YHK - yet another hacker news clone

Israeli firm's digital ads enabling installation of 'zero-click' spyware

225 points chunkyslink 1 hour ago 75 comments

fergie 1 hour ago | parent

How does this actually work? Are they talking about browser fingerprinting or something else?

reactordev 1 hour ago | parent

If I had to ponder a guess…

It’s to do with hiding malware/spyware in an image which ends up in your cache on device. I can’t go much further into details but all this takes is for you to visit a site that serves it via ad network.

Israel has been known to have some sneaky spyware in the past with Pegasus.

andunie 1 hour ago | parent

Looks like it's much worse, they get more information due to exploits, and they can take full control of your machine.

Article on the CitizenLab website: https://citizenlab.ca/research/how-discover-tech-turned-targ...

willmadden 10 minutes ago | parent

This should have been the OP.

pelagicAustral 1 hour ago | parent

There is a tinfoil narrative that suggest that entire formats are in bed with intelligence services. It sounds pretty wild, but other zero-click attack vectors have been possible through sabotaging the parsing of file formats. ie. send a message -> hacked. How? the message wasnt even opened. How is, an app like Messenger receives a photo attachment binary, tries to unpack it and in doing so receives an instruction that stops the parser and executes arbitrary instructions.

donutdonot 1 hour ago | parent

With all the AI decompilation going on would it not be possible to find these things in the binary by now?

pelagicAustral 20 minutes ago | parent

Yeah, but you need to know where to look for it, the average person is never going to be able to afford the amount of tokens that will take to find a bug like this, especially if it was implanted on purpose.

Betelbuddy 1 hour ago | parent

Go to LinkedIn, and check how many ex Unit 8200 (a group you never really quit until you are 50)...work for the Apple iOS dev team...

oulipo 51 minutes ago | parent

It's routine for apps like Messenger to pre-download attachments (eg to compute a resized preview of the image etc)

chunkyslink 1 hour ago | parent

How the ad-based spyware actually worked (from the Citizen Lab and Confiant reports):

- It came in through the front door. Discover-Tech ran its own ad-buying platform and was listed as a "certified" vendor by Google and IAB Europe for six years. Nothing was hacked to get in. It bid in ad auctions like any other buyer.

- The ads looked harmless. Plain banners for games, AliExpress deals and an IP-lookup site. Hidden inside each one was a small script that quietly phoned home when the ad loaded.

- Everyone who saw an ad was profiled. The script collected device details, IP addresses and, on many sites, the publisher's own cookies, sometimes including logged-in session tokens. Cookie-syncing with other ad networks built a huge identity graph.

- Only chosen targets got the payload. A gatekeeper server checked each device's ad ID and IP. Most people got nothing back. A selected target got code that handed them off to spyware maker Candiru, and the code was served only once, which made it very hard for researchers to capture.

- The handoff was built to defeat inspection. Encrypted channels, rotating hosting, anti-bot checks and even a fake "Copyright Google" comment to fool human reviewers.

- It worked. At least 45 devices at Al Jazeera were targeted, and spyware was recovered from an infected machine. Its ads also appeared on networks belonging to NATO, the UN, the European Parliament, the ICC and various defence ministries.

- The scale was huge. Billions of bids and ads in nearly 200,000 apps and websites, including Duolingo, Viber, Yahoo Mail, dating apps and period trackers, yet almost no sign of real advertisers or revenue.

Citizen Lab: https://citizenlab.ca/research/how-discover-tech-turned-targ...

Confiant: https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zer...

Citizen Lab also has a shorter executive summary: https://citizenlab.ca/research/exposing-adfection-executive-...

aenis 35 minutes ago | parent

Wait what, so there is no content disarm between companies making ads, and the publishers? They can literally push whatever they want? Wild.

Edit:

the TFA answers: "Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user." Its wild! I thought the ads are sanitized, go through a CDR of sorts, and whatever javascript is permitted is authored by ad networks, not the buyers. Sheesh. Thats just RCE.

iamacyborg 2 minutes ago | parent

> Wait what, so there is no content disarm between companies making ads, and the publishers? They can literally push whatever they want? Wild.

RTB (real-time bidding) does not incentivise publishers to care about what ads are actually being shown to individual users, so long as CPM is maximised.

gruez 27 minutes ago | parent

Did you AI generate this? The wording looks suspicious and sure enough, it's flagged by pangram as AI.

oulipo 52 minutes ago | parent

They use ad network to try to target individual user visiting a page (eg you know your target is a male, 60 years old, living in that area, with a few other checks you can almost uniquely identify your target)

Then the ad network delivers a targeted ad that exploits a vulnerability (eg a broken JPEG decoder that, when sent a bad image, allows to run arbitrary code on your machine), and from there you have access to the computer

andunie 1 hour ago | parent

Do ad blockers protect against this?

Lio 1 hour ago | parent

> Reuters has reported that billions of dollars’ worth of Meta’s ad revenue comes from ads for scams, illegal gambling, pornography and other banned content. In the US, ICE and other government agencies have bought software that uses ad tech data to track people’s movements.

I don't know if an ad blocker protects against Discover-Tech’s Controlium but in general you'd be a fool to allow ads in your browser in at this point. The ad industry is pretty shady all round.

MSFT_Edging 12 minutes ago | parent

For years there was a strong segment of HN commenters who would come on and declare a moral imperative for not using ad blockers and looking at every ad you could in order to support a website.

One must wonder how many were genuine vs an influence op.

c16 1 hour ago | parent

On web, likely. If it's in app mobile then no. Run a DNS ad blocker.

andunie 1 hour ago | parent

Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.

Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.

user43928 1 hour ago | parent

I'm sure Google's latest push to make it inconvenient to install apps from outside Google's Playstore, where Google charges a 30% commission, is going to solve that.

hotelsacher 1 hour ago | parent

> useless as a way to prevent people from being hacked

From being hacked by others. Google was just trying to protect their property, which is the ability to spy on their users' every move. Google themselves really don't need to "hack" their users for that, they already have all the access and all the data they could ever want. And they also have the ability to brick their users' devices at a moment's notice the same as Apple does.

Cider9986 42 minutes ago | parent

>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.

Totally not useless. It costs a lot more to pay a spyware firm then to have an employee send an email / ask a judge (like that's even necessary).

I feel quite confident of my messages privacy on my Pixel with GrapheneOS given most people I message are on iPhones which are second in security to Pixels running GrapheneOS. Not to mention my threat model doesn't include mercenary spyware, as most people's doesn't.

gruez 31 minutes ago | parent

>Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.

If you're talking about the sideloading restrictions those were intended to stop social engineering and scams, not from getting hacked via 0days.

>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.

Source? play services is privileged but not that privileged.

red_admiral 21 minutes ago | parent

However, this hack could have happened whether sideloading was allowed or not.

In fact, following the OP's link to https://citizenlab.ca/research/how-discover-tech-turned-targ..., "the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries" so it's not just apps but ordinary websites you visit in your android chrome browser.

amelius 1 hour ago | parent

It's fun to see adtech digging a hole for themselves ...

classified 1 hour ago | parent

If only! I think we can no longer afford to ignore all these security threats and should make online advertising wholesale illegal. But I won't hold my breath.

ModernMech 53 minutes ago | parent

The ads are getting insane, they're trying to fill every bit of space you can look with ads. You go to a restaurant there's ads on your placemat. You go to the grocery store there's ads in your cart. They put chargers in the parking lot so now there's ads out there.

Streaming services used to be bad enough with ads in the shows, now they put an ad on the screen when you pause it. Peacock just started putting ads in the login screen.

If we don't stop this, pretty soon they're going to have ads in the stars as satellite constellations arrange themselves to sell you Twitter subscriptions. They're not going to stop even when there's an ad no matter where you look.

amelius 7 minutes ago | parent

The moon as a giant Pepsi logo.

fhdkweig 4 minutes ago | parent

> ads in the stars

I'm reminded of the ending of the 2008 film Hancock in which Hancock defaced the moon with a corporate logo. But it was okay because it was "for a good cause".

chii 25 minutes ago | parent

this is why adblock is completely necessary, not just for your eyes, but for security.

iugtmkbdfil834 1 hour ago | parent

Looking at the bright side, we might just be able to make people really dislike ads.

hotelsacher 56 minutes ago | parent

For those who haven't learned their lesson yet, I doubt anything could move the needle.

fhdkweig 13 minutes ago | parent

People have disliked ads since ads existed. Carl Sagan's 1985 book Contact includes a brazillionaire S.R. Hadden who made his fortune by inventing an adblocker for television. https://en.wikipedia.org/wiki/Contact_(novel)

throw0101c 1 hour ago | parent

Actual report from Citizen Lab:

* https://citizenlab.ca/research/how-discover-tech-turned-targ...

hn_submit 1 hour ago | parent

I doubt it's that easy to click on a link and install malware without the user knowing. Most browsers are highly secure and finding a zero day isn't that easy these days because both sides use A.I. to find vulnerabilities and to secure against them.

LtWorf 58 minutes ago | parent

One side uses AI to find them. The other side probably needs to keep the holes open for NSA, as the multiple 0 click root exploits that happened in the past to the iPhone with very similar techniques suggest.

iamnothere 58 minutes ago | parent

It’s not “easy”, it requires a complex infrastructure of exploit devs (who can sell their findings for millions in some cases) and the companies who package these exploits together with implants and sell them.

https://www.packetlabs.net/posts/demystifying-the-market-for...

oulipo 53 minutes ago | parent

"Most browsers are highly secure"... erm no

squidmaster 1 hour ago | parent

Israel has been a nexus of cybercrime for as long as they've been on the internet at all.

https://en.wikipedia.org/wiki/Download_Valley

bhouston 47 minutes ago | parent

It was so successful that IronSource, one of those companies, ended up merging with Unity and I think they got like 25% of the company: https://en.wikipedia.org/wiki/IronSource

motbus3 39 minutes ago | parent

holy cow

jckrichabdkejdb 34 minutes ago | parent

They've also been a nexus of cyber security: Palo Alto Networks, Checkpoint, Wiz, etc are all Israeli companies.

ambicapter 8 minutes ago | parent

The Ones Who Sell The Panic Sell The Cure.

starcast2026 4 minutes ago | parent

Palo Alto Networks is not an Israeli company. But it has acquired many Israeli companies

Matl 3 minutes ago | parent

It's the same skill set, many acquire it via the IDF, so unsurprising.

MisterMunchkin 21 minutes ago | parent

That explains a lot. You're basically just fishing for downloads in your target networks. You don't actually care if anyone clicks the ads in the installers, the sole purpose of the adware is to get arbitrary software running alongside the installer, so that you can compromise their machine.

sdcfgy 6 minutes ago | parent

Also affordable generic drugs. YMMV.

freakynit 53 minutes ago | parent

Of course, who else could it be.

bhouston 45 minutes ago | parent

It is standard that companies within a country act in the interests of its security services. Israel has a lot of ad-tech companies and thus it makes sense that they are roped into serving Israel's security services.

It is no different that Israel's location tracking of StarLink terminals worldwide: https://www.newarab.com/news/israel-tech-firms-can-locate-an...

This is the same issue that the US government has with Chinese networking companies, it is too easy for the Chinese government to pressure these Chinese networking companies to put in back doors in the interests of national security. The US likely knows this because it pressures its own companies in similar ways.

hedora 39 minutes ago | parent

Bills like the US CLOUD Act (there are similar ones in the EU and China) force service providers to illegally spy on people overseas (via unauthorized use of anything they can access—consider Microsoft’s Windows backdoors).

I think the only technical solution available to individuals is to boycott non-verifiably e2ee services and corporate operating systems (especially including android).

igleria 22 minutes ago | parent

A few weeks ago the FBI tipped the Argentinian police that some 15 year old kid from a forgotten had asked chatgpt for ideas to plan a school massacre.

just to confirm your info... https://buenosairesherald.com/society/argentine-teenager-pla...

underlipton 42 minutes ago | parent

Chance of sanctions?

edoceo 23 minutes ago | parent

Zero

dankobgd 42 minutes ago | parent

tel aviv impressed

slowin 35 minutes ago | parent

> Related work by the research group Confiant also suggests that Discover-Tech’s ads have been shown to users of the networks of government entities in Europe and the US, as well as the UN, Nato, the international criminal court and the International Atomic Energy Agency.

Yet we don't sanction Israel nor hold them accountable in any way. Of course they're spying on members of the UN and ICC, of course. Israel is at war with the entire world right now, and my politicians continue to support them. Thankfully many people have woken up, but the situation is dire.

miohtama 30 minutes ago | parent

Israel keeps being dick earns reputation.

Based on responses from roughly 46,700 people assessing 129 countries, Israel ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.

https://www.middleeastmonitor.com/20260513-israel-becomes-wo...

hersko 13 minutes ago | parent

We don't sanction Israel because we are doing it too. Any country with the same capabilities are doing the same thing.

schleck8 34 minutes ago | parent

This is even crazier than the last time Citizen Lab found an Israeli zero-click spyware (Pegasus). You could call it a sequel

icantevenhold 5 minutes ago | parent

Don't call it a comeback, I been here for years Rocking my peers and putting suckas in fear

writtenone 34 minutes ago | parent

archived, no ads or trackers: https://nonograph.com/online-ads-weaponised-to-deliver-zero-...

throwaway256436 26 minutes ago | parent

Imagine if Iran did this... Or China, or Russia. But hey, it's Israel - all laws, rules, norms and ethics is suddenly suspended - so everything is ok!

boxed 13 minutes ago | parent

They do. But "no jews - no news".

igleria 25 minutes ago | parent

Probably happens with Russia, US, etc as well, but the "hasbara" campaigns through the years have the effect of making people assume the mossad is all powerful etc etc. You inspire fear on your enemies, but also your friends.

edit: and I have been hasbar'd now for simply stating the fact that making people fear you instead of love you has consequences. oh well.

sbdaman 8 minutes ago | parent

>During our analysis of the Controlium platform, we observed that the source code mentioned an endpoint called “/csv-download”, which accepted start and end date parameters. When we sent normal HTTP GET requests to this endpoint without any password, special headers, or authentication token, we received logs showing which users had logged in to Controlium, and from which IP addresses.

Absolute morons.

Ozzie_osman 5 minutes ago | parent

Obviously not the first time an Israeli tech firm is responsible for these types of exploits, and at this point I'd go so far as saying that any Israeli-based tech company (especially cyber security ones, of which they have a strong industry) should be considered beholden to the government of Israel and hence, probably not trustworthy.

zyngaro 4 minutes ago | parent

I wonder who they were facilitating the targeting for given the target countries.

karim79 3 minutes ago | parent

Whenever I think of Israeli ad tech one company always springs to mind, which creates some of the worst garbage on the whole Internet.

https://www.taboola.com/

This crap is the worst of the worst.

muslimpeacepriz 3 minutes ago | parent

You know why we never read "Palestinian firm's..."? Arabs are too stupid for building things.

4star3star 2 minutes ago | parent

All ads should have to appear in an <advertisement> node, and users should have the option of disabling javascript within an advertisement. Make it the fucking law.