It was so successful that IronSource, one of those companies, ended up merging with Unity and I think they got like 25% of the company: https://en.wikipedia.org/wiki/IronSource
Specifically Unit 8200, which really has no counterpart elsewhere in the world given Israel's mandatory universal conscription. Imagine if you could systematically screen every young adult in a country, identify those with the strongest math/quantitative skills or promising deep tech skills and divert them into one single security special ops org for several years. You'd get the concentration of skill that Unit 8200 has been producing.
North Korea does this too, actually (and like Israel, for both genders). It's probably one of the significant reasons why NK has such a comparatively effective offensive cybersecurity group, despite how unlikely that would seem given their overall industrial capacity.
NK likely also gets a bit of a boost because of the extended length of mandatory service. Males on technical teams have to serve for 13 years.
Russia has historically not had mandatory universal conscription.
Which is surprising that these organizations have trust; like our employers probably wouldn't be comfortable shipping all their code to / embedding agents from cybersecurity firms in Russia
That explains a lot. You're basically just fishing for downloads in your target networks. You don't actually care if anyone clicks the ads in the installers, the sole purpose of the adware is to get arbitrary software running alongside the installer, so that you can compromise their machine.
Why do some of the most evil tech companies, especially ones that use exploits and zero-days as part of their business model, disproportionately originate from the same small (population-wise) country? The company from the article, all the other examples everyone here lists, Candiru, NSO... All Israeli.
Palestinians aside, what reasons do neighboring countries have to hate Israel from it's very first moment?
A lot of the immediate neighbors attacked Israel at its birth, and further away countries just seem to hate Israel due to religion/ethnicity/populism (?), countries like Pakistan, Malaysia, etc.
Ethnically cleansing Palestine is reason enough to hate Israel. As an American I’ll add that I hate their influence on my country via bribes and blackmail, and how they strip my rights (anti-BDS laws…) and steal my tax dollars. Spying on everyone via things like the OP don’t help either.
You don't even need to go that far. These anti-BDS laws are clearly against the constitution and get struck down without issue. The real problem is that it's much easier to create these BS laws and put them on the books than it is to repeal them, because repealing them requires court challenges, lawsuits, and then these supporters go and make alterations to the law to meet the criteria of the challenges and ram them through again. Then we go through this whole cycle all over again. To solve this problem, you really need to go after the public officials that are being pushed to pass this garbage by consistently holding their feet to the fire and not tolerating this with punishments of losing their elections. The country is shifting towards that, but there's so much BS going on elsewhere that this takes a back burner in people's minds.
Well, Syria and Lebanon both hold some pretty serious resentment over the recent landgrabs. With the whole "acquiring buffer zone for the buffer zone" business in former and the population expulsions in the latter.
I answered your question, no need to move the goalposts. Countries usually don't like having their land occupied. As far as I know the Turkish occupation zone in Syria has been dissolved.
That's not really an accurate characterization of the situation as much of the land was uninhabited/unregistered and/or state owned. The Negev desert for example is a large percentage of the total land area and was effectively uninhabited and not privately owned. Land ownership records at the time were also not particularly clear and often there were disputed claims. Also Israel has about 20% Arab/Palestinian citizens so it's not like they ethnically cleansed everyone like Egypt/Jordan did with the Jews in Gaza and the West Bank when Israel gained independence.
The whole idea of Greater Israel would make anyone in the region queasy. The logic is pretty hard to dispute when Israelis claim the lang is God given. The "God given" land actually extends much farther beyond Israel's boundaries so I'd say people of those countries are rightful feel as they do.
Like immagine if the rhetoric of Turkey was constantly talking about expanding to Greece and how the land of Greece is historically the Turks. Obviously that would make any Greek uneasy.
Seeing how things have played out this year, maybe this will end up being their undoing. Israel has made it clear that the next domino to fall after Iran is Turkey. I don't even know how that would work. Isn't Turkey a NATO ally? At some point, this has got to stop. After everything that's come out this year, I wonder if an alternative world where a lot of these Middle Eastern countries developing into stable democracies could have occurred had Israel been contained or never been created.
The idea of “greater Israel” is a bogeyman that lives in the heads of people that hates Israel in several factors of greater numbers than there are people in Israel who believe that.
You can literally count with both hands the amount of people in Israel that advocate for “greater Israel”
> Israel refuses to even define its borders. And current behaviour demonstrates why.
States like Israel formally define their borders via mechanisms like peace deals that include bilateral recognition of agreed upon borders, like Israel has with Egypt and Jordan.
You can't realistically define borders properly otherwise, trying to define borders via unilateral declaration doesn't really work when there are 2 states next to each other, the borders ultimately need to be negotiated bilaterally between those states with both sides recognizing the same borders.
Because Israel invaded a land that had been settled by Arab Muslims for centuries, claimed a portion for itself exclusively, proceeded to ethnically cleanse an even bigger portion, all with the support of their extremely powerful western backers. Asking "why did the others hate them" is like asking "why would Europeans hate the Chinese if they had invaded, settled and ethnically cleansed half of France (with the promise of taking even more later)"?
It isn't really unique to Israel, though. There's conflict practically everywhere where major cultures/religions have drawn up borders, or within the backwash of fading empires (Britain, Ottomans, Soviets, French...).
None of those have as much impact on Americans day to day life as Israel does.
Lets zoom out: The whole world is about to enter a massive economic calamity, all because Americans got tricked into to electing the current knucklehead in the White House who took a ~$300 million bribe from an Israeli supporter to start this war.
None of those other conflicts will affect the entire world as what Israel has done.
> all because Americans got tricked into to electing the current knucklehead in the White House who took a ~$300 million bribe from an Israeli supporter to start this war.
From what you've said. It sounds like America is to blame here, tbh. $300mil is chump change in international bribery/development. If your establishment sells itself so cheaply, that's on America.
Besides, what's happening in Iran is minuscule compared to what happened during the 'War on Terror'. Play imperial games, win imperial prizes.
Agreed, the system needs reform so a country the size of Slovenia can't dictate US actions so easily. Reform is hopefully coming but too slowly.
>Besides, what's happening in Iran is minuscule compared to what happened during the 'War on Terror'. Play imperial games, win imperial prizes.
Disagree, Those wars were confined to an adversary that was already a few rungs down on the ladder and couldn't crash the world economy. Iran is larger than Iraq + Afghanistan combined, has very large mountainous terrain which has a lot of easy hiding spots for drones/launchers, has the fourth largest collection of trained staff in the field of nuclear science (more than France) and even became space launch capable in 2009.
Thats is like night and day difference between Iraq/Afghanistan.
I agree with what you're saying, but I think you're discounting the geopolitical impact the War(s) on Terror had.
America needed to push cheap credit to boost confidence after 9/11, oil prices skyrocketed and haven't really come back down, hugely expensive wars were funded on debt. It's arguable that these all directly contributed to the GFC in substantial ways.
Global confidence in American leadership plummetted since these wars, and opened the door for China and 'multi-polarity' to enter the stage which has caused a new wave of proxy wars as powers are trying to get a piece of the new round of global empires. We have Russia making moves (apparently also kickstarted by Gadaffi's death), UAE and Turkey playing games in the Sahel, dicerolled team selections in Libya, China testing the waters in Myanmar and Laos, fuckeries in Venezuela and Cuba, Syria, Azerbaijan....
If anything, Israel have been baited into their current actions just like America were as new and old powers try and undo 'centuries of shame', etc.
Americans didn't get tricked into electing Trump. Don't let Americans off the hook like they're naive schoolchildren. Americans knew what Trump represented, they were warned vociferously and repeatedly about him, his entire life and his public opinions have been well documented, and he isn't exactly subtle or capable of duplicity.
Jan. 6th wasn't enough to disqualify him from a second term. The Epstein files weren't enough to get him removed from power. ICE wasn't enough to get him removed from power. Blatant disregard for the courts, threatening allies, arbitrary and insane tariff policies weren't enough to get him removed from power. No President in the history of the United States has been as secure in his position as Donald Trump is. The Supreme Court even went out of its way to make him immune from prosecution for any crime he might possibly commit while in office.
Israel may have (probably did) talk Trump into the war but Americans are the reason Trump was in that position to begin with, and he is there because Americans want him there.
>Americans didn't get tricked into electing Trump. Don't let Americans off the hook like they're naive schoolchildren.
The fact that they are still trying last minute fuel price manipulation in the hopes of converting some people into Trumps good graces proves that you are wrong. The country is very large. In 300+ million people you will find a large distribution of people in terms of skills and ability to discern fact from fiction. The bottom 10% of the distribution is still ~30 million people. Some % of these people vote. Lets not even consider the bottom 50% percentile.
>Jan. 6th wasn't enough to disqualify him from a second term. The Epstein files weren't enough to get him removed from power. ICE wasn't enough to get him removed from power. Blatant disregard for the courts, threatening allies, arbitrary and insane tariff policies weren't enough to get him removed from power.
You are conflating two different things. This is a failure of the system. This takes time to reform. There are attempts going back years. When you have so many layers of people who benefit from the existing status quo the only way you speed up the fix this without decades of sludging through roadblocks is if a national calamity happens that finally forces change(economic or other challenge). Otherwise too many people are insulated from the downsides of the system until they aren't anymore and then something changes.
>but Americans are the reason Trump was in that position to begin with, and he is there because Americans want him there.
Objectively this is a stated fact (unless you believe the election was rigged). But it glosses over so much nuance and context.
Russia didn't create Trump. They're not solely responsible for Trump.
The same can be said of Brexit, Victor Orban, AfD, etc. All of these bad things were, nevertheless, boosted by Russian ops with the same general strategic goal in mind.
My point is that being at war with your neighbor(s) is not a unique situation, but only Israel has acquired such an extreme abuse-through-tech slant because of it. Why?
My guess (not any more informed than anyone else's) is that it's because they absolutely need US support, and intelligence is one of the few things they could offer them so they invested _a lot_ into it
One factor is that Israel generally refuses to extradite their citizens who are accused of crimes in foreign countries. So they effectively operate with a certain level of legal immunity.
Yes, in general Israeli intelligence and hacking groups tend to enjoy far fewer consequences when they screw up than their Western counterparts, which then allow them to be far more aggressive.
The perpetrator of the viral "you're stealing my house," "if I don't steal it someone else would steal it," video was purported to be an alleged sex offender who fled to Israel to escape charges.
It isn't all Israel. North Korea, Russia, and Iran have long been known to be where most cyber crime comes from. Israel is there, but they are an also-ran compared to the others. (but Israel does tend to have more sophisticated attacks). The US also has done a large share, but mostly that is government attacks on other governments (that we know of).
Israel has a lot of enemies that going against them. Which is why they have incentive to be good at this - to attack back. Corporate attempts are just ways to make money.
I'm going to stay out of the political issue of what any actor should do.
This is true, but as far as I know, the other countries (except the US, which however is far larger than Israel) keep their cyberwarfare operations mostly internal. There's no public Russian company accessible to any Russian that does what the example companies above do, for instance. It's all government-led. So is the existence of these companies some outcome of the legal or financial system in that country?
Certainly some is antisemitism. To imply, as you have, that there is 0% legitimacy to any other reasons to hate the behavior of the current Israeli government is just as pro-genocide as you claim antisemitism.
Most people I know who oppose Israel's actions in Gaza have no problem with Jewish people; many themselves are Jewish.
No religions are states, that is just your political opinion. I think it's a really toxic opinion because it then leads to the question the potential allegiance to a foreign nation of anyone based on their religion. This is the same reason why a Catholic president was once controversial, because back then people believed there was a Catholic state secretly controlling them.
In my political opinion Israel is an artificially created state which is why it's so unstable and we should cut our losses on this, I believe my opinion is the prevailing populist opinion and y'all have to contend with that.
There needs to be some compromise between our points of view or else we'll continue to get more war and violence. I personally think our country needs to recognize our hand in this mess and should offer land in North America of equivalent value for any Zionist refugees and then leave the poor people of that land alone.
...are also widely considered bad actors. Yet, it isn't "islamophobia" when you criticize Iran or "anti-Orthodox" when you call Russia to account.
Curiously, however, when you similarly criticize the actions of this specific Israeli government and its leaders, you are slandered with the term "antisemite" and there are orgs that exist to doxx you and get you fired from your job.
If that's your first instinct, then by your standards no country can be criticized for much of anything. After all, pointing out the negative outcomes of a purposefully designed system is the exact same as prejudice based on immutable birth characteristics.
No country's people should be blanket stereotyped. That's my first instinct. 'why are people from xyz nation more likely to be associated with(negative thing)....'. nah, fuck that kind of talk.
Where did you see me saying that? I didn't even mention any people or generalize that all of them are this or that. Saying that cyberwarfare companies are more likely to be in Israel, which is what I did, seems like the most objective way of framing my observation. Other replies already gave some good reasons for why that may be, and all of them have to do with the systems built within the country, not some inherent property of their people. They could change these systems if they wanted to, it's not inherent to them.
>Right, this discussion totally isn't being used as a bash Israel/isrealis as inherently bad with lots of blanket statements.
I see lots of (maybe un-carefully-worded, maybe?) bashing of the actions of the current Israeli government, and its defense forces and intel apparatus.
That's 100% fair game, anywhere on the planet.
What's I don't see is the rank antisemitism you claim, except for a few outlier recently-created accounts.
The most despicable thing I see at scale in the conversations is the attempt to silence critics of Israel with slanderous accusations of antisemitism. It used to work, as a tactic, but it (like the "racism card") has been vastly overplayed and is rapidly losing its value.
I went out of my way to write the comment in as neutral of a tone as possible. I didn't even state my opinion on Israel or anything it's involved in to avoid starting a flamewar in what would otherwise be a standard question about adversarial technology and cyberwarfare. The only expressed opinion was about the companies themselves, which I think it more than warranted. Yet, as I said in a sibling comment, people are seeing ghosts anyway and disregard the perfectly normal question because they think I'm not really curious about it and am asking it for nefarious reasons.
Oh well, each individual must be judged on their actions and merits, but this doesn't prevent us from observing how groups behave on average. Nobody ever shouted racism when it's said that French are chauvinistic or that Germans follow rules strictly- it won't and shouldn't tell you anything about single individuals but you know there's a grain of truth in the generalisation.
The same reason why many great tech companies originate from Israel. That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
But something tells me that the way you framed your question, is not about the companies and more about you and how you view Israel.
I in fact tried to word this as neutrally as possible, but people are already seeing ghosts just because it has a hint of negativity towards the country, which should be expected because most people agree that these technologies are not actually good for the world.
> The same reason why many great tech companies originate from Israel. That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
You never said what the reason for that is. Their society doesn't seem more tech-oriented than comparable countries. Their universities are OK, but not the best in the world. So what in their society caused this?
Careful. The trolls are out. Half of them are trying to prove Israel is a nation full of demonstrably evil people, and half of them will tar you with antisemitism if you don't love Bibi and all his works.
This bullshit polarization of ideology ruins civil discourse. It's possible to condemn Hamas' slaughter of innocents, and condemn Israel's slaughter of innocents. And to still realize there are innocent Palestinians and Israelis who are not working to make things worse.
Culturally, Israel has a strong emphasis on entrepreneurship, coupled with general lack of tolerance for bureaucracy, makes for pretty agile organizations.
In the military side, it creates a country sized funnel that picks the best people and places them together trying to solve problems that would seem impossible. When these people are discharged, they are friends that knows how to work best together. Think of it like a larger and more focused version of an Ivy League school
Because they are the best at spying in the world by far, and are willing to splash the cash. They're what Silicon Valley would have been if it kept doing government contracts instead of just selling ads.
If Mossad is willing to give you a hundred million to make your startup a spyware company, you're obviously going to agree.
Their military is very good at cyber-warfare. The gap has narrowed in the last decade, but before that there wasn't even a distant second, maybe Russia. People serve in those units, acquire very useful and specific skills, then start companies that offer commercial variants of cyber-warfare, or become subcontractors for other governments.
They're even better at sextortion. Jeffrey Epstein is the posterchild for their efforts, along with his Mossad agent father-in-law Robert Maxwell, and handler Ehud Barak. It's likely that many of Israel's "triumphs" over the last few decades were less a result of hacking and more a result of blackmail, similar to the FSB/KGB.
Mandatory military service, too. You have to imagine that the US would have a similarly disproportionately-scaled cyber-warfare industry if it also had mandatory military service and good sorting of capable people into those units.
> a haven for American pedophiles/criminals who end up fleeing the country
Only Jewish pedophiles & criminals.
Israel will not let in random non-Jewish criminals to flee prosecution, only those who are provably Jewish are granted citizenship and non-extradition.
This is where the wall broke down for me. Criticizing Israel is okay, but criticizing Jews is not. However this is one example of being "above the law" which affects all jews, not only israeli citizens.
There are many ways in which Israel differs. For one it's a 78 year old colony that excludes the indigenous Palestinian population from returning to their ethnically cleansed homes. They also allow people to convert to Judiasm and enter, so it actually has nothing to do with their ethnicity and is solely based on religion.
>The Law of Return offers citizenship to Jews wishing to immigrate, as well as non-Jews with at least one Jewish grandparent (see "Who is a Jew under the Law of Return?"), as well as their spouses
I agree it's racist, but they also allow converts:
> Converts to Judaism who wish to immigrate to Israel are evaluated on a case-by-case basis by the Israeli Interior Ministry, which determines whether the conversion was sincere in its view
> For one it's a 78 year old colony that excludes the indigenous Palestinian population from returning to their ethnically cleansed homes.
The ethnic cleansing that happened when Israel gained independence was not in just one direction, Israel also did allow plenty of Arab/Palestinians to stay and gave them citizenship where feasible. It's not surprising however that Israel doesn't currently offer citizenship to a population that largely doesn't think Israel should even exist. States don't normally give citizenship to their non-citizen enemies.
> They also allow people to convert to Judiasm and enter, so it actually has nothing to do with their ethnicity and is solely based on religion.
It's not solely based on religion. It's also quite rare for people to convert to Judaism in general so that exception has little practical implications.
Guess where the company big AI labs are using for security sandbox is from? The one that was involved in both big hacking scandals from "rogue agents" by OpenAI and Anthropic?
Obviously not the first time an Israeli tech firm is responsible for these types of exploits, and at this point I'd go so far as saying that any Israeli-based tech company (especially cyber security ones, of which they have a strong industry) should be considered beholden to the government of Israel and hence, probably not trustworthy. How could you be sure whether they will act like a trustworthy independent entity, or compromise your data for the benefit of the state?
Define "hostile to users" a bit more. Chinese devices recklessly place rando back-doors into things, opening up them up to everyone and their mother. Average consumer router firmware? Compromised. They swallow up any and all information they can get their hands on and operate scam centers where they can utilize the info to blackmail people. Israel seems to have a more targeted approach, albeit there is definitely a blast radius. I'm not sure I can say any one country is worse than the other when it comes to cybersecurity. That includes: USA, Iran, North Korea, China, Israel, Russia etc. They all put consumers at risk; whether it's immediate or down the line when the exploits are revealed and other bad actors (scammers) are able to leverage them. It's a lose-lose for us either way.
I would also love this clarification, because not trusting an Israeli company is one thing, but with China, you're choosing to trust a government that is decades-old at being untrustworthy, not just a company. And whether or not the Israeli government can persuade a company to work with them notwithstanding, it's a known out truth that the Chinese government is in the business of its businesses.
We live in a world where NSO Group is protected from legal repercussions. If you're a US citizen, you live under the auspices of Israeli surveillance whether you like it or not. If you're a journalist, Israel will sell your opposition the Pegasus spyware to track you down and endanger your life. I wouldn't put it past the Mossad to blow up my phone, if they had the option. Yitzhak Rabin was killed for less.
The pager attack is a single stone in a mosaic of misanthropic Likud tactics. The damage Likud has done to Israel's reputation was intentional, designed from the ground-up to radicalize the Israeli populous and violently suppress any non-nationalist political campaigns. The rest of the world is appropriately disgusted, from my point of view.
Yes, it is clear talking point (which I have seen and refuted before) to convince people not to buy from Israeli companies but as I already explained that doesn't apply and in the scenario with NSO - you aren't their costumer anyway.
> I wouldn't put it past the Mossad to blow up my phone, if they had the option. Yitzhak Rabin was killed for less.
Unless you are a member of Hezballah I doubt it. Yitzhak Rabin wasn't killed by Mossad and you have delusion of grandeur if you think your actions matter more than those of Yitzhak Rabin.
> The pager attack is a single stone in a mosaic of misanthropic Likud tactic
The pager attack was designed by Mossad, no reason to believe any particular relation to Likud.
This is a weird question and comment because a country doesn't generally make the software. But I suppose they seem to have a lot of influence on the companies. Like surveillance cameras in China.
If I was to say what companies have done the most to take the most privacy from the most people, it would be American big tech like Google and Meta.
There's some okayish software from Israel I can think of, like Zcash.
These Israeli ones are literal criminal companies. What Meta does should be illegal. Both are immoral.
A single spyware against a journalist is much worse than a single Facebook user, but for the total impact on society, they both destroy democracy and human rights significantly.
>I would sooner trust a Chinese company than an Israeli company
As for trust, with privacy I'm a big proponent of avoiding it. Use E2EE or self host if you have to. The country does not matter so much.
Some multinationals have their R&D offices in Israel, there's a lot of pretty good research coming out. Russia would probably be worse in terms of trust and they are openly hostile to the West unlike Israel.
I'm saying they shouldn't do that, because there is a decent chance those Israeli companies may do things at odds with their customers' best interests (because they cannot or would not say no to a government request).
It is standard that companies within a country act in the interests of its security services. Israel has a lot of ad-tech companies and thus it makes sense that they are roped into serving Israel's security services.
This is the same issue that the US government has with Chinese networking companies, it is too easy for the Chinese government to pressure these Chinese networking companies to put in back doors in the interests of national security. The US likely knows this because it pressures its own companies in similar ways.
Bills like the US CLOUD Act (there are similar ones in the EU and China) force service providers to illegally spy on people overseas (via unauthorized use of anything they can access—consider Microsoft’s Windows backdoors).
I think the only technical solution available to individuals is to boycott non-verifiably e2ee services and corporate operating systems (especially including android).
A few weeks ago the FBI tipped the Argentinian police that some 15 year old kid from buenos aires province had asked chatgpt for ideas to plan a school massacre.
In the interest of balance, how many times did the FBI snoop into innocent people’s private lives with no warrant or worse, goaded some weak-minded individuals into planning crimes together in sting operations (i.e. people who needed convincing to commit the crime, so not quite clean but not the masterminds either)?
If you put out a fire how many are you allowed to set while people applaud selectively?
I don’t think they’re striking a good balance between how invasive they are compared to the real results they deliver.
> I think the only technical solution available to individuals is to boycott non-verifiably e2ee services
If the world moved that way overnight, I wonder where digital spy budgets would go. Into traditional techniques, cracking encryption, banning encryption, or a more educated guess?
It's not "illegaly spy", it' just spy. National security laws make sure that these requests are all legal - from that particular country's point of view who is forcing the provider to supply the info... and illegal from all the other country's point of view.
The root of this problem is that nation states have the final say in what they consider legal. But that difficulty is by design and is very difficult to fix.
Israel was created by ethnically cleansing Palestinians during the Nakba. That's not a democracy, ethnically cleansed Palestinians aren't even allowed to live on their land, let alone vote. That's not including all of the Palestinians that have been straight up murdered.
In addition Israel is an apartheid state with many undemocratic features:
Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.
Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
I'm sure Google's latest push to make it inconvenient to install apps from outside Google's Playstore, where Google charges a 30% commission, is going to solve that.
> useless as a way to prevent people from being hacked
From being hacked by others. Google was just trying to protect their property, which is the ability to spy on their users' every move. Google themselves really don't need to "hack" their users for that, they already have all the access and all the data they could ever want. And they also have the ability to brick their users' devices at a moment's notice the same as Apple does.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Totally not useless. It costs a lot more to pay a spyware firm then to have an employee send an email / ask a judge (like that's even necessary).
I feel quite confident of my messages privacy on my Pixel with GrapheneOS given most people I message are on iPhones which are second in security to Pixels running GrapheneOS. Not to mention my threat model doesn't include mercenary spyware, as most people's doesn't.
>Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.
If you're talking about the sideloading restrictions those were intended to stop social engineering and scams, not from getting hacked via 0days.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Source? play services is privileged but not that privileged.
However, this hack could have happened whether sideloading was allowed or not.
In fact, following the OP's link to https://citizenlab.ca/research/how-discover-tech-turned-targ..., "the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries" so it's not just apps but ordinary websites you visit in your android chrome browser.
My understanding is that there are hundreds, perhaps thousands, of high impact vulnerabilities on Chrome/Safari. We don't get to hear about most of them because it would become tedious quickly.
Yes, Google's move to block people from installing software on their own devices is orthogonal to this. I was merely saying that some measures have massive negative effects and basically irrelevant positive effects in the grand scheme of things.
It's really sad this got taken off the front page (347 points, posted 2 hours ago at the time of this comment). Israel is deeply intertwined with the tech industry and they use tech extensively in extremely hostile ways. It's relevant to this site discussion and the votes demonstrate that. There's no reason to hide the elephant in the room, let's address it, now is the time.
It's kinda funny that a website with an article titled "Online ads weaponised to deliver ‘zero-click’ spyware" immediately loads a splash that asks users with adblock installed to disable it.
The separation between advertising and editorial has never been greater. Brought to you by the marketing wizards who saw you bought a vacuum cleaner on Amazon and concluded you love buying vacuum cleaners so here’s some more.
>During our analysis of the Controlium platform, we observed that the source code mentioned an endpoint called “/csv-download”, which accepted start and end date parameters. When we sent normal HTTP GET requests to this endpoint without any password, special headers, or authentication token, we received logs showing which users had logged in to Controlium, and from which IP addresses.
It seems to be app-based. So DNS blocking could work; it's easily circumvented by the platforms, but it's rarely circumvented. like mobile games with those ads.
You should threat model, but if you want to maximally protect yourself, use Vanadium or Brave Browser and GrapheneOS and no privacy invasive apps.
It’s to do with hiding malware/spyware in an image which ends up in your cache on device. I can’t go much further into details but all this takes is for you to visit a site that serves it via ad network.
Israel has been known to have some sneaky spyware in the past with Pegasus.
There is a tinfoil narrative that suggest that entire formats are in bed with intelligence services. It sounds pretty wild, but other zero-click attack vectors have been possible through sabotaging the parsing of file formats. ie. send a message -> hacked. How? the message wasnt even opened. How is, an app like Messenger receives a photo attachment binary, tries to unpack it and in doing so receives an instruction that stops the parser and executes arbitrary instructions.
Yeah, but you need to know where to look for it, the average person is never going to be able to afford the amount of tokens that will take to find a bug like this, especially if it was implanted on purpose.
Shrink the surface to scan. Not foolproof but can be an improvement. After watching many conference videos on mobile OS hacking, the strategy should really be to focus on components that were touched recently in new updates (and the most popular components like messaging). Once software is mature, they don't go and change everything with every release. It's been a few years, but an interesting insight I learned at CCC was that the most touched components in new OS releases are the ones most likely to have contributions by junior developers trying to push some commit to satisfy their boss and thus have security flaws. Testing can only catch so much.
Tons of SV companies really... it's quite disturbing how obvious the compromise vectors are but big companies and startups alike seem to just allow it with no consideration for the security implications.
I think lots of it has to do with how well the hasbara covers up the scandals from the wider publics perception, combined with the cultural bandwagon of considering them an ally even when their repeated actions say otherwise.
edit: also the idea that they have such good tech and its a pragmatic decision ignores the history of how and who they got it from and the intentions for it. I say this as someone who worked directly with Mellanox for example, before aquisition by Nvidia... I always thought kernel level shims for networking stacks from an Israeli company was dangerous... but the speeds!!!
well yes, that is the surface. it's the surface being created with no recourse from the user side, that is intentional... the tinfoil hat theory is that it is, anyway.
How the ad-based spyware actually worked (from the Citizen Lab and Confiant reports):
- It came in through the front door. Discover-Tech ran its own ad-buying platform and was listed as a "certified" vendor by Google and IAB Europe for six years. Nothing was hacked to get in. It bid in ad auctions like any other buyer.
- The ads looked harmless. Plain banners for games, AliExpress deals and an IP-lookup site. Hidden inside each one was a small script that quietly phoned home when the ad loaded.
- Everyone who saw an ad was profiled. The script collected device details, IP addresses and, on many sites, the publisher's own cookies, sometimes including logged-in session tokens. Cookie-syncing with other ad networks built a huge identity graph.
- Only chosen targets got the payload. A gatekeeper server checked each device's ad ID and IP. Most people got nothing back. A selected target got code that handed them off to spyware maker Candiru, and the code was served only once, which made it very hard for researchers to capture.
- The handoff was built to defeat inspection. Encrypted channels, rotating hosting, anti-bot checks and even a fake "Copyright Google" comment to fool human reviewers.
- It worked. At least 45 devices at Al Jazeera were targeted, and spyware was recovered from an infected machine. Its ads also appeared on networks belonging to NATO, the UN, the European Parliament, the ICC and various defence ministries.
- The scale was huge. Billions of bids and ads in nearly 200,000 apps and websites, including Duolingo, Viber, Yahoo Mail, dating apps and period trackers, yet almost no sign of real advertisers or revenue.
Wait what, so there is no content disarm between companies making ads, and the publishers? They can literally push whatever they want? Wild.
Edit:
the TFA answers: "Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user." Its wild! I thought the ads are sanitized, go through a CDR of sorts, and whatever javascript is permitted is authored by ad networks, not the buyers. Sheesh. Thats just RCE.
> Wait what, so there is no content disarm between companies making ads, and the publishers? They can literally push whatever they want? Wild.
RTB (real-time bidding) does not incentivise publishers to care about what ads are actually being shown to individual users, so long as CPM is maximised.
I was looking for this comment. I'm wondering the same. Are ads just iframes that could have js? Therefore this is basically a zero click js (is this the first?) that just happens to be distributed via ads?
Agreed it's against the guidelines as written but the interpersonal exchange is no different than someone quoting a blog post (and then not linking to it, to be fair). Something like this doesn't feel strictly bad, assuming disclosure and a link to the chat, sources included.
They use ad network to try to target individual user visiting a page (eg you know your target is a male, 60 years old, living in that area, with a few other checks you can almost uniquely identify your target)
Then the ad network delivers a targeted ad that exploits a vulnerability (eg a broken JPEG decoder that, when sent a bad image, allows to run arbitrary code on your machine), and from there you have access to the computer
If only! I think we can no longer afford to ignore all these security threats and should make online advertising wholesale illegal. But I won't hold my breath.
The ads are getting insane, they're trying to fill every bit of space you can look with ads. You go to a restaurant there's ads on your placemat. You go to the grocery store there's ads in your cart. They put chargers in the parking lot so now there's ads out there.
Streaming services used to be bad enough with ads in the shows, now they put an ad on the screen when you pause it. Peacock just started putting ads in the login screen.
If we don't stop this, pretty soon they're going to have ads in the stars as satellite constellations arrange themselves to sell you Twitter subscriptions. They're not going to stop even when there's an ad no matter where you look.
I'm reminded of the ending of the 2008 film Hancock in which Hancock defaced the moon with a corporate logo. But it was okay because it was "for a good cause".
I don't see how anything in this exploit requires ads. It could just as well be done by enticing the target to view a malicious web page, such as a post in a subreddit or facebook group the target is known to read, or even by just sending him a link in an email or chat which will often trigger an automatic "preview" of the link in the email or chat client. Or by other social engineering techniques.
The ad-tech network probably does make it easier, because any page that includes their ad network could deliver the malicious ad.
People have disliked ads since ads existed. Carl Sagan's 1985 book Contact includes a brazillionaire S.R. Hadden who made his fortune by inventing an adblocker for television. https://en.wikipedia.org/wiki/Contact_(novel)
The FBI has previously recommended running adblockers as a method to prevent malware and especially scamming. Nobody cares much.
It’s a low-hanging fruit that has high value, particularly for less savvy internet users. Scams have always been the biggest threat. I’d say the majority of internet ads are scams, and the platforms often don’t make it clear what is or is not an ad.
But, we always knew the risk of malware was there. In the modern age, ads are basically never delivered as static assets. They’re delivered as small applications, with code. So, we’re relying on our sandboxing mechanics to work perfectly, and predictably they don’t. The solution is to block the code altogether; to block ads.
I would be interested in knowing which devices were (or still are) vulnerable to these zero click exploits. And how those exploits (used to) work, specifically.
The article contains no information on which browsers are impacted, what exploit is being used, if it has been patched, etc? Does anyone know more about how this ad network is exploiting browsers to install spyware on the users machine?
I doubt it's that easy to click on a link and install malware without the user knowing. Most browsers are highly secure and finding a zero day isn't that easy these days because both sides use A.I. to find vulnerabilities and to secure against them.
One side uses AI to find them. The other side probably needs to keep the holes open for NSA, as the multiple 0 click root exploits that happened in the past to the iPhone with very similar techniques suggest.
It’s not “easy”, it requires a complex infrastructure of exploit devs (who can sell their findings for millions in some cases) and the companies who package these exploits together with implants and sell them.
> Reuters has reported that billions of dollars’ worth of Meta’s ad revenue comes from ads for scams, illegal gambling, pornography and other banned content. In the US, ICE and other government agencies have bought software that uses ad tech data to track people’s movements.
I don't know if an ad blocker protects against Discover-Tech’s Controlium but in general you'd be a fool to allow ads in your browser in at this point. The ad industry is pretty shady all round.
For years there was a strong segment of HN commenters who would come on and declare a moral imperative for not using ad blockers and looking at every ad you could in order to support a website.
One must wonder how many were genuine vs an influence op.
Or genuine people who ate an influence op before posting here.
The whole point of an influence op is to find a bunch of useful idiots to provide a large multiplicative factor.
And that's the problem with arguing that something is an influence op, because it is going to be mostly genuine people by the time it gets to you, even though you're not wrong.
Once again proving that ads are an unacceptable security threat. All those sites now deploying ad-blocker blockers should assume liability for whatever ad software they force their readers to run.
Probably happens with Russia, US, etc as well, but the "hasbara" campaigns through the years have the effect of making people assume the mossad is all powerful etc etc. You inspire fear on your enemies, but also your friends.
edit: and I have been hasbar'd now for simply stating the fact that making people fear you instead of love you has consequences. oh well.
> Related work by the research group Confiant also suggests that Discover-Tech’s ads have been shown to users of the networks of government entities in Europe and the US, as well as the UN, Nato, the international criminal court and the International Atomic Energy Agency.
Yet we don't sanction Israel nor hold them accountable in any way. Of course they're spying on members of the UN and ICC, of course. Israel is at war with the entire world right now, and my politicians continue to support them. Thankfully many people have woken up, but the situation is dire.
Based on responses from roughly 46,700 people assessing 129 countries, Israel ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
That conflates the state with a business headquartered in it. It begs the question of what the sanctions would be for: is the argument that this firm is an arm of Israel, that Israel turns a blind eye to abusive businesses, or something else?
Yes, obviously the state and this company are the same thing. Why would a private company spy on the ICC and the UN? I’m sure there are plenty of 8200 people involved.
My Democratic Rep (who is a Zionist) voted with the Republican Party to financially sanction and impose visa restrictions on members of the International Criminal Court for issuing an arrest warrant for Netanyahu, so the ICC could hold Netanyahu for trial.
I will never vote for this particular (D) candidate again. Fortunately, the (L) candidate seems reasonable.
If indeed your representatives support Israel or the genocide in Gaza, I urge you to consider voting 3rd party. In two-party elections, candidates mostly just try to be a little better than their opponent. What forces them to do more isn’t a third party actually winning. It’s a real risk that enough fed-up voters will go third-party and cost them the election. This is basic game theory optimization.
All ads should have to appear in an <advertisement> node, and users should have the option of disabling javascript within an advertisement. Make it the fucking law.
Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle...
The CTO happens to have worked for Radware
Hacker News sure loves to single out one specific country and blanket label. I remember when comments like those in this thread directed against Russia after the Ukraine war heated up were shut down by Dang. But blanket generalizations against Israel?
HN made a special carve out to the rules it had in place when russia/Ukraine escalated for IP discussions and changed moderating behavior from past conflict discussions.
If you're so concerned about Israel's reputation, focus less on Ukraine or Russia and turn your attention to what Israel is doing to earn that reputation.
Israel has been a nexus of cybercrime for as long as they've been on the internet at all.
https://en.wikipedia.org/wiki/Download_Valley
It was so successful that IronSource, one of those companies, ended up merging with Unity and I think they got like 25% of the company: https://en.wikipedia.org/wiki/IronSource
holy cow
How was I not aware of this. Concerning.
Games are an underrated vector for similar campaigns.
Edit: for the doubters, malware-via-game has already been happening https://www.malwarebytes.com/blog/news/2025/07/steam-games-a...
They've also been a nexus of cyber security: Palo Alto Networks, Checkpoint, Wiz, etc are all Israeli companies.
The Ones Who Sell The Panic Sell The Cure.
Palo Alto used booth babes in 2025. I have zero respect for them since that.
Are you saying there's no work for both babes either? What a dry market!
Palo Alto Networks is not an Israeli company. But it has acquired many Israeli companies
the founder is !
The founder was former checkpoint engineer and unit 8200 in Israel. It isn't HQed in there but there are ties.
It's the same skill set, many acquire it via the IDF, so unsurprising.
Specifically Unit 8200, which really has no counterpart elsewhere in the world given Israel's mandatory universal conscription. Imagine if you could systematically screen every young adult in a country, identify those with the strongest math/quantitative skills or promising deep tech skills and divert them into one single security special ops org for several years. You'd get the concentration of skill that Unit 8200 has been producing.
I don't see why other countries couldn't do this? Doesn't Russia kinda do this as well? Its a matter of will.(Just my opinion).
Does Russia have mandatory *Universal* conscription? I didn't think they did. Maybe recently?
North Korea does this too, actually (and like Israel, for both genders). It's probably one of the significant reasons why NK has such a comparatively effective offensive cybersecurity group, despite how unlikely that would seem given their overall industrial capacity.
NK likely also gets a bit of a boost because of the extended length of mandatory service. Males on technical teams have to serve for 13 years.
Russia has historically not had mandatory universal conscription.
Which is surprising that these organizations have trust; like our employers probably wouldn't be comfortable shipping all their code to / embedding agents from cybersecurity firms in Russia
That explains a lot. You're basically just fishing for downloads in your target networks. You don't actually care if anyone clicks the ads in the installers, the sole purpose of the adware is to get arbitrary software running alongside the installer, so that you can compromise their machine.
Also affordable generic drugs. YMMV.
Why do some of the most evil tech companies, especially ones that use exploits and zero-days as part of their business model, disproportionately originate from the same small (population-wise) country? The company from the article, all the other examples everyone here lists, Candiru, NSO... All Israeli.
Seems pretty straightforward. If you are surrounded by adversaries that vastly outnumber you, you invest in other forms of strength
Its easy to be surrounded by enemies when you keep giving them reasons to hate you.
Palestinians aside, what reasons do neighboring countries have to hate Israel from it's very first moment?
A lot of the immediate neighbors attacked Israel at its birth, and further away countries just seem to hate Israel due to religion/ethnicity/populism (?), countries like Pakistan, Malaysia, etc.
> Palestinians aside,
That easy huh
Ethnically cleansing Palestine is reason enough to hate Israel. As an American I’ll add that I hate their influence on my country via bribes and blackmail, and how they strip my rights (anti-BDS laws…) and steal my tax dollars. Spying on everyone via things like the OP don’t help either.
hah, I've got something for your anti bds law if you're put in front of court:
funding Israel violates the separation of church and state.
You don't even need to go that far. These anti-BDS laws are clearly against the constitution and get struck down without issue. The real problem is that it's much easier to create these BS laws and put them on the books than it is to repeal them, because repealing them requires court challenges, lawsuits, and then these supporters go and make alterations to the law to meet the criteria of the challenges and ram them through again. Then we go through this whole cycle all over again. To solve this problem, you really need to go after the public officials that are being pushed to pass this garbage by consistently holding their feet to the fire and not tolerating this with punishments of losing their elections. The country is shifting towards that, but there's so much BS going on elsewhere that this takes a back burner in people's minds.
and then every jew near you will try to ruin your life
Well, Syria and Lebanon both hold some pretty serious resentment over the recent landgrabs. With the whole "acquiring buffer zone for the buffer zone" business in former and the population expulsions in the latter.
But they hated Israel before the recent land grab, right? And they seem less bothered by the much bigger Turkish land grab.
I answered your question, no need to move the goalposts. Countries usually don't like having their land occupied. As far as I know the Turkish occupation zone in Syria has been dissolved.
The original formation was a land grab. Jews owned 6% of the land in Mandatory Palestine in 1947. The other 94% was ethnic cleansing.
But if that were the cause why do countries like Malaysia and Pakistan have diplomatic relations with let's say a country like Australia?
I dont understand the analogy but none of those countries are committing ongoing massive human rights violations or apartheid conditions?
> The other 94% was ethnic cleansing.
That's not really an accurate characterization of the situation as much of the land was uninhabited/unregistered and/or state owned. The Negev desert for example is a large percentage of the total land area and was effectively uninhabited and not privately owned. Land ownership records at the time were also not particularly clear and often there were disputed claims. Also Israel has about 20% Arab/Palestinian citizens so it's not like they ethnically cleansed everyone like Egypt/Jordan did with the Jews in Gaza and the West Bank when Israel gained independence.
Indiscriminate bombing of innocent people, maybe?
https://www.bbc.com/news/articles/cwylx1vq18zo
Your comment makes no sense whatsoever. Moreover your account was created minutes ago. What time does your shift end?
The whole idea of Greater Israel would make anyone in the region queasy. The logic is pretty hard to dispute when Israelis claim the lang is God given. The "God given" land actually extends much farther beyond Israel's boundaries so I'd say people of those countries are rightful feel as they do.
Like immagine if the rhetoric of Turkey was constantly talking about expanding to Greece and how the land of Greece is historically the Turks. Obviously that would make any Greek uneasy.
The Turks would never dream of irridentism, expansion, a Blue Homeland, the destruction of neighbouring peoples or neo-Ottomanism. Absolutely never.
And the Greeks are historically famous for being quite laissez-faire when it comes to their eastern borders.
source: https://www.youtube.com/watch?v=qsbm-YGRmCs
Seeing how things have played out this year, maybe this will end up being their undoing. Israel has made it clear that the next domino to fall after Iran is Turkey. I don't even know how that would work. Isn't Turkey a NATO ally? At some point, this has got to stop. After everything that's come out this year, I wonder if an alternative world where a lot of these Middle Eastern countries developing into stable democracies could have occurred had Israel been contained or never been created.
The idea of “greater Israel” is a bogeyman that lives in the heads of people that hates Israel in several factors of greater numbers than there are people in Israel who believe that.
You can literally count with both hands the amount of people in Israel that advocate for “greater Israel”
Israel refuses to even define its borders. And current behaviour demonstrates why.
> Israel refuses to even define its borders. And current behaviour demonstrates why.
States like Israel formally define their borders via mechanisms like peace deals that include bilateral recognition of agreed upon borders, like Israel has with Egypt and Jordan.
You can't realistically define borders properly otherwise, trying to define borders via unilateral declaration doesn't really work when there are 2 states next to each other, the borders ultimately need to be negotiated bilaterally between those states with both sides recognizing the same borders.
Because Israel invaded a land that had been settled by Arab Muslims for centuries, claimed a portion for itself exclusively, proceeded to ethnically cleanse an even bigger portion, all with the support of their extremely powerful western backers. Asking "why did the others hate them" is like asking "why would Europeans hate the Chinese if they had invaded, settled and ethnically cleansed half of France (with the promise of taking even more later)"?
You're right. Never in history and never anywhere else in the world have Jews been persecuted.
It isn't really unique to Israel, though. There's conflict practically everywhere where major cultures/religions have drawn up borders, or within the backwash of fading empires (Britain, Ottomans, Soviets, French...).
https://www.cfr.org/global-conflict-tracker
None of those have as much impact on Americans day to day life as Israel does.
Lets zoom out: The whole world is about to enter a massive economic calamity, all because Americans got tricked into to electing the current knucklehead in the White House who took a ~$300 million bribe from an Israeli supporter to start this war.
None of those other conflicts will affect the entire world as what Israel has done.
> all because Americans got tricked into to electing the current knucklehead in the White House who took a ~$300 million bribe from an Israeli supporter to start this war.
From what you've said. It sounds like America is to blame here, tbh. $300mil is chump change in international bribery/development. If your establishment sells itself so cheaply, that's on America.
Besides, what's happening in Iran is minuscule compared to what happened during the 'War on Terror'. Play imperial games, win imperial prizes.
Agreed, the system needs reform so a country the size of Slovenia can't dictate US actions so easily. Reform is hopefully coming but too slowly.
>Besides, what's happening in Iran is minuscule compared to what happened during the 'War on Terror'. Play imperial games, win imperial prizes.
Disagree, Those wars were confined to an adversary that was already a few rungs down on the ladder and couldn't crash the world economy. Iran is larger than Iraq + Afghanistan combined, has very large mountainous terrain which has a lot of easy hiding spots for drones/launchers, has the fourth largest collection of trained staff in the field of nuclear science (more than France) and even became space launch capable in 2009.
Thats is like night and day difference between Iraq/Afghanistan.
I agree with what you're saying, but I think you're discounting the geopolitical impact the War(s) on Terror had.
America needed to push cheap credit to boost confidence after 9/11, oil prices skyrocketed and haven't really come back down, hugely expensive wars were funded on debt. It's arguable that these all directly contributed to the GFC in substantial ways.
Global confidence in American leadership plummetted since these wars, and opened the door for China and 'multi-polarity' to enter the stage which has caused a new wave of proxy wars as powers are trying to get a piece of the new round of global empires. We have Russia making moves (apparently also kickstarted by Gadaffi's death), UAE and Turkey playing games in the Sahel, dicerolled team selections in Libya, China testing the waters in Myanmar and Laos, fuckeries in Venezuela and Cuba, Syria, Azerbaijan....
If anything, Israel have been baited into their current actions just like America were as new and old powers try and undo 'centuries of shame', etc.
Americans didn't get tricked into electing Trump. Don't let Americans off the hook like they're naive schoolchildren. Americans knew what Trump represented, they were warned vociferously and repeatedly about him, his entire life and his public opinions have been well documented, and he isn't exactly subtle or capable of duplicity.
Jan. 6th wasn't enough to disqualify him from a second term. The Epstein files weren't enough to get him removed from power. ICE wasn't enough to get him removed from power. Blatant disregard for the courts, threatening allies, arbitrary and insane tariff policies weren't enough to get him removed from power. No President in the history of the United States has been as secure in his position as Donald Trump is. The Supreme Court even went out of its way to make him immune from prosecution for any crime he might possibly commit while in office.
Israel may have (probably did) talk Trump into the war but Americans are the reason Trump was in that position to begin with, and he is there because Americans want him there.
>Americans didn't get tricked into electing Trump. Don't let Americans off the hook like they're naive schoolchildren.
The fact that they are still trying last minute fuel price manipulation in the hopes of converting some people into Trumps good graces proves that you are wrong. The country is very large. In 300+ million people you will find a large distribution of people in terms of skills and ability to discern fact from fiction. The bottom 10% of the distribution is still ~30 million people. Some % of these people vote. Lets not even consider the bottom 50% percentile.
>Jan. 6th wasn't enough to disqualify him from a second term. The Epstein files weren't enough to get him removed from power. ICE wasn't enough to get him removed from power. Blatant disregard for the courts, threatening allies, arbitrary and insane tariff policies weren't enough to get him removed from power.
You are conflating two different things. This is a failure of the system. This takes time to reform. There are attempts going back years. When you have so many layers of people who benefit from the existing status quo the only way you speed up the fix this without decades of sludging through roadblocks is if a national calamity happens that finally forces change(economic or other challenge). Otherwise too many people are insulated from the downsides of the system until they aren't anymore and then something changes.
>but Americans are the reason Trump was in that position to begin with, and he is there because Americans want him there.
Objectively this is a stated fact (unless you believe the election was rigged). But it glosses over so much nuance and context.
Russia didn't create Trump. They're not solely responsible for Trump.
The same can be said of Brexit, Victor Orban, AfD, etc. All of these bad things were, nevertheless, boosted by Russian ops with the same general strategic goal in mind.
My point is that being at war with your neighbor(s) is not a unique situation, but only Israel has acquired such an extreme abuse-through-tech slant because of it. Why?
My guess (not any more informed than anyone else's) is that it's because they absolutely need US support, and intelligence is one of the few things they could offer them so they invested _a lot_ into it
One factor is that Israel generally refuses to extradite their citizens who are accused of crimes in foreign countries. So they effectively operate with a certain level of legal immunity.
Yes, in general Israeli intelligence and hacking groups tend to enjoy far fewer consequences when they screw up than their Western counterparts, which then allow them to be far more aggressive.
I was only really aware of the many high profile cases of sex offenders exploiting this, I never thought of the cybercrime angle.
The perpetrator of the viral "you're stealing my house," "if I don't steal it someone else would steal it," video was purported to be an alleged sex offender who fled to Israel to escape charges.
I don't know if that's true since I haven't seen any evidence for it, but I would not be surprised.
If there is no punishment for shooting school kids with a sniper rifle, there isn't going to be punishment for any lesser evils.
It isn't all Israel. North Korea, Russia, and Iran have long been known to be where most cyber crime comes from. Israel is there, but they are an also-ran compared to the others. (but Israel does tend to have more sophisticated attacks). The US also has done a large share, but mostly that is government attacks on other governments (that we know of).
Israel has a lot of enemies that going against them. Which is why they have incentive to be good at this - to attack back. Corporate attempts are just ways to make money.
I'm going to stay out of the political issue of what any actor should do.
This is true, but as far as I know, the other countries (except the US, which however is far larger than Israel) keep their cyberwarfare operations mostly internal. There's no public Russian company accessible to any Russian that does what the example companies above do, for instance. It's all government-led. So is the existence of these companies some outcome of the legal or financial system in that country?
>Israel has a lot of enemies that going against them.
Why do you think that is?
lol downvotes
antisemitism
>antisemitism
Certainly some is antisemitism. To imply, as you have, that there is 0% legitimacy to any other reasons to hate the behavior of the current Israeli government is just as pro-genocide as you claim antisemitism.
Most people I know who oppose Israel's actions in Gaza have no problem with Jewish people; many themselves are Jewish.
Israel is not a religion.
True, but it's the only Jewish state.
Speaking as an escaped Christian fundamentalist -- religious faith and religious nationalism are actually two different things.
No religions are states, that is just your political opinion. I think it's a really toxic opinion because it then leads to the question the potential allegiance to a foreign nation of anyone based on their religion. This is the same reason why a Catholic president was once controversial, because back then people believed there was a Catholic state secretly controlling them.
In my political opinion Israel is an artificially created state which is why it's so unstable and we should cut our losses on this, I believe my opinion is the prevailing populist opinion and y'all have to contend with that.
There needs to be some compromise between our points of view or else we'll continue to get more war and violence. I personally think our country needs to recognize our hand in this mess and should offer land in North America of equivalent value for any Zionist refugees and then leave the poor people of that land alone.
But North Korea, Russia, and Iran isn't supported on our tax dollars. In this case we're literally paying another country to infiltrate ourselves.
>North Korea, Russia, and Iran
...are also widely considered bad actors. Yet, it isn't "islamophobia" when you criticize Iran or "anti-Orthodox" when you call Russia to account.
Curiously, however, when you similarly criticize the actions of this specific Israeli government and its leaders, you are slandered with the term "antisemite" and there are orgs that exist to doxx you and get you fired from your job.
Isn't that weird?
'I'm not racist against blacks, I'm just pointing out crime statistics in certain communities' vibes
If that's your first instinct, then by your standards no country can be criticized for much of anything. After all, pointing out the negative outcomes of a purposefully designed system is the exact same as prejudice based on immutable birth characteristics.
No country's people should be blanket stereotyped. That's my first instinct. 'why are people from xyz nation more likely to be associated with(negative thing)....'. nah, fuck that kind of talk.
Where did you see me saying that? I didn't even mention any people or generalize that all of them are this or that. Saying that cyberwarfare companies are more likely to be in Israel, which is what I did, seems like the most objective way of framing my observation. Other replies already gave some good reasons for why that may be, and all of them have to do with the systems built within the country, not some inherent property of their people. They could change these systems if they wanted to, it's not inherent to them.
Right, this discussion totally isn't being used as a bash Israel/isrealis as inherently bad with lots of blanket statements.
>Right, this discussion totally isn't being used as a bash Israel/isrealis as inherently bad with lots of blanket statements.
I see lots of (maybe un-carefully-worded, maybe?) bashing of the actions of the current Israeli government, and its defense forces and intel apparatus.
That's 100% fair game, anywhere on the planet.
What's I don't see is the rank antisemitism you claim, except for a few outlier recently-created accounts.
The most despicable thing I see at scale in the conversations is the attempt to silence critics of Israel with slanderous accusations of antisemitism. It used to work, as a tactic, but it (like the "racism card") has been vastly overplayed and is rapidly losing its value.
I went out of my way to write the comment in as neutral of a tone as possible. I didn't even state my opinion on Israel or anything it's involved in to avoid starting a flamewar in what would otherwise be a standard question about adversarial technology and cyberwarfare. The only expressed opinion was about the companies themselves, which I think it more than warranted. Yet, as I said in a sibling comment, people are seeing ghosts anyway and disregard the perfectly normal question because they think I'm not really curious about it and am asking it for nefarious reasons.
Oh well, each individual must be judged on their actions and merits, but this doesn't prevent us from observing how groups behave on average. Nobody ever shouted racism when it's said that French are chauvinistic or that Germans follow rules strictly- it won't and shouldn't tell you anything about single individuals but you know there's a grain of truth in the generalisation.
In this book, they explain that it's because this industry is de-regulated:
Pegasus: How a Spy in Your Pocket Threatens the End of Privacy, Dignity, and Democracy by Lauret Richard
The same reason why many great tech companies originate from Israel. That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
But something tells me that the way you framed your question, is not about the companies and more about you and how you view Israel.
I in fact tried to word this as neutrally as possible, but people are already seeing ghosts just because it has a hint of negativity towards the country, which should be expected because most people agree that these technologies are not actually good for the world.
> The same reason why many great tech companies originate from Israel. That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
You never said what the reason for that is. Their society doesn't seem more tech-oriented than comparable countries. Their universities are OK, but not the best in the world. So what in their society caused this?
Careful. The trolls are out. Half of them are trying to prove Israel is a nation full of demonstrably evil people, and half of them will tar you with antisemitism if you don't love Bibi and all his works.
This bullshit polarization of ideology ruins civil discourse. It's possible to condemn Hamas' slaughter of innocents, and condemn Israel's slaughter of innocents. And to still realize there are innocent Palestinians and Israelis who are not working to make things worse.
There are answers to these questions but they will put you at odds with those who hold to the other position.
Simply asking the question is going too far for most.
Paul wrestles with this in Romans 9:6.
It’s a mix of culture and army bias.
Culturally, Israel has a strong emphasis on entrepreneurship, coupled with general lack of tolerance for bureaucracy, makes for pretty agile organizations.
In the military side, it creates a country sized funnel that picks the best people and places them together trying to solve problems that would seem impossible. When these people are discharged, they are friends that knows how to work best together. Think of it like a larger and more focused version of an Ivy League school
> The same reason why many great tech companies originate from Israel.
wait - what's the reason, though? i don't understand what you're trying to say.
> That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
you cite two american companies with presence in Israel to defend your claim that "many great tech companies originate from Israel".
> is not about the companies and more about you and how you view Israel
your entire response is predicated on your view of Israel but you haven't explained what your view actually is or what it's based on.
Because they are the best at spying in the world by far, and are willing to splash the cash. They're what Silicon Valley would have been if it kept doing government contracts instead of just selling ads.
If Mossad is willing to give you a hundred million to make your startup a spyware company, you're obviously going to agree.
> If Mossad is willing to give you a hundred million to make your startup a spyware company, you're obviously going to agree.
what a sad take.
Their military is very good at cyber-warfare. The gap has narrowed in the last decade, but before that there wasn't even a distant second, maybe Russia. People serve in those units, acquire very useful and specific skills, then start companies that offer commercial variants of cyber-warfare, or become subcontractors for other governments.
They're even better at sextortion. Jeffrey Epstein is the posterchild for their efforts, along with his Mossad agent father-in-law Robert Maxwell, and handler Ehud Barak. It's likely that many of Israel's "triumphs" over the last few decades were less a result of hacking and more a result of blackmail, similar to the FSB/KGB.
Like Monica Lewinsky, for starters?
They probably didn't arrange for that affair to happen, but they did use it for blackmail nonetheless.
Mandatory military service, too. You have to imagine that the US would have a similarly disproportionately-scaled cyber-warfare industry if it also had mandatory military service and good sorting of capable people into those units.
Because those are typically created by ex-military people who had become civilians and now they need to make money with the skills they have.
OK this might be a wild (conspiracy) theory, but what if Israel is just an arms-length scape goat for the US?
That country has long been known as a haven for American pedophiles/criminals who end up fleeing the country.
> a haven for American pedophiles/criminals who end up fleeing the country
Only Jewish pedophiles & criminals. Israel will not let in random non-Jewish criminals to flee prosecution, only those who are provably Jewish are granted citizenship and non-extradition.
This is where the wall broke down for me. Criticizing Israel is okay, but criticizing Jews is not. However this is one example of being "above the law" which affects all jews, not only israeli citizens.
I'm trying to be nice here, but yes, it's a racial nationalist policy. We don't have many of those countries left in the world.
> We don't have many of those countries left in the world.
It's fairly common in Europe[0].
[0] https://en.wikipedia.org/wiki/Jus_sanguinis#Leges_sanguinis_...
There are many ways in which Israel differs. For one it's a 78 year old colony that excludes the indigenous Palestinian population from returning to their ethnically cleansed homes. They also allow people to convert to Judiasm and enter, so it actually has nothing to do with their ethnicity and is solely based on religion.
>The Law of Return offers citizenship to Jews wishing to immigrate, as well as non-Jews with at least one Jewish grandparent (see "Who is a Jew under the Law of Return?"), as well as their spouses
This is clearly a racial ideology.
I agree it's racist, but they also allow converts:
> Converts to Judaism who wish to immigrate to Israel are evaluated on a case-by-case basis by the Israeli Interior Ministry, which determines whether the conversion was sincere in its view
> For one it's a 78 year old colony that excludes the indigenous Palestinian population from returning to their ethnically cleansed homes.
The ethnic cleansing that happened when Israel gained independence was not in just one direction, Israel also did allow plenty of Arab/Palestinians to stay and gave them citizenship where feasible. It's not surprising however that Israel doesn't currently offer citizenship to a population that largely doesn't think Israel should even exist. States don't normally give citizenship to their non-citizen enemies.
> They also allow people to convert to Judiasm and enter, so it actually has nothing to do with their ethnicity and is solely based on religion.
It's not solely based on religion. It's also quite rare for people to convert to Judaism in general so that exception has little practical implications.
Guess where the company big AI labs are using for security sandbox is from? The one that was involved in both big hacking scandals from "rogue agents" by OpenAI and Anthropic?
Obviously not the first time an Israeli tech firm is responsible for these types of exploits, and at this point I'd go so far as saying that any Israeli-based tech company (especially cyber security ones, of which they have a strong industry) should be considered beholden to the government of Israel and hence, probably not trustworthy. How could you be sure whether they will act like a trustworthy independent entity, or compromise your data for the benefit of the state?
I would sooner trust a Chinese company than an Israeli company. Is there any country less trustworthy and more hostile to users?
Define "hostile to users" a bit more. Chinese devices recklessly place rando back-doors into things, opening up them up to everyone and their mother. Average consumer router firmware? Compromised. They swallow up any and all information they can get their hands on and operate scam centers where they can utilize the info to blackmail people. Israel seems to have a more targeted approach, albeit there is definitely a blast radius. I'm not sure I can say any one country is worse than the other when it comes to cybersecurity. That includes: USA, Iran, North Korea, China, Israel, Russia etc. They all put consumers at risk; whether it's immediate or down the line when the exploits are revealed and other bad actors (scammers) are able to leverage them. It's a lose-lose for us either way.
I would also love this clarification, because not trusting an Israeli company is one thing, but with China, you're choosing to trust a government that is decades-old at being untrustworthy, not just a company. And whether or not the Israeli government can persuade a company to work with them notwithstanding, it's a known out truth that the Chinese government is in the business of its businesses.
> Define "hostile to users" a bit more
Exploding pagers. Israel literally killed people with consumer tech.
Sold by a non-Israeli company (because Hezbollah isn't that stupid) and only to Hezbollah. But nice attempt to create ingenuine concern.
Ingenuine?
We live in a world where NSO Group is protected from legal repercussions. If you're a US citizen, you live under the auspices of Israeli surveillance whether you like it or not. If you're a journalist, Israel will sell your opposition the Pegasus spyware to track you down and endanger your life. I wouldn't put it past the Mossad to blow up my phone, if they had the option. Yitzhak Rabin was killed for less.
The pager attack is a single stone in a mosaic of misanthropic Likud tactics. The damage Likud has done to Israel's reputation was intentional, designed from the ground-up to radicalize the Israeli populous and violently suppress any non-nationalist political campaigns. The rest of the world is appropriately disgusted, from my point of view.
Yes, it is clear talking point (which I have seen and refuted before) to convince people not to buy from Israeli companies but as I already explained that doesn't apply and in the scenario with NSO - you aren't their costumer anyway.
> I wouldn't put it past the Mossad to blow up my phone, if they had the option. Yitzhak Rabin was killed for less.
Unless you are a member of Hezballah I doubt it. Yitzhak Rabin wasn't killed by Mossad and you have delusion of grandeur if you think your actions matter more than those of Yitzhak Rabin.
> The pager attack is a single stone in a mosaic of misanthropic Likud tactic
The pager attack was designed by Mossad, no reason to believe any particular relation to Likud.
This is a weird question and comment because a country doesn't generally make the software. But I suppose they seem to have a lot of influence on the companies. Like surveillance cameras in China.
If I was to say which countries do the most to restrict digital freedom, I'd say look at this table: https://eylenburg.github.io/countries.htm
If I was to say what companies have done the most to take the most privacy from the most people, it would be American big tech like Google and Meta.
There's some okayish software from Israel I can think of, like Zcash.
These Israeli ones are literal criminal companies. What Meta does should be illegal. Both are immoral.
A single spyware against a journalist is much worse than a single Facebook user, but for the total impact on society, they both destroy democracy and human rights significantly.
>I would sooner trust a Chinese company than an Israeli company
As for trust, with privacy I'm a big proponent of avoiding it. Use E2EE or self host if you have to. The country does not matter so much.
Some multinationals have their R&D offices in Israel, there's a lot of pretty good research coming out. Russia would probably be worse in terms of trust and they are openly hostile to the West unlike Israel.
Many, many, many Fortune 500 companies use Israeli cybersecurity services.
I guess that your concerns are not aligned with reality, or the benefits far outweigh whatever it is you think may happen.
(Talking as an Israeli working in cybersecurity)
Or maybe fortune 500 companies have different vulnerabilities, financial power, and concerns than individual humans.
A good chunk of the EU powergrid uses Israeli made embedded systems.
> Many, many, many Fortune 500 companies use Israeli cybersecurity services.
It's possible for this to be true, and that they spy on said companies on behalf of the government of Israel. It makes it easier to do so.
I'm saying they shouldn't do that, because there is a decent chance those Israeli companies may do things at odds with their customers' best interests (because they cannot or would not say no to a government request).
Actual report from Citizen Lab:
* https://citizenlab.ca/research/how-discover-tech-turned-targ...
Y'all will be shocked at how much of the VPN space is owned/controlled by Israel.
https://share.gemini.google/DbWctQhiJXMh
It is standard that companies within a country act in the interests of its security services. Israel has a lot of ad-tech companies and thus it makes sense that they are roped into serving Israel's security services.
It is no different that Israel's location tracking of StarLink terminals worldwide: https://www.newarab.com/news/israel-tech-firms-can-locate-an...
This is the same issue that the US government has with Chinese networking companies, it is too easy for the Chinese government to pressure these Chinese networking companies to put in back doors in the interests of national security. The US likely knows this because it pressures its own companies in similar ways.
Bills like the US CLOUD Act (there are similar ones in the EU and China) force service providers to illegally spy on people overseas (via unauthorized use of anything they can access—consider Microsoft’s Windows backdoors).
I think the only technical solution available to individuals is to boycott non-verifiably e2ee services and corporate operating systems (especially including android).
A few weeks ago the FBI tipped the Argentinian police that some 15 year old kid from buenos aires province had asked chatgpt for ideas to plan a school massacre.
just to confirm your info... https://buenosairesherald.com/society/argentine-teenager-pla...
In the interest of balance, how many times did the FBI snoop into innocent people’s private lives with no warrant or worse, goaded some weak-minded individuals into planning crimes together in sting operations (i.e. people who needed convincing to commit the crime, so not quite clean but not the masterminds either)?
If you put out a fire how many are you allowed to set while people applaud selectively?
I don’t think they’re striking a good balance between how invasive they are compared to the real results they deliver.
to be clear: I'm against this "pre-crime" FBI bullshit. it's overreach.
> I think the only technical solution available to individuals is to boycott non-verifiably e2ee services
If the world moved that way overnight, I wonder where digital spy budgets would go. Into traditional techniques, cracking encryption, banning encryption, or a more educated guess?
It's not "illegaly spy", it' just spy. National security laws make sure that these requests are all legal - from that particular country's point of view who is forcing the provider to supply the info... and illegal from all the other country's point of view. The root of this problem is that nation states have the final say in what they consider legal. But that difficulty is by design and is very difficult to fix.
Difference being we're pretending that Israel is a democracy that values human rights, so nobody makes a real stink about it, unlike with China.
Only the national brass is pretending at this point.
Why Israel is not a Democracy?
Israel was created by ethnically cleansing Palestinians during the Nakba. That's not a democracy, ethnically cleansed Palestinians aren't even allowed to live on their land, let alone vote. That's not including all of the Palestinians that have been straight up murdered.
In addition Israel is an apartheid state with many undemocratic features:
https://static1.squarespace.com/static/66a134337e960f229da81...
This is abhorrent. Every government spying on everyone.. and who benefits from all of this?
Can we get an alien invasion already please, god
Except this isn't the security services they are serving it's a mercenary spyware vendor.
Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.
Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
I'm sure Google's latest push to make it inconvenient to install apps from outside Google's Playstore, where Google charges a 30% commission, is going to solve that.
> useless as a way to prevent people from being hacked
From being hacked by others. Google was just trying to protect their property, which is the ability to spy on their users' every move. Google themselves really don't need to "hack" their users for that, they already have all the access and all the data they could ever want. And they also have the ability to brick their users' devices at a moment's notice the same as Apple does.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Totally not useless. It costs a lot more to pay a spyware firm then to have an employee send an email / ask a judge (like that's even necessary).
I feel quite confident of my messages privacy on my Pixel with GrapheneOS given most people I message are on iPhones which are second in security to Pixels running GrapheneOS. Not to mention my threat model doesn't include mercenary spyware, as most people's doesn't.
>Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.
If you're talking about the sideloading restrictions those were intended to stop social engineering and scams, not from getting hacked via 0days.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Source? play services is privileged but not that privileged.
However, this hack could have happened whether sideloading was allowed or not.
In fact, following the OP's link to https://citizenlab.ca/research/how-discover-tech-turned-targ..., "the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries" so it's not just apps but ordinary websites you visit in your android chrome browser.
So there's some sort of Android/iOS vulnerability in Chrome/Safari that they're exploiting?
No info on if a recent version patches this?
It also mentions a "Windows DLL" - so they're somehow infecting Windows desktop too?
My understanding is that there are hundreds, perhaps thousands, of high impact vulnerabilities on Chrome/Safari. We don't get to hear about most of them because it would become tedious quickly.
Yes, Google's move to block people from installing software on their own devices is orthogonal to this. I was merely saying that some measures have massive negative effects and basically irrelevant positive effects in the grand scheme of things.
Is GrapheneOS affected?
This is even crazier than the last time Citizen Lab found an Israeli zero-click spyware (Pegasus). You could call it a sequel
Don't call it a comeback, I been here for years Rocking my peers and putting suckas in fear
Is that the song from LL Cool J?
You were expecting Leviticus?
It's really sad this got taken off the front page (347 points, posted 2 hours ago at the time of this comment). Israel is deeply intertwined with the tech industry and they use tech extensively in extremely hostile ways. It's relevant to this site discussion and the votes demonstrate that. There's no reason to hide the elephant in the room, let's address it, now is the time.
It's kinda funny that a website with an article titled "Online ads weaponised to deliver ‘zero-click’ spyware" immediately loads a splash that asks users with adblock installed to disable it.
The separation between advertising and editorial has never been greater. Brought to you by the marketing wizards who saw you bought a vacuum cleaner on Amazon and concluded you love buying vacuum cleaners so here’s some more.
The site works much better with JS disabled.
>During our analysis of the Controlium platform, we observed that the source code mentioned an endpoint called “/csv-download”, which accepted start and end date parameters. When we sent normal HTTP GET requests to this endpoint without any password, special headers, or authentication token, we received logs showing which users had logged in to Controlium, and from which IP addresses.
Absolute morons.
If you work for an ad tech firm you are one of the baddies.
Would installing ad-blocker software give me any protection from this stuff?
It seems to be app-based. So DNS blocking could work; it's easily circumvented by the platforms, but it's rarely circumvented. like mobile games with those ads.
You should threat model, but if you want to maximally protect yourself, use Vanadium or Brave Browser and GrapheneOS and no privacy invasive apps.
https://www.privacyguides.org/en/basics/threat-modeling/
How does this actually work? Are they talking about browser fingerprinting or something else?
If I had to ponder a guess…
It’s to do with hiding malware/spyware in an image which ends up in your cache on device. I can’t go much further into details but all this takes is for you to visit a site that serves it via ad network.
Israel has been known to have some sneaky spyware in the past with Pegasus.
https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zer...
https://citizenlab.ca/research/how-discover-tech-turned-targ...
Here is a better article https://citizenlab.ca/research/how-discover-tech-turned-targ...
Looks like it's much worse, they get more information due to exploits, and they can take full control of your machine.
Article on the CitizenLab website: https://citizenlab.ca/research/how-discover-tech-turned-targ...
This should have been the OP.
There is a tinfoil narrative that suggest that entire formats are in bed with intelligence services. It sounds pretty wild, but other zero-click attack vectors have been possible through sabotaging the parsing of file formats. ie. send a message -> hacked. How? the message wasnt even opened. How is, an app like Messenger receives a photo attachment binary, tries to unpack it and in doing so receives an instruction that stops the parser and executes arbitrary instructions.
With all the AI decompilation going on would it not be possible to find these things in the binary by now?
Yeah, but you need to know where to look for it, the average person is never going to be able to afford the amount of tokens that will take to find a bug like this, especially if it was implanted on purpose.
Shrink the surface to scan. Not foolproof but can be an improvement. After watching many conference videos on mobile OS hacking, the strategy should really be to focus on components that were touched recently in new updates (and the most popular components like messaging). Once software is mature, they don't go and change everything with every release. It's been a few years, but an interesting insight I learned at CCC was that the most touched components in new OS releases are the ones most likely to have contributions by junior developers trying to push some commit to satisfy their boss and thus have security flaws. Testing can only catch so much.
Go to LinkedIn, and check how many ex Unit 8200 (a group you never really quit until you are 50)...work for the Apple iOS dev team...
Tons of SV companies really... it's quite disturbing how obvious the compromise vectors are but big companies and startups alike seem to just allow it with no consideration for the security implications.
I think lots of it has to do with how well the hasbara covers up the scandals from the wider publics perception, combined with the cultural bandwagon of considering them an ally even when their repeated actions say otherwise.
edit: also the idea that they have such good tech and its a pragmatic decision ignores the history of how and who they got it from and the intentions for it. I say this as someone who worked directly with Mellanox for example, before aquisition by Nvidia... I always thought kernel level shims for networking stacks from an Israeli company was dangerous... but the speeds!!!
It's routine for apps like Messenger to pre-download attachments (eg to compute a resized preview of the image etc)
well yes, that is the surface. it's the surface being created with no recourse from the user side, that is intentional... the tinfoil hat theory is that it is, anyway.
How the ad-based spyware actually worked (from the Citizen Lab and Confiant reports):
- It came in through the front door. Discover-Tech ran its own ad-buying platform and was listed as a "certified" vendor by Google and IAB Europe for six years. Nothing was hacked to get in. It bid in ad auctions like any other buyer.
- The ads looked harmless. Plain banners for games, AliExpress deals and an IP-lookup site. Hidden inside each one was a small script that quietly phoned home when the ad loaded.
- Everyone who saw an ad was profiled. The script collected device details, IP addresses and, on many sites, the publisher's own cookies, sometimes including logged-in session tokens. Cookie-syncing with other ad networks built a huge identity graph.
- Only chosen targets got the payload. A gatekeeper server checked each device's ad ID and IP. Most people got nothing back. A selected target got code that handed them off to spyware maker Candiru, and the code was served only once, which made it very hard for researchers to capture.
- The handoff was built to defeat inspection. Encrypted channels, rotating hosting, anti-bot checks and even a fake "Copyright Google" comment to fool human reviewers.
- It worked. At least 45 devices at Al Jazeera were targeted, and spyware was recovered from an infected machine. Its ads also appeared on networks belonging to NATO, the UN, the European Parliament, the ICC and various defence ministries.
- The scale was huge. Billions of bids and ads in nearly 200,000 apps and websites, including Duolingo, Viber, Yahoo Mail, dating apps and period trackers, yet almost no sign of real advertisers or revenue.
Citizen Lab: https://citizenlab.ca/research/how-discover-tech-turned-targ...
Confiant: https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zer...
Citizen Lab also has a shorter executive summary: https://citizenlab.ca/research/exposing-adfection-executive-...
Wait what, so there is no content disarm between companies making ads, and the publishers? They can literally push whatever they want? Wild.
Edit:
the TFA answers: "Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user." Its wild! I thought the ads are sanitized, go through a CDR of sorts, and whatever javascript is permitted is authored by ad networks, not the buyers. Sheesh. Thats just RCE.
> Wait what, so there is no content disarm between companies making ads, and the publishers? They can literally push whatever they want? Wild.
RTB (real-time bidding) does not incentivise publishers to care about what ads are actually being shown to individual users, so long as CPM is maximised.
I was looking for this comment. I'm wondering the same. Are ads just iframes that could have js? Therefore this is basically a zero click js (is this the first?) that just happens to be distributed via ads?
Did you AI generate this? The wording looks suspicious and sure enough, it's flagged by pangram as AI.
I found it to be an excellent, easy-to-read summary.
Which is what AI is RLHF'd to do, but using AI, much less undisclosed AI is against HN guidelines.
> Don't post generated text or AI-edited text. HN is for conversation between humans.
Agreed it's against the guidelines as written but the interpersonal exchange is no different than someone quoting a blog post (and then not linking to it, to be fair). Something like this doesn't feel strictly bad, assuming disclosure and a link to the chat, sources included.
They use ad network to try to target individual user visiting a page (eg you know your target is a male, 60 years old, living in that area, with a few other checks you can almost uniquely identify your target)
Then the ad network delivers a targeted ad that exploits a vulnerability (eg a broken JPEG decoder that, when sent a bad image, allows to run arbitrary code on your machine), and from there you have access to the computer
archived, no ads or trackers: https://nonograph.com/online-ads-weaponised-to-deliver-zero-...
It's fun to see adtech digging a hole for themselves ...
If only! I think we can no longer afford to ignore all these security threats and should make online advertising wholesale illegal. But I won't hold my breath.
The ads are getting insane, they're trying to fill every bit of space you can look with ads. You go to a restaurant there's ads on your placemat. You go to the grocery store there's ads in your cart. They put chargers in the parking lot so now there's ads out there.
Streaming services used to be bad enough with ads in the shows, now they put an ad on the screen when you pause it. Peacock just started putting ads in the login screen.
If we don't stop this, pretty soon they're going to have ads in the stars as satellite constellations arrange themselves to sell you Twitter subscriptions. They're not going to stop even when there's an ad no matter where you look.
The moon as a giant Pepsi logo.
> ads in the stars
I'm reminded of the ending of the 2008 film Hancock in which Hancock defaced the moon with a corporate logo. But it was okay because it was "for a good cause".
Showing an advert is fine. A poster on a billboard is not deploying mass surveillance.
It's both, there is no mass advertising without mass surveillance.
No, it really isn’t.
Putting a static, printed poster on a wall is in no way analogous to surveillance.
this is why adblock is completely necessary, not just for your eyes, but for security.
I don't see how anything in this exploit requires ads. It could just as well be done by enticing the target to view a malicious web page, such as a post in a subreddit or facebook group the target is known to read, or even by just sending him a link in an email or chat which will often trigger an automatic "preview" of the link in the email or chat client. Or by other social engineering techniques.
The ad-tech network probably does make it easier, because any page that includes their ad network could deliver the malicious ad.
The main thing ads allows is "zero-click" - so they don't need to click a link or anything to get exploited.
Looking at the bright side, we might just be able to make people really dislike ads.
For those who haven't learned their lesson yet, I doubt anything could move the needle.
People have disliked ads since ads existed. Carl Sagan's 1985 book Contact includes a brazillionaire S.R. Hadden who made his fortune by inventing an adblocker for television. https://en.wikipedia.org/wiki/Contact_(novel)
The FBI has previously recommended running adblockers as a method to prevent malware and especially scamming. Nobody cares much.
It’s a low-hanging fruit that has high value, particularly for less savvy internet users. Scams have always been the biggest threat. I’d say the majority of internet ads are scams, and the platforms often don’t make it clear what is or is not an ad.
But, we always knew the risk of malware was there. In the modern age, ads are basically never delivered as static assets. They’re delivered as small applications, with code. So, we’re relying on our sandboxing mechanics to work perfectly, and predictably they don’t. The solution is to block the code altogether; to block ads.
You have to go about 5 pages deep on any search, anywhere, before you find something positive about "israel"
they do have a really big and well stocked skin bank! Its positive as long as you don't start asking where it came from :P
Committing a genocide does typically reduce one's cachet.
Seems like a second-order effect to me, and this report is a good example
I would be interested in knowing which devices were (or still are) vulnerable to these zero click exploits. And how those exploits (used to) work, specifically.
The article contains no information on which browsers are impacted, what exploit is being used, if it has been patched, etc? Does anyone know more about how this ad network is exploiting browsers to install spyware on the users machine?
I doubt it's that easy to click on a link and install malware without the user knowing. Most browsers are highly secure and finding a zero day isn't that easy these days because both sides use A.I. to find vulnerabilities and to secure against them.
One side uses AI to find them. The other side probably needs to keep the holes open for NSA, as the multiple 0 click root exploits that happened in the past to the iPhone with very similar techniques suggest.
It’s not “easy”, it requires a complex infrastructure of exploit devs (who can sell their findings for millions in some cases) and the companies who package these exploits together with implants and sell them.
https://www.packetlabs.net/posts/demystifying-the-market-for...
"Most browsers are highly secure"... erm no
The fact one of the spyware cos was named after the fish that swims up your dick hole is too funny
Of course, who else could it be.
You can have peace or Israel, not both.
Do ad blockers protect against this?
> Reuters has reported that billions of dollars’ worth of Meta’s ad revenue comes from ads for scams, illegal gambling, pornography and other banned content. In the US, ICE and other government agencies have bought software that uses ad tech data to track people’s movements.
I don't know if an ad blocker protects against Discover-Tech’s Controlium but in general you'd be a fool to allow ads in your browser in at this point. The ad industry is pretty shady all round.
For years there was a strong segment of HN commenters who would come on and declare a moral imperative for not using ad blockers and looking at every ad you could in order to support a website.
One must wonder how many were genuine vs an influence op.
Or genuine people who ate an influence op before posting here.
The whole point of an influence op is to find a bunch of useful idiots to provide a large multiplicative factor.
And that's the problem with arguing that something is an influence op, because it is going to be mostly genuine people by the time it gets to you, even though you're not wrong.
On web, likely. If it's in app mobile then no. Run a DNS ad blocker.
Curious if GrapheneOS phones were also vulnerable to this.
Wild guess even if not in this particular case it's best to consider the possibility as non theoretical.
Earlier link:
https://news.ycombinator.com/item?id=50101813
The headline is "Online ads weaponised to deliver ‘zero-click’ spyware, researchers say"
Once again proving that ads are an unacceptable security threat. All those sites now deploying ad-blocker blockers should assume liability for whatever ad software they force their readers to run.
Probably happens with Russia, US, etc as well, but the "hasbara" campaigns through the years have the effect of making people assume the mossad is all powerful etc etc. You inspire fear on your enemies, but also your friends.
edit: and I have been hasbar'd now for simply stating the fact that making people fear you instead of love you has consequences. oh well.
> Related work by the research group Confiant also suggests that Discover-Tech’s ads have been shown to users of the networks of government entities in Europe and the US, as well as the UN, Nato, the international criminal court and the International Atomic Energy Agency.
Yet we don't sanction Israel nor hold them accountable in any way. Of course they're spying on members of the UN and ICC, of course. Israel is at war with the entire world right now, and my politicians continue to support them. Thankfully many people have woken up, but the situation is dire.
Israel keeps being dick earns reputation.
Based on responses from roughly 46,700 people assessing 129 countries, Israel ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
https://www.middleeastmonitor.com/20260513-israel-becomes-wo...
We don't sanction Israel because we are doing it too. Any country with the same capabilities are doing the same thing.
We sanction plenty of other countries where we do the same thing we're sanctioning them for.
That conflates the state with a business headquartered in it. It begs the question of what the sanctions would be for: is the argument that this firm is an arm of Israel, that Israel turns a blind eye to abusive businesses, or something else?
Yes, obviously the state and this company are the same thing. Why would a private company spy on the ICC and the UN? I’m sure there are plenty of 8200 people involved.
That would be the most likely explanation if we knew the ICC and UN were targets, which we do not:
That's from the study itself: https://citizenlab.ca/research/how-discover-tech-turned-targ...
> Israel is at war with the entire world right now
Israel is at war with Hamas, Iran and its proxies and allies.
...and the rest of the world.
Please explain the state of war between Israel and Mongolia.
IWI exports arms to Mongolia, so arguably they've picked a side.
That's not a state of war. So you have nothing to support the delusional claim that Israel is at war with the rest of the world as expected.
I would say Israel using Jeffery Epstein to infiltrate Mongolia is a good example:
https://www.dropsitenews.com/p/jeffrey-epstein-ehud-barak-le...
...and the women and children of Gaza who happen to live with members of Hamas.
My Democratic Rep (who is a Zionist) voted with the Republican Party to financially sanction and impose visa restrictions on members of the International Criminal Court for issuing an arrest warrant for Netanyahu, so the ICC could hold Netanyahu for trial.
I will never vote for this particular (D) candidate again. Fortunately, the (L) candidate seems reasonable.
If indeed your representatives support Israel or the genocide in Gaza, I urge you to consider voting 3rd party. In two-party elections, candidates mostly just try to be a little better than their opponent. What forces them to do more isn’t a third party actually winning. It’s a real risk that enough fed-up voters will go third-party and cost them the election. This is basic game theory optimization.
I wonder who they were facilitating the targeting for given the target countries.
if anyone is well versed with this tech; can this be used to target regular people? how can an average joe protect themselves from this?
All ads should have to appear in an <advertisement> node, and users should have the option of disabling javascript within an advertisement. Make it the fucking law.
Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle... The CTO happens to have worked for Radware
https://radware.com/
https://www.innovid.com/about-us/news/mediaocean-completes-a...
Whenever I think of Israeli ad tech one company always springs to mind, which creates some of the worst garbage on the whole Internet.
https://www.taboola.com/
This crap is the worst of the worst.
"uBlock Origin has prevented the following page from loading:"
Absolutely terrible companies. Another one is https://fingerprint.com/ but iirc they don't do ad targetting.
tel aviv impressed
Title is: Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
In fact, just update the url and title to the report:
How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
https://citizenlab.ca/research/how-discover-tech-turned-targ...
I don't see any ads, so ...
Chance of sanctions?
Zero
NSO was sanctioned, so slightly higher than zero imo.
Imagine if Iran did this... Or China, or Russia. But hey, it's Israel - all laws, rules, norms and ethics is suddenly suspended - so everything is ok!
They do. But "no jews - no news".
Oh you think this is about Jews? Oh, you sweet summer child.
Name checks out
Careful, your antisemitism is showing.
Hacker News sure loves to single out one specific country and blanket label. I remember when comments like those in this thread directed against Russia after the Ukraine war heated up were shut down by Dang. But blanket generalizations against Israel?
Dang's official position by the way https://news.ycombinator.com/item?id=48100358 let's see how this thread goes.
Criticism isn't evidence of persecution. If Israel wants to be criticized less, it should better itself.
HN made a special carve out to the rules it had in place when russia/Ukraine escalated for IP discussions and changed moderating behavior from past conflict discussions.
If you're so concerned about Israel's reputation, focus less on Ukraine or Russia and turn your attention to what Israel is doing to earn that reputation.