Israeli spy outfit Discover-Tech spied on internet users through a sprawling network of dodgy online ads that it used to track, surveil, and geolocate internet users. In some instances simply having the firm’s “zero click” spyware ads displayed by devices resulted in infection. The company seemed particularly interested in using ads to surveil and geolocate Starlink users, according to a new Reuters report:
“Researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro (4704.T)
, opens new tab, concluded the Israeli company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX’s Starlink service and that the ads were likely being used to geolocate or otherwise surveil them, according to the six people.”
For some reason TrendAI and Trend Micro originally didn’t formally name Discover-Tech; something only disclosed after follow up reports by both Citizen Lab and New York ad security firm Confiant. According to Citizen Lab, Discover-Tech posed as a legitimate vendor on ad exchanges, but was really just a proxy for outfits like Israel’s Candiru — a spyware company blacklisted by the U.S. government.
Being broadly declared as “certified” and “approved” by unregulated establishment ad vendors and markets allowed Discover-Tech to target people with zero-click malware across more than 120,000 websites and 75,000 apps.
“The totality of information gleaned from ad auctions is quite valuable. A company with access to auction data can track users without their knowledge as they move around in physical space, or switch between cellular, Wi-Fi, and VPNs, by observing how bid requests tied to a specific identifier change location or IP address over time. In fact, the surveillance industry sells access to so-called ad intelligence (ADINT) platforms that leverage this sort of data, often combined with third-party tracking data. In recent years, several investigations and media reports have uncovered vendors that sell ADINT to defense, intelligence, and law enforcement agencies.”
Citizen Lab goes on to detail advancements in “zero click” ad-based malware, where simply having the ad displayed is enough to begin the infection process:
“Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user. That code retrieves additional JavaScript code, which may, in turn, load further code, such as a browser exploit to install spyware. Since the code can contain identifiers for the user or their device, arbitrary JavaScript code can be sent precisely to a single user’s device. Our research in this report indicates that this architecture is indeed abused to facilitate the delivery of zero-click targeted spyware, and that the simple display of a targeted ad is enough for infection.”
Last May, Israeli newspaper Haaretz reported that numerous Israeli spyware vendors had begun specifically advertising their ability to locate and spy on Starlink users, of obvious importance in military conflicts in Ukraine.
We’ve noted repeatedly how the U.S. has failed to regulate data brokers and online ad markets for two primary reasons. One, the country is corrupt and repeatedly places online ad revenues above public safety, national security, and even the safety of U.S. troops. And two, the U.S. government also enjoys being able to bypass warrants by buying much of this unregulated data itself.
The end result is an ecosystem poised for widespread exploitation and abuse by a long parade of unethical predators. And despite decades of constant scandal, little seems to change. In fact, U.S. regulators under Trump have actively made life easier on these sorts of bad actors by rolling back even the more modest efforts to regulate online data brokers.
