Why do some of the most evil tech companies, especially ones that use exploits and zero-days as part of their business model, disproportionately originate from the same small (population-wise) country? The company from the article, all the other examples everyone here lists, Candiru, NSO... All Israeli.
One factor is that Israel generally refuses to extradite their citizens who are accused of crimes in foreign countries. So they effectively operate with a certain level of legal immunity.
It isn't all Israel. North Korea, Russia, and Iran have long been known to be where most cyber crime comes from. Israel is there, but they are an also-ran compared to the others. (but Israel does tend to have more sophisticated attacks). The US also has done a large share, but mostly that is government attacks on other governments (that we know of).
Israel has a lot of enemies that going against them. Which is why they have incentive to be good at this - to attack back. Corporate attempts are just ways to make money.
I'm going to stay out of the political issue of what any actor should do.
This is true, but as far as I know, the other countries (except the US, which however is far larger than Israel) keep their cyberwarfare operations mostly internal. There's no public Russian company accessible to any Russian that does what the example companies above do, for instance. It's all government-led. So is the existence of these companies some outcome of the legal or financial system in that country?
Palestinians aside, what reasons do neighboring countries have to hate Israel?
A lot of the immediate neighbors attacked Israel at its birth, and further away countries just seem to hate Israel due to religion/ethnicity/populism (?), countries like Pakistan, Malaysia, etc.
Ethnically cleansing Palestine is reason enough to hate Israel. As an American I’ll add that I hate their influence on my country via bribes and blackmail, and how they strip my rights (anti-BDS laws…) and steal my tax dollars. Spying on everyone via things like the OP don’t help either.
My point is that being at war with your neighbor(s) is not a unique situation, but only Israel has acquired such an extreme abuse-through-tech slant because of it. Why?
My guess (not any more informed than anyone else's) is that it's because they absolutely need US support, and intelligence is one of the few things they could offer them so they invested _a lot_ into it
The same reason why many great tech companies originate from Israel. That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
But something tells me that the way you framed your question, is not about the companies and more about you and how you view Israel.
I in fact tried to word this as neutrally as possible, but people are already seeing ghosts seemingly just because it has a hint of negativity towards the country, which makes sense for the comment because most people agree that these technologies are not actually good for the world.
> The same reason why many great tech companies originate from Israel. That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
You never specified what the reason for that. Their society doesn't seem more tech-oriented than comparable countries. Their universities are OK, but not the best in the world. So what in their society caused this?
If that's your first instinct, then by your standards no country can be criticized for much of anything. After all, pointing out the negative outcomes of a purposefully designed system is the exact same as prejudice based on immutable birth characteristics.
It was so successful that IronSource, one of those companies, ended up merging with Unity and I think they got like 25% of the company: https://en.wikipedia.org/wiki/IronSource
That explains a lot. You're basically just fishing for downloads in your target networks. You don't actually care if anyone clicks the ads in the installers, the sole purpose of the adware is to get arbitrary software running alongside the installer, so that you can compromise their machine.
Guess where the company big AI labs are using for security sandbox is from? The one that was involved in both big hacking scandals from "rogue agents" by OpenAI and Anthropic?
Obviously not the first time an Israeli tech firm is responsible for these types of exploits, and at this point I'd go so far as saying that any Israeli-based tech company (especially cyber security ones, of which they have a strong industry) should be considered beholden to the government of Israel and hence, probably not trustworthy. How could you be sure whether they will act like a trustworthy independent entity, or compromise your data for the benefit of the state?
Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.
Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Totally not useless. It costs a lot more to pay a spyware firm then to have an employee send an email / ask a judge (like that's even necessary).
I feel quite confident of my messages privacy on my Pixel with GrapheneOS given most people I message are on iPhones which are second in security to Pixels running GrapheneOS. Not to mention my threat model doesn't include mercenary spyware, as most people's doesn't.
> useless as a way to prevent people from being hacked
From being hacked by others. Google was just trying to protect their property, which is the ability to spy on their users' every move. Google themselves really don't need to "hack" their users for that, they already have all the access and all the data they could ever want. And they also have the ability to brick their users' devices at a moment's notice the same as Apple does.
>Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.
If you're talking about the sideloading restrictions those were intended to stop social engineering and scams, not from getting hacked via 0days.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Source? play services is privileged but not that privileged.
I'm sure Google's latest push to make it inconvenient to install apps from outside Google's Playstore, where Google charges a 30% commission, is going to solve that.
However, this hack could have happened whether sideloading was allowed or not.
In fact, following the OP's link to https://citizenlab.ca/research/how-discover-tech-turned-targ..., "the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries" so it's not just apps but ordinary websites you visit in your android chrome browser.
It is standard that companies within a country act in the interests of its security services. Israel has a lot of ad-tech companies and thus it makes sense that they are roped into serving Israel's security services.
This is the same issue that the US government has with Chinese networking companies, it is too easy for the Chinese government to pressure these Chinese networking companies to put in back doors in the interests of national security. The US likely knows this because it pressures its own companies in similar ways.
Bills like the US CLOUD Act (there are similar ones in the EU and China) force service providers to illegally spy on people overseas (via unauthorized use of anything they can access—consider Microsoft’s Windows backdoors).
I think the only technical solution available to individuals is to boycott non-verifiably e2ee services and corporate operating systems (especially including android).
It's not "illegaly spy", it' just spy. National security laws make sure that these requests are all legal - from that particular country's point of view who is forcing the provider to supply the info... and illegal from all the other country's point of view.
The root of this problem is that nation states have the final say in what they consider legal. But that difficulty is by design and is very difficult to fix.
> I think the only technical solution available to individuals is to boycott non-verifiably e2ee services
If the world moved that way overnight, I wonder where digital spy budgets would go. Into traditional techniques, cracking encryption, banning encryption, or a more educated guess?
A few weeks ago the FBI tipped the Argentinian police that some 15 year old kid from buenos aires province had asked chatgpt for ideas to plan a school massacre.
In the interest of balance, how many times did the FBI snoop into innocent people’s private lives with no warrant or worse, goaded some weak-minded individuals into planning crimes together in sting operations (i.e. people who needed convincing to commit the crime, so not quite clean but not the masterminds either)?
If you put out a fire how many are you allowed to set while people applaud selectively?
I don’t think they’re striking a good balance between how invasive they are compared to the real results they deliver.
>During our analysis of the Controlium platform, we observed that the source code mentioned an endpoint called “/csv-download”, which accepted start and end date parameters. When we sent normal HTTP GET requests to this endpoint without any password, special headers, or authentication token, we received logs showing which users had logged in to Controlium, and from which IP addresses.
It's kinda funny that a website with an article titled "Online ads weaponised to deliver ‘zero-click’ spyware" immediately loads a splash that asks users with adblock installed to disable it.
The separation between advertising and editorial has never been greater. Brought to you by the marketing wizards who saw you bought a vacuum cleaner on Amazon and concluded you love buying vacuum cleaners so here’s some more.
People have disliked ads since ads existed. Carl Sagan's 1985 book Contact includes a brazillionaire S.R. Hadden who made his fortune by inventing an adblocker for television. https://en.wikipedia.org/wiki/Contact_(novel)
The FBI has previously recommended running adblockers as a method to prevent malware and especially scamming. Nobody cares much.
It’s a low-hanging fruit that has high value, particularly for less savvy internet users. Scams have always been the biggest threat. I’d say the majority of internet ads are scams, and the platforms often don’t make it clear what is or is not an ad.
But, we always knew the risk of malware was there. In the modern age, ads are basically never delivered as static assets. They’re delivered as small applications, with code. So, we’re relying on our sandboxing mechanics to work perfectly, and predictably they don’t. The solution is to block the code altogether; to block ads.
There is a tinfoil narrative that suggest that entire formats are in bed with intelligence services. It sounds pretty wild, but other zero-click attack vectors have been possible through sabotaging the parsing of file formats. ie. send a message -> hacked. How? the message wasnt even opened. How is, an app like Messenger receives a photo attachment binary, tries to unpack it and in doing so receives an instruction that stops the parser and executes arbitrary instructions.
Yeah, but you need to know where to look for it, the average person is never going to be able to afford the amount of tokens that will take to find a bug like this, especially if it was implanted on purpose.
well yes, that is the surface. it's the surface being created with no recourse from the user side, that is intentional... the tinfoil hat theory is that it is, anyway.
It’s to do with hiding malware/spyware in an image which ends up in your cache on device. I can’t go much further into details but all this takes is for you to visit a site that serves it via ad network.
Israel has been known to have some sneaky spyware in the past with Pegasus.
They use ad network to try to target individual user visiting a page (eg you know your target is a male, 60 years old, living in that area, with a few other checks you can almost uniquely identify your target)
Then the ad network delivers a targeted ad that exploits a vulnerability (eg a broken JPEG decoder that, when sent a bad image, allows to run arbitrary code on your machine), and from there you have access to the computer
How the ad-based spyware actually worked (from the Citizen Lab and Confiant reports):
- It came in through the front door. Discover-Tech ran its own ad-buying platform and was listed as a "certified" vendor by Google and IAB Europe for six years. Nothing was hacked to get in. It bid in ad auctions like any other buyer.
- The ads looked harmless. Plain banners for games, AliExpress deals and an IP-lookup site. Hidden inside each one was a small script that quietly phoned home when the ad loaded.
- Everyone who saw an ad was profiled. The script collected device details, IP addresses and, on many sites, the publisher's own cookies, sometimes including logged-in session tokens. Cookie-syncing with other ad networks built a huge identity graph.
- Only chosen targets got the payload. A gatekeeper server checked each device's ad ID and IP. Most people got nothing back. A selected target got code that handed them off to spyware maker Candiru, and the code was served only once, which made it very hard for researchers to capture.
- The handoff was built to defeat inspection. Encrypted channels, rotating hosting, anti-bot checks and even a fake "Copyright Google" comment to fool human reviewers.
- It worked. At least 45 devices at Al Jazeera were targeted, and spyware was recovered from an infected machine. Its ads also appeared on networks belonging to NATO, the UN, the European Parliament, the ICC and various defence ministries.
- The scale was huge. Billions of bids and ads in nearly 200,000 apps and websites, including Duolingo, Viber, Yahoo Mail, dating apps and period trackers, yet almost no sign of real advertisers or revenue.
Wait what, so there is no content disarm between companies making ads, and the publishers? They can literally push whatever they want? Wild.
Edit:
the TFA answers: "Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user." Its wild! I thought the ads are sanitized, go through a CDR of sorts, and whatever javascript is permitted is authored by ad networks, not the buyers. Sheesh. Thats just RCE.
> Wait what, so there is no content disarm between companies making ads, and the publishers? They can literally push whatever they want? Wild.
RTB (real-time bidding) does not incentivise publishers to care about what ads are actually being shown to individual users, so long as CPM is maximised.
If only! I think we can no longer afford to ignore all these security threats and should make online advertising wholesale illegal. But I won't hold my breath.
I don't see how anything in this exploit requires ads. It could just as well be done by enticing the target to view a malicious web page, such as a post in a subreddit the target is known to read, or even by just sending him a link in an email or chat which will often trigger an automatic "preview" of the link in the email or chat client. Or by other social engineering techniques.
The ad-tech network probably does make it easier, because any page that includes their ad network could deliver the malicious ad.
The ads are getting insane, they're trying to fill every bit of space you can look with ads. You go to a restaurant there's ads on your placemat. You go to the grocery store there's ads in your cart. They put chargers in the parking lot so now there's ads out there.
Streaming services used to be bad enough with ads in the shows, now they put an ad on the screen when you pause it. Peacock just started putting ads in the login screen.
If we don't stop this, pretty soon they're going to have ads in the stars as satellite constellations arrange themselves to sell you Twitter subscriptions. They're not going to stop even when there's an ad no matter where you look.
I'm reminded of the ending of the 2008 film Hancock in which Hancock defaced the moon with a corporate logo. But it was okay because it was "for a good cause".
I doubt it's that easy to click on a link and install malware without the user knowing. Most browsers are highly secure and finding a zero day isn't that easy these days because both sides use A.I. to find vulnerabilities and to secure against them.
It’s not “easy”, it requires a complex infrastructure of exploit devs (who can sell their findings for millions in some cases) and the companies who package these exploits together with implants and sell them.
One side uses AI to find them. The other side probably needs to keep the holes open for NSA, as the multiple 0 click root exploits that happened in the past to the iPhone with very similar techniques suggest.
Hacker News sure loves to single out one specific country and blanket label. I remember when comments like those in this thread directed against Russia after the Ukraine war heated up were shut down by Dang. But blanket generalizations against Israel?
> Reuters has reported that billions of dollars’ worth of Meta’s ad revenue comes from ads for scams, illegal gambling, pornography and other banned content. In the US, ICE and other government agencies have bought software that uses ad tech data to track people’s movements.
I don't know if an ad blocker protects against Discover-Tech’s Controlium but in general you'd be a fool to allow ads in your browser in at this point. The ad industry is pretty shady all round.
For years there was a strong segment of HN commenters who would come on and declare a moral imperative for not using ad blockers and looking at every ad you could in order to support a website.
One must wonder how many were genuine vs an influence op.
Once again proving that ads are an unacceptable security threat. All those sites now deploying ad-blocker blockers should assume liability for whatever ad software they force their readers to run.
> Related work by the research group Confiant also suggests that Discover-Tech’s ads have been shown to users of the networks of government entities in Europe and the US, as well as the UN, Nato, the international criminal court and the International Atomic Energy Agency.
Yet we don't sanction Israel nor hold them accountable in any way. Of course they're spying on members of the UN and ICC, of course. Israel is at war with the entire world right now, and my politicians continue to support them. Thankfully many people have woken up, but the situation is dire.
Based on responses from roughly 46,700 people assessing 129 countries, Israel ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
That conflates the state with a business headquartered in it. It begs the question of what the sanctions would be for: is the argument that this firm is an arm of Israel, that Israel turns a blind eye to abusive businesses, or something else?
Yes, obviously the state and this company are the same thing. Why would a private company spy on the ICC and the UN? I’m sure there are plenty of 8200 people involved.
My Democratic Rep (who is a Zionist) voted with the Republican Party to financially sanction and impose visa restrictions on members of the International Criminal Court for issuing an arrest warrant for Netanyahu, so the ICC could hold Netanyahu for trial.
I will never vote for this particular (D) candidate again. Fortunately, the (L) candidate seems reasonable.
If indeed your representatives support Israel or the genocide in Gaza, I urge you to consider voting 3rd party. In two-party elections, candidates mostly just try to be a little better than their opponent. What forces them to do more isn’t a third party actually winning. It’s a real risk that enough fed-up voters will go third-party and cost them the election. This is basic game theory optimization.
All ads should have to appear in an <advertisement> node, and users should have the option of disabling javascript within an advertisement. Make it the fucking law.
Probably happens with Russia, US, etc as well, but the "hasbara" campaigns through the years have the effect of making people assume the mossad is all powerful etc etc. You inspire fear on your enemies, but also your friends.
edit: and I have been hasbar'd now for simply stating the fact that making people fear you instead of love you has consequences. oh well.
https://en.wikipedia.org/wiki/Download_Valley
Pegasus: How a Spy in Your Pocket Threatens the End of Privacy, Dignity, and Democracy by Lauret Richard
Israel has a lot of enemies that going against them. Which is why they have incentive to be good at this - to attack back. Corporate attempts are just ways to make money.
I'm going to stay out of the political issue of what any actor should do.
A lot of the immediate neighbors attacked Israel at its birth, and further away countries just seem to hate Israel due to religion/ethnicity/populism (?), countries like Pakistan, Malaysia, etc.
Wow
But something tells me that the way you framed your question, is not about the companies and more about you and how you view Israel.
> The same reason why many great tech companies originate from Israel. That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
You never specified what the reason for that. Their society doesn't seem more tech-oriented than comparable countries. Their universities are OK, but not the best in the world. So what in their society caused this?
I guess that your concerns are not aligned with reality, or the benefits far outweigh whatever it is you think may happen.
(Talking as an Israeli working in cybersecurity)
It's possible for this to be true, and that they spy on said companies on behalf of the government of Israel. It makes it easier to do so.
* https://citizenlab.ca/research/how-discover-tech-turned-targ...
Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Totally not useless. It costs a lot more to pay a spyware firm then to have an employee send an email / ask a judge (like that's even necessary).
I feel quite confident of my messages privacy on my Pixel with GrapheneOS given most people I message are on iPhones which are second in security to Pixels running GrapheneOS. Not to mention my threat model doesn't include mercenary spyware, as most people's doesn't.
From being hacked by others. Google was just trying to protect their property, which is the ability to spy on their users' every move. Google themselves really don't need to "hack" their users for that, they already have all the access and all the data they could ever want. And they also have the ability to brick their users' devices at a moment's notice the same as Apple does.
If you're talking about the sideloading restrictions those were intended to stop social engineering and scams, not from getting hacked via 0days.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Source? play services is privileged but not that privileged.
In fact, following the OP's link to https://citizenlab.ca/research/how-discover-tech-turned-targ..., "the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries" so it's not just apps but ordinary websites you visit in your android chrome browser.
No info on if a recent version patches this?
It is no different that Israel's location tracking of StarLink terminals worldwide: https://www.newarab.com/news/israel-tech-firms-can-locate-an...
This is the same issue that the US government has with Chinese networking companies, it is too easy for the Chinese government to pressure these Chinese networking companies to put in back doors in the interests of national security. The US likely knows this because it pressures its own companies in similar ways.
I think the only technical solution available to individuals is to boycott non-verifiably e2ee services and corporate operating systems (especially including android).
If the world moved that way overnight, I wonder where digital spy budgets would go. Into traditional techniques, cracking encryption, banning encryption, or a more educated guess?
just to confirm your info... https://buenosairesherald.com/society/argentine-teenager-pla...
If you put out a fire how many are you allowed to set while people applaud selectively?
I don’t think they’re striking a good balance between how invasive they are compared to the real results they deliver.
Can we get an alien invasion already please, god
Wild guess even if not in this particular case it's best to consider the possibility as non theoretical.
Absolute morons.
https://news.ycombinator.com/item?id=50101813
It’s a low-hanging fruit that has high value, particularly for less savvy internet users. Scams have always been the biggest threat. I’d say the majority of internet ads are scams, and the platforms often don’t make it clear what is or is not an ad.
But, we always knew the risk of malware was there. In the modern age, ads are basically never delivered as static assets. They’re delivered as small applications, with code. So, we’re relying on our sandboxing mechanics to work perfectly, and predictably they don’t. The solution is to block the code altogether; to block ads.
Article on the CitizenLab website: https://citizenlab.ca/research/how-discover-tech-turned-targ...
https://citizenlab.ca/research/how-discover-tech-turned-targ...
It’s to do with hiding malware/spyware in an image which ends up in your cache on device. I can’t go much further into details but all this takes is for you to visit a site that serves it via ad network.
Israel has been known to have some sneaky spyware in the past with Pegasus.
Then the ad network delivers a targeted ad that exploits a vulnerability (eg a broken JPEG decoder that, when sent a bad image, allows to run arbitrary code on your machine), and from there you have access to the computer
- It came in through the front door. Discover-Tech ran its own ad-buying platform and was listed as a "certified" vendor by Google and IAB Europe for six years. Nothing was hacked to get in. It bid in ad auctions like any other buyer.
- The ads looked harmless. Plain banners for games, AliExpress deals and an IP-lookup site. Hidden inside each one was a small script that quietly phoned home when the ad loaded.
- Everyone who saw an ad was profiled. The script collected device details, IP addresses and, on many sites, the publisher's own cookies, sometimes including logged-in session tokens. Cookie-syncing with other ad networks built a huge identity graph.
- Only chosen targets got the payload. A gatekeeper server checked each device's ad ID and IP. Most people got nothing back. A selected target got code that handed them off to spyware maker Candiru, and the code was served only once, which made it very hard for researchers to capture.
- The handoff was built to defeat inspection. Encrypted channels, rotating hosting, anti-bot checks and even a fake "Copyright Google" comment to fool human reviewers.
- It worked. At least 45 devices at Al Jazeera were targeted, and spyware was recovered from an infected machine. Its ads also appeared on networks belonging to NATO, the UN, the European Parliament, the ICC and various defence ministries.
- The scale was huge. Billions of bids and ads in nearly 200,000 apps and websites, including Duolingo, Viber, Yahoo Mail, dating apps and period trackers, yet almost no sign of real advertisers or revenue.
Citizen Lab: https://citizenlab.ca/research/how-discover-tech-turned-targ...
Confiant: https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zer...
Citizen Lab also has a shorter executive summary: https://citizenlab.ca/research/exposing-adfection-executive-...
> Don't post generated text or AI-edited text. HN is for conversation between humans.
Edit:
the TFA answers: "Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user." Its wild! I thought the ads are sanitized, go through a CDR of sorts, and whatever javascript is permitted is authored by ad networks, not the buyers. Sheesh. Thats just RCE.
RTB (real-time bidding) does not incentivise publishers to care about what ads are actually being shown to individual users, so long as CPM is maximised.
The ad-tech network probably does make it easier, because any page that includes their ad network could deliver the malicious ad.
Streaming services used to be bad enough with ads in the shows, now they put an ad on the screen when you pause it. Peacock just started putting ads in the login screen.
If we don't stop this, pretty soon they're going to have ads in the stars as satellite constellations arrange themselves to sell you Twitter subscriptions. They're not going to stop even when there's an ad no matter where you look.
I'm reminded of the ending of the 2008 film Hancock in which Hancock defaced the moon with a corporate logo. But it was okay because it was "for a good cause".
https://www.packetlabs.net/posts/demystifying-the-market-for...
Dang's official position by the way https://news.ycombinator.com/item?id=48100358 let's see how this thread goes.
I don't know if an ad blocker protects against Discover-Tech’s Controlium but in general you'd be a fool to allow ads in your browser in at this point. The ad industry is pretty shady all round.
One must wonder how many were genuine vs an influence op.
https://www.taboola.com/
This crap is the worst of the worst.
Yet we don't sanction Israel nor hold them accountable in any way. Of course they're spying on members of the UN and ICC, of course. Israel is at war with the entire world right now, and my politicians continue to support them. Thankfully many people have woken up, but the situation is dire.
Based on responses from roughly 46,700 people assessing 129 countries, Israel ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
https://www.middleeastmonitor.com/20260513-israel-becomes-wo...
I will never vote for this particular (D) candidate again. Fortunately, the (L) candidate seems reasonable.
If indeed your representatives support Israel or the genocide in Gaza, I urge you to consider voting 3rd party. In two-party elections, candidates mostly just try to be a little better than their opponent. What forces them to do more isn’t a third party actually winning. It’s a real risk that enough fed-up voters will go third-party and cost them the election. This is basic game theory optimization.
Israel is at war with Hamas, Iran and its proxies and allies.
edit: and I have been hasbar'd now for simply stating the fact that making people fear you instead of love you has consequences. oh well.