apparatus that decisions were made to sacrifice 500+ innocent civilians to carry out a strike on one human target. I bet such a strike would be more likely if spyware indicated that one of the innocents was an "enemy" journalist.