AdTech engineer here (some 13 years in the industry). A couple of notes:
- The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.
- To the point below that "ad providers should be held responsible." There is no such thing as "ad provider." The AdTech ecosystem is teeming with different niches and business models - see the famous LUMAscapes diagrams: https://lumapartners.com/lumascapes/ . The sheer volume of traffic makes it virtually impossible to vet even a fraction of it. Google has thrown a lot of compute power to pre-scan 3p creatives and even then bad actors can sneak through. Add to this a lot of sophistication on their side (from different landing pages based on the perception of the type of user to farming throw-away advertiser accounts aimed at running just one campaign like that to hijacking legit accounts through sophisticated technical and people engineering means). In the end, politicians full of indignation do what politicians always do - sue or fine Google and call it a victory, whereas the true bad actors just keep going.
Ozzie_osmantoday at 2:30 PM
Obviously not the first time an Israeli tech firm is responsible for these types of exploits, and at this point I'd go so far as saying that any Israeli-based tech company (especially cyber security ones, of which they have a strong industry) should be considered beholden to the government of Israel and hence, probably not trustworthy. How could you be sure whether they will act like a trustworthy independent entity, or compromise your data for the benefit of the state?
My question is, why is Israel so good at this? It seems to be at least the 4th cyber power of the world, after the US, Russia and China, if not actually on par or better.
I guess it is because it has been under the threat of larger enemies from its birth, so it must leverage whatever it has to survive. And once you grow an organization and let it loose, you don't have much control over it anymore, and it grows in the wild like a flower.
bhoustontoday at 1:51 PM
It is standard that companies within a country act in the interests of its security services. Israel has a lot of ad-tech companies and thus it makes sense that they are roped into serving Israel's security services.
This is the same issue that the US government has with Chinese networking companies, it is too easy for the Chinese government to pressure these Chinese networking companies to put in back doors in the interests of national security. The US likely knows this because it pressures its own companies in similar ways.
un-nftoday at 9:46 PM
Targets could have been identified using pretty basic advertising and marketing techniques. Bid requests broadcast IP, device details, and ad IDs to every bidder. Intersecting topic audiences across a few months of Al Jazeera stories could narrow that audience to a few individuals. The ad ecosystem already does set-intersection de-anonymization to identify interests and profile customers.
Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.
Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
slowintoday at 3:44 PM
It's really sad this got taken off the front page (347 points, posted 2 hours ago at the time of this comment). Israel is deeply intertwined with the tech industry and they use tech extensively in extremely hostile ways. It's relevant to this site discussion and the votes demonstrate that. There's no reason to hide the elephant in the room, let's address it, now is the time.
joshAgtoday at 6:49 PM
As much as it sucks for the ecosystem that's built itself up around the world wide web, good ad blockers and fingerprinting protection are as important as firewalls and antiviruses now. There's no more babies in this fetid bathwater.
schleck8today at 2:01 PM
This is even crazier than the last time Citizen Lab found an Israeli zero-click spyware (Pegasus). You could call it a sequel
roscastoday at 6:31 PM
"Researchers also recommend that users at high risk of targeting use ad blockers, disable ad tracking, and regularly reset mobile ad IDs.". Not "recommend". Everyone must use uBlock Origin or at least some type of ad blocker in every device.
Then also mandatory pi-hole on every house.
Even if you are used by Windows OS, you must use an adblocker. Even if you use Chrome. On every browser.
ediamondsciencetoday at 2:41 PM
It's kinda funny that a website with an article titled "Online ads weaponised to deliver āzero-clickā spyware" immediately loads a splash that asks users with adblock installed to disable it.
sbdamantoday at 2:27 PM
>During our analysis of the Controlium platform, we observed that the source code mentioned an endpoint called ā/csv-downloadā, which accepted start and end date parameters. When we sent normal HTTP GET requests to this endpoint without any password, special headers, or authentication token, we received logs showing which users had logged in to Controlium, and from which IP addresses.
Absolute morons.
bigbuppotoday at 2:44 PM
If you work for an ad tech firm you are one of the baddies.
Frierentoday at 3:31 PM
Ads providers should be held responsible for delivering malware. All the tracking (that includes fingerprinting for clients that do not want to be tracked) should also be illegal.
How is this acceptable for society goes beyond me. And then corporations blame individuals when they get scammed. It is your fault that we have all your information and leak it everywhere, when it is not just directly sold.
And add jail time to fines. Fines means nothing for the rich.
bawolfftoday at 8:28 PM
So reading the article, it feels a bit confusing what zero click exploit they are talking about. It sounds like they are talking about CVE-2021-21166, but if they really are talking about an exploit from 5 years ago, i feel like their intro paragraph is rather misleading.
zahlmantoday at 6:28 PM
Awful lot of words here, but not much explanation of the actual capabilities of the "zero-click spyware". Tacking on the phrase "zero-click" suggests some kind of browser exploit, but it seems like this is just the same sort of thing as tracking cookies, third-party telemetry etc.
fergietoday at 1:10 PM
How does this actually work? Are they talking about browser fingerprinting or something else?
iugtmkbdfil834today at 1:22 PM
Looking at the bright side, we might just be able to make people really dislike ads.
itissidtoday at 6:46 PM
How paranoid should one be of, say for example, a wasm vulnerability exploited on zero day by a bad JS ad?
I am scared for my parents to get exposed to this kind of thing from bad ad network actors. Does anyone have some practical concrete recommendations they took? Like I don't think they can install ublock origin and whitelist sites on demand in Firefox they way I do.
The only practical thing right now is to make sure they don't have the money on device and have 2 fac for email and bank accounts. But every now and then there are phishing attamepts that they could fall prey to.
ameliustoday at 1:18 PM
It's fun to see adtech digging a hole for themselves ...
BubbleRingstoday at 3:09 PM
Would installing ad-blocker software give me any protection from this stuff?
Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle...
Incredible that they don't clearly say what the exploit is and what OS/hardware/apps is/are vulnerable. Still, quite a lot of interesting info about the modern ad delivery networks sewer system...
saagarjhatoday at 3:47 PM
Iām a little confused how mobile ad targeting ends up as a DLL hijack?
limagnoliatoday at 4:47 PM
The article contains no information on which browsers are impacted, what exploit is being used, if it has been patched, etc? Does anyone know more about how this ad network is exploiting browsers to install spyware on the users machine?
pelagicAustraltoday at 2:44 PM
You have to go about 5 pages deep on any search, anywhere, before you find something positive about "israel"
pbasistatoday at 4:22 PM
I would be interested in knowing which devices were (or still are) vulnerable to these zero click exploits. And how those exploits (used to) work, specifically.
tintortoday at 8:13 PM
Very strong reason for everyone to install ad-blockers on all of their devices.
freakynittoday at 1:43 PM
Of course, who else could it be.
deletedtoday at 4:38 PM
iamacyborgtoday at 3:45 PM
The fact one of the spyware cos was named after the fish that swims up your dick hole is too funny
jazzyjacksontoday at 8:07 PM
This is what ad networks are for, by the way
kleiba2today at 11:09 AM
uBlock Origin ftw
hn_submittoday at 1:33 PM
I doubt it's that easy to click on a link and install malware without the user knowing. Most browsers are highly secure and finding a zero day isn't that easy these days because both sides use A.I. to find vulnerabilities and to secure against them.
andunietoday at 1:10 PM
Do ad blockers protect against this?
Iolaumtoday at 3:01 PM
Curious if GrapheneOS phones were also vulnerable to this.
Wild guess even if not in this particular case it's best to consider the possibility as non theoretical.
The headline is "Online ads weaponised to deliver āzero-clickā spyware, researchers say"
igleriatoday at 2:11 PM
Probably happens with Russia, US, etc as well, but the "hasbara" campaigns through the years have the effect of making people assume the mossad is all powerful etc etc. You inspire fear on your enemies, but also your friends.
edit: and I have been hasbar'd now for simply stating the fact that making people fear you instead of love you has consequences. oh well.
NelsonMinartoday at 2:40 PM
Once again proving that ads are an unacceptable security threat. All those sites now deploying ad-blocker blockers should assume liability for whatever ad software they force their readers to run.
ecommerceguytoday at 5:51 PM
You can have peace or Israel, not both.
zyngarotoday at 2:31 PM
I wonder who they were facilitating the targeting for given the target countries.
kotaKattoday at 2:50 PM
Apps should be required to disclose every single ad network they use as part of their app store disclosures. I want a lot more transparency as to where the ads are coming from inside the app itself.
I've witnessed consumer apps throwing quite heinous malware/sketchware advertisements and watched the banners rotate between 4-5 different ad vendors to keep things hot and spicy.
Crane992today at 7:01 PM
It doesn't make sense how this is even possible.
prometheus1992today at 3:04 PM
if anyone is well versed with this tech; can this be used to target regular people? how can an average joe protect themselves from this?
gaiagraphiatoday at 7:22 PM
Quite amusing that the Crusader states have exchanged horses, swords and shields for spinny chair, ads, and adblockers.
Wonder what the world's most boring ideological argument will bring us in the year 3027.
All ads should have to appear in an <advertisement> node, and users should have the option of disabling javascript within an advertisement. Make it the fucking law.
the_giraffetoday at 4:19 PM
Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle...
The CTO happens to have worked for Radware
> Related work by the research group Confiant also suggests that Discover-Techās ads have been shown to users of the networks of government entities in Europe and the US, as well as the UN, Nato, the international criminal court and the International Atomic Energy Agency.
Yet we don't sanction Israel nor hold them accountable in any way. Of course they're spying on members of the UN and ICC, of course. Israel is at war with the entire world right now, and my politicians continue to support them. Thankfully many people have woken up, but the situation is dire.
kittikittitoday at 7:58 PM
Why would anyone trust any Israeli cybersecurity firm at this point? Any website or service knowingly utilizing their services is a huge risk. They're already deeply embedded in federal and local governments so there is a strong sense of doom.
throwaway256436today at 2:09 PM
Imagine if Iran did this... Or China, or Russia. But hey, it's Israel - all laws, rules, norms and ethics is suddenly suspended - so everything is ok!
_DeadFred_today at 2:58 PM
Hacker News sure loves to single out one specific country and blanket label. I remember when comments like those in this thread directed against Russia after the Ukraine war heated up were shut down by Dang. But blanket generalizations against Israel?