Obviously not the first time an Israeli tech firm is responsible for these types of exploits, and at this point I'd go so far as saying that any Israeli-based tech company (especially cyber security ones, of which they have a strong industry) should be considered beholden to the government of Israel and hence, probably not trustworthy. How could you be sure whether they will act like a trustworthy independent entity, or compromise your data for the benefit of the state?
Define "hostile to users" a bit more. Chinese devices recklessly place rando back-doors into things, opening up them up to everyone and their mother. Average consumer router firmware? Compromised. They swallow up any and all information they can get their hands on and operate scam centers where they can utilize the info to blackmail people. Israel seems to have a more targeted approach, albeit there is definitely a blast radius. I'm not sure I can say any one country is worse than the other when it comes to cybersecurity. That includes: USA, Iran, North Korea, China, Israel, Russia etc. They all put consumers at risk; whether it's immediate or down the line when the exploits are revealed and other bad actors (scammers) are able to leverage them. It's a lose-lose for us either way.
I would also love this clarification, because not trusting an Israeli company is one thing, but with China, you're choosing to trust a government that is decades-old at being untrustworthy, not just a company. And whether or not the Israeli government can persuade a company to work with them notwithstanding, it's a known out truth that the Chinese government is in the business of its businesses.
There is no limit. The request is not coming from genuine curiosity — they are asking for a stricter definition so that they can attack any one that you provide, no matter how sensible. The befuddlement is deliberate.
Incorrect. I was genuinely curious and the person you responded to even proves my point in needing clarification because they're referring to an intentional "enemy" (which is relative here), but my understanding of OP's "users" is the average consumer like you or I. That's why I asked what the definition of "hostile to users" is here because hostile to a specific military or organizational target (like Israeli compromised devices do) is not the same as hostile to Frank sitting in a cubicle in Wisconsin (like Chinese compromised devices do).
EDIT: I looked at your comment history and it's full of snarky comments like the one you made here. You're either trolling or you lack a serious self-awareness in your contributions to this platform. Maybe time to step back and examine if it's worth even being on here if you can't control your emotions and have a civil conversation instead of these virtual drive-by shootings where you don't even engage with the actual person you're commenting about. This is not Reddit.
This is a weird question and comment because a country doesn't generally make the software. But I suppose they seem to have a lot of influence on the companies. Like surveillance cameras in China.
If I was to say what companies have done the most to take the most privacy from the most people, it would be American big tech like Google and Meta.
There's some okayish software from Israel I can think of, like Zcash.
These Israeli ones are literal criminal companies. What Meta does should be illegal. Both are immoral.
A single spyware against a journalist is much worse than a single Facebook user, but for the total impact on society, they both destroy democracy and human rights significantly.
>I would sooner trust a Chinese company than an Israeli company
As for trust, with privacy I'm a big proponent of avoiding it. Use E2EE or self host if you have to. The country does not matter so much.
Zcash was created as an alternative to Monero. In Monero, every transaction is completely anonymous. In Zcash, transactions can be chosen as anonymous or not, so users can be pressured to avoid anonymous transactions, and to avoid associating or transacting with users who use anonymous transactions. This is apparently the main advantage and selling point of Zcash.
Some multinationals have their R&D offices in Israel, there's a lot of pretty good research coming out. Russia would probably be worse in terms of trust and they are openly hostile to the West unlike Israel.
Israel has openly and publicly threatened western politicians and citizens that don't aid their agenda however, many times. Like Russia, they have also shot down commercial airliners.
Unlike Russia, they have killed American sailors whilst directly attacking American naval assets.
That doesn't make any sense. China is a full dictatorship, Israel is not.
Vote me down all you want for saying something about Israel that's not super negative, but it's not a "which country do I dislike most" competition when it comes to facts.
China being a dictatorship means bad things for Chinese citizens but not necessary for the rest of the world.
Israel being a (disfunctional and rather illiberal at this point) democracy, means it's much better for it's own citizens (excluding Arabs ofc), but says nothing about the people outside. Same for the US BTW.
> You wouldn’t put personal data and trust in a Chinese app.
At this point, I don’t agree. I’m an immigrant living in the US currently. From an infosec and real-world consequences perspective, I have much less reason to fear what the Chinese government or corporations could do with my information than what either the current US government or its major tech corporations might do.
> Israel still have the reputation of being part of the ‘free world’ in the collective mind.
That collective mind is cognitively challenged and extremely ignorant, but it doesn’t mean I have to be.
wonder how long they'll be able to uphold this reputation, it's a bit puzzling to me that they still have one after three years of genocide in Palestine/Gaza and attacks on Lebanon, Iran, Qatar, Yemen and Syria. with the president having a warrant for war crimes and being investigated in his own country. and far-right government officials proudly saying that they want to eradicate their arab neighbors, and other heinous shit.
seems to me like lots of people are wary of ever criticizing or changing their mind about Israel, because their population once was the target of arguably the most heinous genocide in history, so far, which i'm of course very sorry for. must've caused some heavy, multi-generational trauma, other than that i can't explain why they're acting the way they do. don't make the mistake of translating official government statements or looking at population surveys, truly horrific, barbaric stuff. but of course the only terrorists in all of this are their neighbors which they keep in open-air prisons they at this point have bombed to rubble.
If I were engaged in anything hostile to Israel I utterly would not trust Israeli stuff. But Israel is normally quite careful about target selection, if I was not engaged in anything hostile to Israel I would expect anything they slip in to be secure and to not do any harm beyond it's existence. A scene from Lebanon not too long ago makes it very clear: A whole bunch of people milling about, setting up for selfies and the like--then we see the building behind destroyed by an airstrike. Clearly all those people around knew the building was going to be destroyed and they trusted Israeli accuracy enough to be standing not too far from where the bomb would land.
China, though, I would utterly not trust target selection or security against misuse.
I'm saying they shouldn't do that, because there is a decent chance those Israeli companies may do things at odds with their customers' best interests (because they cannot or would not say no to a government request).
* The state of Israel does authorize spyware sales (eg NSO Group has to get a license from the Ministry of Defense, and Israel's Defense Export Control Agency states that its decisions take national security / foreign policy into account).
* In the case of Pegasus, NYT had reported that Netanyahu intervened to make an exception allowing sale of Pegasus to Saudi Arabia (as political leverage). NSO group execs used Israeli diplomatic passports when they traveled and stayed at the Israeli embassy.
* The government doesn't crack down on these industries, which it would do if it really considered them criminal.
* In this particular case, one of the main targets was Al Jazeera, which seems unlikely that a criminal company would want to target vs. a state actor.
So yea, the government seems to allow these companies to engage in what other countries would consider criminal activity. You can then kind of choose your spot on the spectrum of: "I think this is some broad conspiracy the government purposefully designed for large-scale espionage" or just "The Israeli government thinks it would be good to have great cybersecurity skills in the country so they bend the rules a little".
A good well-researched read is The Palestine Laboratory by Antony Loewenstein.
Exactly. There's plenty of public-private partnerships in Israel and there is zero chance that a spyware firm would go unnoticed. Israeli academia, defense industry, and government is tightly interconnected. See Unit 8200, for example, which basically works as an incubator for Israeli cyberspace fraudsters. Denying Israeli government involvement here is just as dumb as denying Russian government involvement in Fancy Bear.
Jewish and Israeli are not identical. It's possible for someone to have negative views of the country without that being a stance on people who are Jewish.
OK, I read the report, but I'm still not clear on what the browser vulnerability is. This clearly seems like something browser vendors should be able to patch, correct?
The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited.
It was a Windows exploit that ran. An adBlocker (funnily enough) would've been an excellent defense against this, given that the exploit ran in JavaScript served in targeted ads.
Though, there is a browser patch for this, don't advertise so much identifiable information that an advertiser can identify a user or their employer. That's the defense, but it'll never happen.
The os exploit is, within this context, after the fact and therefore a non sequitur. You should look up the Project Zero watering hole analysis where they revealed something like 17 0-days being delivered to visitors of one particular site. It's likely that citizen labs only had windows exemplars.
(This comment must have been posted in one of the other threads before we merged them hither. I don't recall which one, but the other links are in the toptext.)
Very weird to me that they never recommend that the industry could stop adding javascript to their website. They recommend millions of layer of "security" but never recommend the end of javascript. This is outrageous to me. Disable javascript!!!
My question is, why is Israel so good at this? It seems to be at least the 4th cyber power of the world, after the US, Russia and China, if not actually on par or better.
I guess it is because it has been under the threat of larger enemies from its birth, so it must leverage whatever it has to survive. And once you grow an organization and let it loose, you don't have much control over it anymore, and it grows in the wild like a flower.
Circles probably matter. I am actively in communication with several hundred people of all ages outside of tech. I have never heard anyone say anything except: (1) positive of Snowden, and (2) negative of the NSA.
US gets away with it because no one can challenge their military might, Israel gets away with it because any criticism of the state is “anti-Semitic”. Not the same thing
...Did you just emerge from a bunker that you entered in 1946? Here in 2026 we're on quite a losing streak against MUCH weaker opponents. I mean I get it, you're doing the "Jewish conspiracy" thing and reality, truth, words having meanings are all inconsequential to you, but you have to try harder than this.
Even the US had big scandals with Abu Ghraib and waterboarding, with big public debates. Even if this was just about public image and hypocritical, not about real values, it shows some capacity for shame.
Though this may be changing now with Trump and the israelification of america.
Big scandals that led to... prosecutions of the people involved at a high level? Systemic change?
Come on... Snowden told us that we were all being spied on and we made some movies, some books, a lot of blog posts and that was it.
Abu Ghraib? The people literally on film doing things were prosecuted, and it was passed off as an essentially low-level problem.
Gitmo still exists and has prisoners.
We invaded Iraq on a lie, literally lied to the UN about a nuclear threat that didn't exist. Elected that guy a second time, just like Reagan and Nixon and Trump.
What we're good at is public debate that goes nowhere and losing wars in the Middle East.
All normal countries spy on their enemies and all normal countries spy on their friends. All normal countries use cyber-espionage. All normal political groups condemn the actions of groups they oppose and excuse the same actions when committed by those they support.
1. For all normal countries, if they get caught, there's consequences. For Israel there's no consequences even if they get caught.
2. Israel is embedded in US politics. So US government is allowed to purchase this from Israeli contractors but I doubt they would be allowed to purchase sensitive stuff like from a neutral country like UAE.
So, the US is the customer and also protects Israel so Israel has built an entire industry around it.
You just listed some of the most sanctioned countries in the world #1 and #3.
China doesn't have large sanctions because it plays a key role in the economy, but the US had massive regime change intelligence operations against them in the 90s, but they failed and were dismantled.
It’s an interesting question. I would also guess that this kind of behaviour would be illegal for private companies in many countries even if you don’t do it domestically.
Cope harder. The US guarantees the security of many nations, including many of the failed states in the Middle East. Look at Saudi Arabia, being completely helpless and begging everyone for help with the Houthis.
That's been the status quo for decades, but between Trump convincing folks that the US won't protect them and Iran convincing folks that the US can't protect them, and Hegseth focusing more on culture war stuff rather than policy objectives it's a guarantee that's looking a bit thin.
Iran isn't convincing anyone. It's a rogue terrorist state that has pissed off all of its neighbors by launching missiles at them and harassing their ships in international waters. The country is sinking, inflation and unemployment are rampant, its currency is worthless, but the mullahs will do whatever it takes to stay in power.
Israel is the one occupying and bullying its neighbors, spying on its "allies", doing air-strikes on neutral countries, attacking US research ships, and performing piracy and kidnapping in international waters.
Back when I was a tech journalist, back in the 90s I visited Israel once and interviewed a number of their tech companies - admittedly most in the cyber-security space.
They ascribed a lot of the tech innovation to conscription - lots of the founders had learned a lot while in technical posts in the army and put that to use when they left.
Most people have heard of the Mossad, but Unit 8200 of the IDF deserves the same notoriety. The state selects bright young techies and trains them in the absolute state-of-the-art in cybercrime. What could go wrong?
>The unit is composed primarily of 18–21 year olds. As a result of the youth of the soldiers in the unit, and the shortness of their service period, the unit relies on selecting recruits with the ability for rapid adaptation and speedy learning. Afterschool programs for 16–18 year olds, teaching computer coding and hacking skills, also serve as feeder programs for the unit. Former Unit 8200 soldiers have founded and hold top positions in many international IT companies, including in Silicon Valley.
>According to the Director of Military Sciences at the Royal United Services Institute in 2015, "Unit 8200 is probably the foremost technical intelligence agency in the world and stands on a par with the NSA in everything except scale."
Multiple reasons. America gives Israel special protection for everything they do, Ashkenazi and general Jewish culture values education more than anyone outside of East Asia, and a lot of Soviet Jewish scientists had to work for the military so they came to Israel with cryptography or spy tech experience.
> Ashkenazi and general Jewish culture values education more than anyone
I would recommend you to visit Israel and traditional orthodox jews. Women are serving as "birthing machines", constantly pregnant, and doing all house chores. Education for women is strongly discouraged. Men are "studying", but useless memorizing of old texts.
Normal education in western sense is strongly discouraged in traditional jewish culture!
Two things can be true at the same, although I agree with your assessment of future prospects - and the recent OECD report on school performance could be read that way too (or blamed on the war as the government has).
Israel is not just one homogeneous people, there are some orthodox jews who study biblical texts, treat women as birthing machines, and (personal opinion) contribute little to our society.
Yes, orthodox jews are a significant part of the population (~1.4 million in 2025 [1]), and I wouldn't go there looking for modern ideas like women's rights, but go a couple km in any direction and you'd find completely different people, living modern lives just like in the rest of the western world. Schools, research universities (Tel Aviv University, Waitzmann Institue of Science, Technion), tech companies, startups, makerspaces, and many more.
Traditional Judaism has this really weird (to me, a goy) emphasis on finding loopholes in rules. I always remember these ropes they place around New York City and other places so they can stay "indoors" on, I think it was, the Shabbat, by walking underneath the rope, which is a type of ceiling.
As I understand it, they know God's not stupid and sees right through this sort of thing, but they believe God put rules like "stay indoors on the Shabbat" in place so that He could entertain Himself by watching the creative loopholes humans come up with. Other Shabbat loopholes include putting things on timers the day before, paying a non-Jew to do things that Jews are forbidden to do, or legally transferring ownership of the cupboard full of bread to a non-Jew for the one day a year when Jews aren't allowed to own bread.
And as I understand it, they do this with all things, from a young age. Cultivating this mindset definitely has something to do with their cybersecurity prowess.
> Traditional Judaism has this really weird (to me, a goy) emphasis on finding loopholes in rules.
As an atheist Jew, it's weird to me as well...
> stay "indoors" on, I think it was, the Shabbat
Can't say I'm familiar with that one. What I'm generally familiar with is that you're not allowed to "work" on Shabbat, and the definition of work is extremely broad. For example, lighting a fire is considered work, turning a light switch on creates a tiny spark between the contacts, that counts as fire, so it's work.
This extends to pretty much every electrical device, so for those who observe Shabbat, using a computer or phone, turning the AC on or off, is all disallowed.
As a result there are many workarounds as you've described, timers, non-Jews (though you can't ask directly! You can say "it's hot in here", but not "Please turn the AC on"), fridges without a light bulb inside, and more.
> they do this with all things, from a young age.
Religious families do, to varying degrees. But I've met plenty of extremely talented programmers and hackers who do not follow any of the Jewish law.
Edit: Just noticed your username, I also want to say I really like your projects on YouTube!
And also it has help, it is unlikely it acts alone. Example Stuxnet. Israel has the talent so they are a convenient and willing proxy too for getting shady shit done.
Don't forget the compounding effect. Say, one country (or city or community) decides to invest their efforts into area X (e.g. clock making in Switzerland). They do it and become better and better. As long as they keep doing that they can become #1 in the world. Regardless of any reasons "why them".
There's no reason Netherlands are better at chip lithography except that they're doing it (Dutch agriculture success can be attributed to good soils/climate/geolocation, but not chips). There's no reason Hollywood is better at filmmaking. Kinda chaos theory -- small changes to initial state leads to huge changes in the later outcomes.
I would like to give a real world example of this too.
If you want to do something artistic or start a business based around Art, Montreal is perfect for it, for the very same reason above.
Initially the govt invested in the arts to preserve French culture, which resulted in a lot of art infrastructure being made, cheap ateliers, fabric suppliers, paint suppliers, &c. Which attracted a lot of artists, which then increases the demand for the art infrastructure, which makes the city easy to make art in.
It makes it stupid easy to make stuff and find the skilled artisans you need to make it. Much easier than any other Canadian city I've lived in.
Depends what "best" means. Best city for cheapest workers in that area? Best city for highest paying employers in that area? Just these two would yield different cities.
The Hollywood case has a quirk that is relevent to the extensional content of HN:
West coast filmmakng started in the Bay Area (at the time the largest conurbation in the west) but moved south because of the year 'round weather.
But why the west? Because Edison controlled the filmmaking patents and demanded not just royalties but script oversight as well. By moving west, they could ignore the patents because they were simply too hard to enforce from such a long distance.
So ironically, given how things worked out, IP piracy is at the root of Hollywood.
Yep, but Edison is long gone, while Hollywood kept compounding over time. There's zero other reasons Hollywood is _currently_ better than any other place for filmmaking.
This, plus all jewish folks I've ever met are naturally smart (not genetically of course, more like societal pressures/expectations/upbringing), hard working like few others, and seem to genuinely veer towards numerical jobs - banking and finance, math, applied math like security, cryptography, trading and so on. Very similar to Iranians to be fair, if US and British MI6 wouldnt be meddling in Iranian internal politics and supporting corrupt shah to steal all the oil cheaply those 2 would be together a superpower on global scale. Israel was very very lucky to not have any oil on their territories.
Plus very much present in US politics and power circles for some reason.
2 examples out of many - my boss is a prime example, every thought somehow infused with money (I work in a bank). My ex gf was exactly the same (she is a successful commodity trader). Just very, very different mindset to the core to say typical european one (I mention folks who are europeans and I've never been to Israel, so extrapolating a bit here).
It has always been at odds with its neighbors and has persecuted its occupied people, for far too long. It has further facilitated other tyrant governments in the control of their people. The cyberwarfare industry in Israel is directly part of the controlled Defense Industry.
It is not under threat. It has sought to be a formidable threat to everyone.
Israel is definitely a threat to its enemies, but even if you think it's all their fault and they deserve it (I do not think that), it's pretty obvious that Israel also faces many threats.
Perhaps you don’t know the history or simply choose to ignore it. Initiating bombing, ethnic cleansing, stealing land, property and occupation of people for eight decades, while publicly declaring a desire to invade all the regional nations to create a greater Israel apartheid regime does generate pushback. Imagine that.
See professor john mearsheimer on the history & future of israel
What I meant was, I don’t think Israel is the only guilty party in that decades old conflict, nor the only side with agency to choose how to react in the conflict.
Read the Hamas charter, Iran’s statements about Israel, etc. Israel is not unique in choosing violence.
The Hamas charter is more-or-less isomorphic to the Likud charter, Likud being the currently ruling political party of Israel. So it's not fair to assign asymmetric blame to those charters.
The idea of Israel being under threat has been inculcated into every Israeli and Zionist. Significant casualties of historical facts had to occur such as The first arab israel war is described as arab world fighting Israel, Even though Israel conquered significant parts of UN partitioned Palestine. The arab govts were too new to be a threat. And they were too disunited then and now. Since inception, Israel has been behind every attack and disruption to peace.
Not really. Most countries don't face realistic threat of invasion, especially post world war 2.
Over the last 50 years, the probability of anyone invading france, canada, australia, etc has been next to 0. The only countries that really had to worry are the ones that straddle the regions of influence during the cold war.
Pre-1967 Israel didn't control the West Bank or Gaza. So most of the bad stuff people claim about Israel today didn't really exist.
Yet all its neighbours wanted to destroy it.
Lebanon who in theory should have no dispute with Israel bombarded it with ten's of thousands of rockets, mortars, anti-tank munitions etc. After Oct 7th.
The bit you're missing in your overly simplistic analysis is that Israel is really surrounded/attacked by a single religious/political ideology. There is no "everybody else here".
And what you are missing is that Israel acts don't call for friendship even in the people that would want this friendship.
Israel has stolen as much military and industrial secrets from US as they could grab. Has violated every international law. There are strong suspicions to be behind Epstein honey trap for riches and politicians all around USA and Europe. Has funded Hamas. Has an horrible relationship with human rights, longer than the bible. Has called non Jews "human animals", and acted accordingly, even to the point of doing competitions about "who can destroy more kneecaps or shoot more testicles in a week", among starving people that were trying to obtain food none less. Has treated 5Yo children like partridges in a hunting party. Has killed thousands of journalists, doctors, nurses and NGO staff without even trying to pretend that they care. Has put spy devices in friend's phones each time they could. Was caught messing with the elections in UK. Has used, discarded, and left each politician that supported them, alone and hanging dry in the elections, from Biden, to Trump, to Merz.
US does not want the demise of Israel, but Israel does not even try to pretend that they respect the opinion of US. Even after all this time, is all grab and cash. And US is always cleaning the mess that they left behind.
And the only thing that we can hear from them is "Why everybody hates us?" Really?. Clean your acts first.
But that's mostly true because those countries are rich and fly half the world away to attack poorer countries and usually by bombing them from far away. Eg syrians can't realistically gather enough money and weapons and planes and bombs to bomb paris. Or iraqis london. Etc. On the other hand, they can gather a few fanatics, give them guns and have them shoot a bunch of people, or bomb something, or worse. But then we get the "why did those people get radicalized? was it GTA?" articles.
TBH, considering the number of dead in palestine and the number of people in europe/us who literally lost everyone who ever mattered to them, the number of "terrorist" attacks seems relatively low.
Why is that relavent? The point is that some countries have more immediate security fears then others. It doesn't matter what structural factors lead to that. Countries with realistic security fears are going to invest differently than those that don't. Countries like people do whatever they think is in their best interest.
If your point is the world is unfair, then yes obviously that is true, nobody disputes that.
If france decided they needed to exert their "political pressure" over eg. germany, they'd have the same problem and all the realistic security fears, because germany is a rich country and they share a border. Same for the opposite direction with a few more historic events related to that. Same with france vs uk wars, and many many other wars in europe.
But hey, having your capital cities bombed is expensive, transport is cheap, and so it's easier to bully countries in a different continent, eventually bomb and invade them, becuase you're pretty sure they won't be able reach you back home with conventional war means (planes, rockets, tanks,...).
And yes, it's relevant, some politicians in one of those "safe" countries decided to bomb some country in a different continent, and you, a normal football fan or a party goer get killed when those people come and fight back in "unconventional means" (eg 2015 in paris). Somehow no one treats those as "we're at war with them, we bombed them first, they're just fighting back".
To a certain extent, i think its because Israel benefits from being seen as "scary" so there isn't as much pressure to keep this sort of thing on the down low, where in any other countries there is more pressure to keep grey-area stuff like this secret to prevent blowback.
A few potential possibilities that may or may not be popular here.
- Compulsory military service means the government captures the best and brightest of the country.
- An extraordinarily outsized number of nobel prizes belong to Ashkenazi Jews, and other indicators of intelligence (lack of propensity for violent crime, lifetime earnings, etc) are also quite high for the whole group.
We have had viruses leaked by other countries in the past, with US and Germany coming to mind. If I remember right it was around 2005-2010 when democratic nations officially started to state that they had a right to use malware against criminals and military targets, and from that on it has just kept going. As I recall, Bruce Schneier and FSF made a bit of articles and talks where they tried to get people to understand that once democratic nations starts to use malware offensively they also generally stop protecting their citizens from those security holes.
That we don't hear about it more often seems to me that nations that develop this stuff seem to have gotten better in making malware more precise in what they target and less leaky to the general population, but it could also be that media just don't report about it as much. When a gangs anonymous chat get hacked, or a tor hidden service website get taken down, news seems more interested in talking about the crime than what security vulnerability that the police used.
Unit 8200 [1]. Also, Israel doesn't extradite its own citizens and seems to turn a blind eye to criminals doing nonsense abroad. (Similar to Russia and China.)
That unit is a symptom of their prodigious skill not the cause. Israelis are good at cyber for the same reason the US is good, and the same reason Russia is good. They have an outsized tech industry.
> That unit is a symptom of their prodigious skill not the cause
"Unit 8200 was established in 1952," and apparently the Technion – Israel Institute of Technology was founded in 1912 [2]. I don't think Israel became a tech centre until the 1980s or 90s.
I'm not an expert on this. But similar to how military spending created Silicon Valley, I think Israeli military structure created its tech industry.
Because Apple, Intel and Samsung have huge engineering labs there and employ IDF & intelligence people to work in those corporation’s labs. It means they have very detailed knowledge of their products as they have all internal documents and also design software & hardware.
That is why both Apple & Samsung have malware from Israel on their phones. The USA has the NSA building and exploiting products for surveillance and penetration globally.
Netanyahu recently was on a US broadcast, he held up a phone and stated to the reporter interviewing him, that Israel can penetrate any device obtaining it contents and then blackmail or discredit the owner of said device.
The USA now examines phones at airports to see if people are saying things the current administration doesn’t like.
Because they are arrogant as fuck, barge their way in, shove everyone else out of the way and genuinely believe they are gods chosen people. Are you surprised that a country that regularly spits on Christians and turns cities into concentration camps while running the world's biggest pedo blackmail ring, "right to return for pedos" offer, exploding pagers and spyware operations - happens to be the best?
For the same reason Russia is so good at producing mobsters - the government turns a blind eye or even acts as an incubator for scammers. Your question is like asking why the Philippines is so good at sex tourism.
AdTech engineer here (some 13 years in the industry). A couple of notes:
- The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.
- To the point below that "ad providers should be held responsible." There is no such thing as "ad provider." The AdTech ecosystem is teeming with different niches and business models - see the famous LUMAscapes diagrams: https://lumapartners.com/lumascapes/ . The sheer volume of traffic makes it virtually impossible to vet even a fraction of it. Google has thrown a lot of compute power to pre-scan 3p creatives and even then bad actors can sneak through. Add to this a lot of sophistication on their side (from different landing pages based on the perception of the type of user to farming throw-away advertiser accounts aimed at running just one campaign like that to hijacking legit accounts through sophisticated technical and people engineering means). In the end, politicians full of indignation do what politicians always do - sue or fine Google and call it a victory, whereas the true bad actors just keep going.
Prior to online ads, that is ads that existed on TV, print media, etc, ads were properly vetted. Very few outright scams made it through.
So, it’s definitely possible, especially with human review and static ads. No code. It might not be possible at scale. To me, that’s just not an excuse. If you can’t do something safely at scale, then you shouldn’t. If that means generalized online ads can’t exist then… so be it.
Online ads are definitely still possible. For example, im sure Disney reviews and approves all ads that run on Disney plus. So just do that, and if you can’t do that for e.g. YouTube then dont.
Not in Australia at least. There were ads for flash in the pan fitness and weight loss devices and various other wastes of money, but outright scams and illegal devices would have their ads pulled real quick.
I think your answer gives us a clue about what went wrong and where.
The fact that internet advertising is run by the big US tech behemoths, makes them difficult to go after by countries that have previously had sane advertising standards. The lack of US regulation is the winning car in the race to the bottom.
You clearly misunderstand the sheer scale of online advertising (compared to linear TV ads, magazine ads etc). There is no chance you can vet every single creative and a landing page (one public number is 30B daily ads just served by Google alone in 2012 - which is probably closer in spirit to the Punic Wars than to 2026).
That's the first point. Now, who should be responsible for getting the ads? The website? That will absolutely kill the monetization model and it is simply unrealistic. Which means, that responsibility now should be pinned on someone else. Who would that be? My point being that no one there has an inherent lawful obligation to provide such vetting, which would be a) costly and b) only applicable to one player (out of many).
And then we get to bad actors. If I were a really motivated bad actor as early as in 2005, I was serving different creatives and different landing pages to different audiences - a perfectly well-behaved ones to Google's crawlers (again, Google does A LOT to fight malware), a questionable quality clicky ones to general audiences and maybe malware-ridden ones to specifically targeted audiences. And you would not be able to catch me in real time - only after the fact, once the campaign was run and someone looked at the evidence (assuming it was collected, which it isn't normally)
it has to be the website to start with; if the website is hosting malware, then it's the website's problem. Soon after that's implemented, the adtech companies will begin competing to solve the website's problem by promising clean, malware free ads, and will begin aggressively vetting ads. The monetization model will be preserved and the incentives will be properly aligned.
There is no universe in which 'gosh it's just too hard' is the correct answer.
You have to be specific what you mean by "ads" then. If you mean creatives that ultimately rendered - you are absolutely correct. I don't have any stats handy to check the ratio between the two to estimate the number of unique creatives, but I believe it is a) several orders of magnitude smaller but b) still very very large.
And again, we are talking about logical creative (the actual visible part). Click URLs and such will definitely be different.
If it is indeed impossible to vet all the traffic passing through your networks, then perhaps your networks' existence is itself the issue. Maybe it is indeed not possible to vet 30 billion ads, just like it's difficult for Facebook to moderate all 3 billion users.
Perhaps the actual problem then are these monolith platforms that have done such a good job "eating the world" that they can no longer properly function.
If you really read what I wrote above - there is no "monolith" (and yes, Google is everyone's favorite Boogeyman). AdTech is a primordial pool all kinds of actors, each of which has found a profitable niche to "add value" (or to bullshit partners about "adding value").
I spoke of the network in specific. Whether we're discussing one firm dumping industrial quantities of sewage into the internet, or 10,000 tiny ones, doesn't really change at all that there's industrial quantities of sewage.
I'm critically uninterested in the fictions of the business idiot class. I'm sure for many purposes it's important for all the papers to have the proper LLC's on them. For the purpose of burning it to the ground though, it's not overly important.
While I respect that you are posting constructively here you might also be the physical embodiment of the old joke that it is difficult for someone to accept a truth when their continued employment depends upon its falsehood.
The Web used to be a great place before surveillance capitalism and adtech took over. Some of us remember it. People participated because they wanted to. People contributed content because they enjoyed it. The incentive was a sense of community and contribution and shared knowledge - and usually there was no expectation of direct financial gain. Basic hosting was included in everyone's normal ISP plan. SEO wasn't a thing. Blogspam just to generate pages to host ads wasn't a thing. AI slop just to generate even more pages to host ads wasn't a thing. And there was still more genuine and worthwhile content out there than anyone could read in a lifetime.
If 95% of the modern Web disappeared tomorrow and all that was left was what people or organisations were still willing to contribute because they enjoyed it and/or it provided some direct benefit then the Web would probably be a much better place. I cite as exhibit A the fact that we're all here posting our thoughts on HN - itself a site that has always run without any of the intrusive advertising we're talking about - without any compensation or reward other than the enjoyment of the discussion and perhaps the chance to learn something new.
I see no reason to tolerate any sort of online advertising that conflicts with the above ideals. We should simply set rules that decide what is acceptable and drop legal nukes on any company - or indeed any entire business model or industry - that fails to comply. Low key advertising for YC's next round? I doubt a single contributor here minds the little banner that pops up at certain times of year. In-your-face auto-play videos that accidentally (or not - it doesn't matter) advertise something dangerous before your kid's favourite show plays? Sue everyone and punish the offending businesses without mercy. It's really not that complicated.
It was allowed to grow to its current "sheer scale" due to lack of regulation, be that internal or legislated.
Continued lack of regulation, throwing up ones hands and saying "well, it's too big now" will not allow it to be solved.
What has been 'normalised' in the online advertising industry sets my teeth on edge as someone with some amount of security and privacy awareness. Hence I go out of my way to block as much of it as possible, for myself and family and friends.
Even the FBI and NSA make public their recommendation to run ad blockers as a safety requirement for internet browsing. I would have thought this may be some kind of red flag to say that maybe you're doing something not quite as well as would be satisfactory.
I find myself a bit astonished whenever people have trouble with this idea.
We can just decide that if you can't afford a person to vet the ad, it's not allowed to run.
Yes. That will destroy the current online advertising industry. As tempting as it is to say "that's the point", that is in fact not the point. The point is, we are completely in our rights as a society to say through regulation that if you can't vet an ad with a human, you can't run it, and the capital structure can damned well do what it does best and accommodate that whether they like it or not. We absolutely can write laws that say that Google is to some extent directly liable for the ads they run. Nothing is stopping us, at least in principle.
Does that mean it will be a lot harder for the advertising industry? Yes. So be it. That is not a reason this can't happen. Is it expensive for them? Yes. I don't care that this means that they won't be able to run anywhere near as many ads.
It is not a stopper that it would be really hard for them. It should be harder than it is. It should not be profitable to build a vast surveillance apparatus to squeeze literal fractions of a penny at a time out of us. It should not be profitable to have this massive machine that can push such targeted malware at as.
We're not talking about some minor tweaks that they can toss a few AI tokens at. We're talking about regulation that would rewrite the entire social contract of advertising. A social contract that we have not really signed, either individually or collectively. We can do that. We can rewrite the contract. It's a permissible thing.
We don't have to have a massive surveillance state just to serve us ads. We don't have to have sports gambling advertising on television. We don't have to have billboards on our highways. We don't have to have extra-cheap mailing rates for ads. We don't have to have Roblox and other video game systems exploiting our children's psychologies with deceptive game currency practices and gambling mechanics. We don't have to have state-sponsored gambling running what everyone knows is a backdoor tax on the poor. None of these things are physically inevitable. None of these things are socially inevitable. There are reasons why these things do exist, which economists and game theorists and political theorists have various words for, but none of the reasons are because they are mandatory and we're just stuck with them forever because there are no other possible worlds.
Disney (CTV) doesn't take any open auction demand. All their programmatic demand is deals - meaning that they carefully plan those campaigns with highly reputable agencies and advertisers. There is zero chance for a contentious scammy crypto exchange ad (or even a moderately innocent crypto wallet one) to show on their properties.
Which you can absolutely do, when you are Disney (read, agencies fight to run a campaign with you). When you are, let's say, TechCrunch, the situation changes - you can still strike some deals but a lot of your demand is not the same grade.
I just don’t find business model arguments particularly convincing. If your business model can’t support itself, I don’t think that’s justification to go out and do whatever.
Yes, exactly, if programmatic deals aren’t possible to do safely then dont. There’s tons of stuff you can’t do safely programmatically, so we get people involved. Many such domains exist. The idea that advertising can’t be one of them is just the status-quo, not the only option.
Your appeal to authority as an "AdTech Engineer" works against you when support your own industry. You have a conflict of interest. Of course you will try to do damage control and PR.
I was surprised by the opening statement too. These guys are the literal scourge of the modern web and he's proud he's been at it for 13 years? Not sure we're on the same page, lol.
Or you can read what they said and see that it's neither. Not sure why credentials would have any bearing on the material of their comment.
They're pointing out the article lacks substance implied by its title, and essentially that it would be nice to see the actual bad actors being prosecuted instead of the middleman. Both positive things to hear for me? Who cares if they work for the industry.
(The former thing is positive because it saves me time reading the article for information that won't be there.)
I don't have any conflict of interest. I'm proud of my work and I think it is great. I personally dislike ads as much as the other guy, but I am pragmatic and I have enough sense to understand that this economics has flourished because it maximizes common good: content creators are incentivised to produce good content and get properly and sustainably rewarded, regular users don't get nickel and dimed every time they load some web page.
To paraphrase Churchill, it is a terrible model but others are worse.
If a website serves me malware, the website's owner should be liable to me. They may then be able to sue someone else, in turn. But I chose to interact with them and then they chose to outsource stuff to crooks.
This would be complicated to implement. But it's absolutely doable.
No, it's not. It completely upsets the economics of content management and makes it absolutely impractical for content owners to monetize through ads. No ad revenue would be worth such liability.
Then there are all kinds of fun scenarios - from drive-by malware to landing page malware to malware served after clicking an ad ON A LANDING PAGE. Who would assume responsibility for those?
Bottom line, this is not much different from "regular" crime. It happens. Governments employ police and various deterrents to reduce it. But it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness.
I think we currently are - but not because of online ads. :-)
My main concern is supply chain attacks. I'm afraid, the frequency and sophistication of such attacks will only increase, thanks to really powerful LLMs. From there - to running keyloggers and stealing your bank credentials etc.
"in-part because of ads" seems more reasonable, tbh.
When I worked at an adtech company almost ten years ago, this sort of shit was the exact concern of me and my colleagues. We've had time to do better but guess we're just fucked.
What, your ad provider would just need to indemnify you for the consequences of their own fuckups. This is pretty basic stuff.
As for the ad provider, it is trivial to not deliver criminal payloads if your business starts from the assumption that doing so is costly instead of something you can foist on society for your own benefit.
> completely upsets the economics of content management and makes it absolutely impractical for content owners to monetize through ads
Why? An insurance product wouldn't wipe out ad revenues.
> this is not much different from "regular" crime. It happens
Why do you think parking lots have signs that say they aren't responsible for goods stolen out of cars parked there? Because that liability, by default, exists. And if a parking lot is a robbery hotspot, and the owners don't bother putting up cameras or whatnot, they'll absolutely start facing lawsuits and investigations.
> it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness
Nobody argued as much. That doesn't mean we give negligent actors monetizing malware a free pass.
> It completely upsets the economics of content management
Exactly. It moves the economic incentives from "serve the ads from the highest bidder and turn a blind eye to the fact that that's a scammer/malware" to "drop an ad platform that can't or won't keep the scammers/malware out".
Or even better, refusing to use ad platforms that let the ads serve arbitrary code. There is no strict reason why an ad can't be an image (re-rendered by the platform) and a link. Slapping scripts all over the place just makes it easier to collect data (among other things to verify that all the companies involved in serving your ad aren't cheating you, because the ecosystem is full of scammers in all directions).
The deterrent here would be prosecuting the accomplices involved in, and directly getting paid for, the crime.
But it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness.
How can you exercise situational awareness against a zero-day attack?
There are several parties who have an opportunity to detect that problem before it causes serious damage to people visiting a website. The visitors themselves are not among them. Trying to make those visitors responsible for the consequences is nonsensical.
And this would motivate fundamental change in the industry to be able to track down the bad actors.
KYC exists for various industries in order to track down the person responsible for bad actions. Implement KYC for the advertising chain, or something equivalent, to ensure there's a validly registered sue-able entity at the end of it.
> be mindful and exercise situational awareness
I'm not going to say victim blaming, but a good percentage of the population just aren't capable of this, especially with "the sheer scale" of advertising they're exposed to. It's exhausting to be on guard for the entirety of your life.
Might as well say: don't use the internet. That might actually be the best advice to come from all this.
This was my main question as well. I read the report, but I'm still not clear on what the browser vulnerability is. This clearly seems like something browser vendors should be able to patch, correct?
The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited. The step-by-step info graphic in the article literally skips over how the infection actually occurs.
>The sheer volume of traffic makes it virtually impossible to vet even a fraction of it
No, it doesn't. Your company is too much of a cheap fuck to do it and would rather offload that cost on society, no matter how bad the effects of it is.
>There is no such thing as "ad provider."
Only when it's to your advantage, because you're very happy to refer to yourself as an ad provider in every single marketing piece.
>AdTech engineer here (some 13 years in the industry)
You've made the world miserable for the past 13 years and have the gall to come over and pretend you're a poor innocent little thing who can't do nothing UwU there's just too much how could we be held responsible.
Not to jump on you after everyone else did (although I agree with them), but they didn't give you a solution. The solution is unfortunately for everyone a robust KYC regime. Then the linkages stop being impossible to track and instead become merely burdensome.
Obvious sarcasm aside, I compel you to ponder on this question next time you read "free" content on the web (a newspaper, a dedicated niche site or anything in between).
Former Adtech dev here - yeah, that justification worked for me for a while but when I was ordered to "just go look at this porn site and figure out what they're doing to open popunders despite the latest browser updates and then apply it to our adverts" too many times, I jumped ship.
But sure, "free content cos adverts", you keep believing that for as long as you can, I jumped ship after 13 years of it, which ironically appears to be how long you've been in the industry.
Let me just say though - adverts can still support free content without all the absolutely scummy things the adtech industry does. You don't have to track users across everything you can possibly track them across to still make money - my former company at one point was going to partner with Shazam to track people via transponders in bus-stop / train station billboards.
That's not "supporting the free Internet", that's "making some amoral shareholders richer".
Hopefully you'll figure out the difference with a few more years under your belt.
Most free works on the web is produced by users who receive absolutely zero ad money or any direct compensation whatsoever.
If anything, the ad industry helps kill honest contributions because they financially reward dishonest ones who are better at playing the SEO game or other such tactics than they are at giving visitors what they are actually looking for.
And at the end of the day, ad-supported content isn't free at all because we all pay for it in the end - and much more than what the website receives because there are entire industries inbetween that take their cut.
This argument reminds me of when I dealt with telecommunication providers in a law enforcement context.
Their argument was often that the complexities and volume of data, messages, devices just made it impossible for them to help law enforcement even when justified. Almost as if they were apologetic -- they simply cannot help!
But I was in a room once with a very senior police official, prosecutor and several telco reps when the simple question was asked: why is it not impossible then also to do billing?
Every time the conversation moved away from this point, it was forced to return by the non telco members: they knew it would cost money for the telco to help. And any argument against that was simply foregoing that cost at the expense of the safety or well-being of the public, and was unacceptable.
You may feel (in my example) their are many arguments against state surveillance, but the core truth is that all of these ad providers could indeed have systems that at least attempt to prevent this kind of activity -- it would just reduce profits to do so.
Lastly on the zero click lack of detail: it's kind of irrelevant. The exploit might be complicated, but the vector is clear -- the ad network.
> The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.
It read to me like it was assumed to be using OS/browser/application-level exploits to get further access to target devices. I suspect the CitizenLab report is light on details in particular because they don't actually know them:
> In most cases, the user who sees the ad is not selected for targeting, and the server will not return any JavaScript to be executed.
> A large number of ads placed by Discover-Tech contain a script tag pointing back to what the company refers to as a “NOAS server” (also called a “getAd server”). This tag causes the ad, when rendered, to connect back to Discover-Tech, submit advertising identifiers for the user (either a cookie ID or a mobile ad ID), and automatically execute any JavaScript code returned. The NOAS server decides, apparently based on a combination of the source IP address and the advertising identifiers, whether the target is eligible to receive any JavaScript. If so, then code is returned. If not, a 0-byte response is returned. The NOAS server is a key part of Discover-Tech’s strategy, allowing Discover-Tech to avoid directly sharing malicious code, or even pointers to malicious code, with the companies who serve and display the ads.
I think the simple argument here is that the ad ecosystem should be rebuilt on the default assumption being that ad creatives should be an image and a link with no support for arbitrary rich content.
It would break the long tail of the ad ecosystem, but a bunch of people think the tradeoff is fine.
Given how much of online advertising is now in walled gardens rather than display ads, I think this shows this is more doable than the people who are part of the open ecosystem want it to be.
I and many people believe that google intentionally chooses to keep harmful ads (deceptive, scamming, or leading to malware) this is because it's often very blatant and often survives being reported
Google is able to provide an AI-generated answer for every query, yet somehow can't use the same AI to check whether the sponsored result is an obvious scam.
Not sure why this guy is getting a lot of shit. I play at adops, but I haven't done much with it since we set everything up.
Ads drive the internet. Sorry, but it's true. And you, the technical people, have no real idea of the scale. I don't like ads, but was amused when I had to turn off all my blockers to get stuff done. Many people in the adops world dislike ads, but money.
The point he's making is simple: the ad networks are not responsible for the ad payload. And you might argue the point, but your arguments are worthless. Even finding the entity responsible for the payload will be difficult, and they're probably overseas. Are you going to sue them? No, you're not. Can you actually prove damages, even if you did decide to sue? Probably not.
The structure in the article sounds nefarious, but it's literally the adtech stack. The only thing the company must be doing that's abnormal is tracking all the users in one specific IP range and associating it was a company, likely with their emails. I never touched the targeting section of the stack, but I presume that's possible but not "normal."
It was so successful that IronSource, one of those companies, ended up merging with Unity and I think they got like 25% of the company: https://en.wikipedia.org/wiki/IronSource
Specifically Unit 8200, which really has no counterpart elsewhere in the world given Israel's mandatory universal conscription. Imagine if you could systematically screen every young adult in a country, identify those with the strongest math/quantitative skills or promising deep tech skills and divert them into one single security special ops org for several years. You'd get the concentration of skill that Unit 8200 has been producing.
North Korea does this too, actually (and like Israel, for both genders). It's probably one of the significant reasons why NK has such a comparatively effective offensive cybersecurity group, despite how unlikely that would seem given their overall industrial capacity.
NK likely also gets a bit of a boost because of the extended length of mandatory service. Males on technical teams have to serve for 13 years.
Russia has historically not had mandatory universal conscription.
Which is surprising that these organizations have trust; like our employers probably wouldn't be comfortable shipping all their code to / embedding agents from cybersecurity firms in Russia
That explains a lot. You're basically just fishing for downloads in your target networks. You don't actually care if anyone clicks the ads in the installers, the sole purpose of the adware is to get arbitrary software running alongside the installer, so that you can compromise their machine.
Why do some of the most evil tech companies, especially ones that use exploits and zero-days as part of their business model, disproportionately originate from the same small (population-wise) country? The company from the article, all the other examples everyone here lists, Candiru, NSO... All Israeli.
Palestinians aside, what reasons do neighboring countries have to hate Israel from it's very first moment?
A lot of the immediate neighbors attacked Israel at its birth, and further away countries just seem to hate Israel due to religion/ethnicity/populism (?), countries like Pakistan, Malaysia, etc.
> My friend recommended a documentary to me recently about Hitler. It was about Hitler's atrocities. But my friend, god love her, she couldn't think of the word atrocities. She tried to cover for a second; she went "ahhh—" while she searched for a synonym, but it didn't come out right.
She said, "Gary, I saw this very interesting documentary about Hitler's shenanigans." [audience laughter] Shenanigans! [he chuckles] Not even close!
And, as a Jew, I'm obviously not oversensitive, but when people trivialize Hitler's monkey-business... [audience laughter] When the Nazis' hijinks, tomfoolery, and ballyhoo is understated, I feel it does a disservice to the millions who were, ahhh, inconvenienced by Hitler's mischief! [audience laughter]
Ethnically cleansing Palestine is reason enough to hate Israel. As an American I’ll add that I hate their influence on my country via bribes and blackmail, and how they strip my rights (anti-BDS laws…) and steal my tax dollars. Spying on everyone via things like the OP don’t help either.
You don't even need to go that far. These anti-BDS laws are clearly against the constitution and get struck down without issue. The real problem is that it's much easier to create these BS laws and put them on the books than it is to repeal them, because repealing them requires court challenges, lawsuits, and then these supporters go and make alterations to the law to meet the criteria of the challenges and ram them through again. Then we go through this whole cycle all over again. To solve this problem, you really need to go after the public officials that are being pushed to pass this garbage by consistently holding their feet to the fire and not tolerating this with punishments of losing their elections. The country is shifting towards that, but there's so much BS going on elsewhere that this takes a back burner in people's minds.
Well, Syria and Lebanon both hold some pretty serious resentment over the recent landgrabs. With the whole "acquiring buffer zone for the buffer zone" business in former and the population expulsions in the latter.
I answered your question, no need to move the goalposts. Countries usually don't like having their land occupied. As far as I know the Turkish occupation zone in Syria has been dissolved.
That's not really an accurate characterization of the situation as much of the land was uninhabited/unregistered and/or state owned. The Negev desert for example is a large percentage of the total land area and was effectively uninhabited and not privately owned. Land ownership records at the time were also not particularly clear and often there were disputed claims. Also Israel has about 20% Arab/Palestinian citizens so it's not like they ethnically cleansed everyone like Egypt/Jordan did with the Jews in Gaza and the West Bank when Israel gained independence.
The whole idea of Greater Israel would make anyone in the region queasy. The logic is pretty hard to dispute when Israelis claim the lang is God given. The "God given" land actually extends much farther beyond Israel's boundaries so I'd say people of those countries are rightful feel as they do.
Like immagine if the rhetoric of Turkey was constantly talking about expanding to Greece and how the land of Greece is historically the Turks. Obviously that would make any Greek uneasy.
Seeing how things have played out this year, maybe this will end up being their undoing. Israel has made it clear that the next domino to fall after Iran is Turkey. I don't even know how that would work. Isn't Turkey a NATO ally? At some point, this has got to stop. After everything that's come out this year, I wonder if an alternative world where a lot of these Middle Eastern countries developing into stable democracies could have occurred had Israel been contained or never been created.
The idea of “greater Israel” is a bogeyman that lives in the heads of people that hates Israel in several factors of greater numbers than there are people in Israel who believe that.
You can literally count with both hands the amount of people in Israel that advocate for “greater Israel”
> Israel refuses to even define its borders. And current behaviour demonstrates why.
States like Israel formally define their borders via mechanisms like peace deals that include bilateral recognition of agreed upon borders, like Israel has with Egypt and Jordan.
You can't realistically define borders properly otherwise, trying to define borders via unilateral declaration doesn't really work when there are 2 states next to each other, the borders ultimately need to be negotiated bilaterally between those states with both sides recognizing the same borders.
Because Israel invaded a land that had been settled by Arab Muslims for centuries, claimed a portion for itself exclusively, proceeded to ethnically cleanse an even bigger portion, all with the support of their extremely powerful western backers. Asking "why did the others hate them" is like asking "why would Europeans hate the Chinese if they had invaded, settled and ethnically cleansed half of France (with the promise of taking even more later)"?
It isn't really unique to Israel, though. There's conflict practically everywhere where major cultures/religions have drawn up borders, or within the backwash of fading empires (Britain, Ottomans, Soviets, French...).
None of those have as much impact on Americans day to day life as Israel does.
Lets zoom out: The whole world is about to enter a massive economic calamity, all because Americans got tricked into to electing the current knucklehead in the White House who took a ~$300 million bribe from an Israeli supporter to start this war.
None of those other conflicts will affect the entire world as what Israel has done.
> all because Americans got tricked into to electing the current knucklehead in the White House who took a ~$300 million bribe from an Israeli supporter to start this war.
From what you've said. It sounds like America is to blame here, tbh. $300mil is chump change in international bribery/development. If your establishment sells itself so cheaply, that's on America.
Besides, what's happening in Iran is minuscule compared to what happened during the 'War on Terror'. Play imperial games, win imperial prizes.
Agreed, the system needs reform so a country the size of Slovenia can't dictate US actions so easily. Reform is hopefully coming but too slowly.
>Besides, what's happening in Iran is minuscule compared to what happened during the 'War on Terror'. Play imperial games, win imperial prizes.
Disagree, Those wars were confined to an adversary that was already a few rungs down on the ladder and couldn't crash the world economy. Iran is larger than Iraq + Afghanistan combined, has very large mountainous terrain which has a lot of easy hiding spots for drones/launchers, has the fourth largest collection of trained staff in the field of nuclear science (more than France) and even became space launch capable in 2009.
Thats is like night and day difference between Iraq/Afghanistan.
I agree with what you're saying, but I think you're discounting the geopolitical impact the War(s) on Terror had.
America needed to push cheap credit to boost confidence after 9/11, oil prices skyrocketed and haven't really come back down, hugely expensive wars were funded on debt. It's arguable that these all directly contributed to the GFC in substantial ways.
Global confidence in American leadership plummetted since these wars, and opened the door for China and 'multi-polarity' to enter the stage which has caused a new wave of proxy wars as powers are trying to get a piece of the new round of global empires. We have Russia making moves (apparently also kickstarted by Gadaffi's death), UAE and Turkey playing games in the Sahel, dicerolled team selections in Libya, China testing the waters in Myanmar and Laos, fuckeries in Venezuela and Cuba, Syria, Azerbaijan....
If anything, Israel have been baited into their current actions just like America were as new and old powers try and undo 'centuries of shame', etc.
Americans didn't get tricked into electing Trump. Don't let Americans off the hook like they're naive schoolchildren. Americans knew what Trump represented, they were warned vociferously and repeatedly about him, his entire life and his public opinions have been well documented, and he isn't exactly subtle or capable of duplicity.
Jan. 6th wasn't enough to disqualify him from a second term. The Epstein files weren't enough to get him removed from power. ICE wasn't enough to get him removed from power. Blatant disregard for the courts, threatening allies, arbitrary and insane tariff policies weren't enough to get him removed from power. No President in the history of the United States has been as secure in his position as Donald Trump is. The Supreme Court even went out of its way to make him immune from prosecution for any crime he might possibly commit while in office.
Israel may have (probably did) talk Trump into the war but Americans are the reason Trump was in that position to begin with, and he is there because Americans want him there.
>Americans didn't get tricked into electing Trump. Don't let Americans off the hook like they're naive schoolchildren.
The fact that they are still trying last minute fuel price manipulation in the hopes of converting some people into Trumps good graces proves that you are wrong. The country is very large. In 300+ million people you will find a large distribution of people in terms of skills and ability to discern fact from fiction. The bottom 10% of the distribution is still ~30 million people. Some % of these people vote. Lets not even consider the bottom 50% percentile.
>Jan. 6th wasn't enough to disqualify him from a second term. The Epstein files weren't enough to get him removed from power. ICE wasn't enough to get him removed from power. Blatant disregard for the courts, threatening allies, arbitrary and insane tariff policies weren't enough to get him removed from power.
You are conflating two different things. This is a failure of the system. This takes time to reform. There are attempts going back years. When you have so many layers of people who benefit from the existing status quo the only way you speed up the fix this without decades of sludging through roadblocks is if a national calamity happens that finally forces change(economic or other challenge). Otherwise too many people are insulated from the downsides of the system until they aren't anymore and then something changes.
>but Americans are the reason Trump was in that position to begin with, and he is there because Americans want him there.
Objectively this is a stated fact (unless you believe the election was rigged). But it glosses over so much nuance and context.
Russia didn't create Trump. They're not solely responsible for Trump.
The same can be said of Brexit, Victor Orban, AfD, etc. All of these bad things were, nevertheless, boosted by Russian ops with the same general strategic goal in mind.
My point is that being at war with your neighbor(s) is not a unique situation, but only Israel has acquired such an extreme abuse-through-tech slant because of it. Why?
My guess (not any more informed than anyone else's) is that it's because they absolutely need US support, and intelligence is one of the few things they could offer them so they invested _a lot_ into it
One factor is that Israel generally refuses to extradite their citizens who are accused of crimes in foreign countries. So they effectively operate with a certain level of legal immunity.
Yes, in general Israeli intelligence and hacking groups tend to enjoy far fewer consequences when they screw up than their Western counterparts, which then allow them to be far more aggressive.
The perpetrator of the viral "you're stealing my house," "if I don't steal it someone else would steal it," video was purported to be an alleged sex offender who fled to Israel to escape charges.
It isn't all Israel. North Korea, Russia, and Iran have long been known to be where most cyber crime comes from. Israel is there, but they are an also-ran compared to the others. (but Israel does tend to have more sophisticated attacks). The US also has done a large share, but mostly that is government attacks on other governments (that we know of).
Israel has a lot of enemies that going against them. Which is why they have incentive to be good at this - to attack back. Corporate attempts are just ways to make money.
I'm going to stay out of the political issue of what any actor should do.
This is true, but as far as I know, the other countries (except the US, which however is far larger than Israel) keep their cyberwarfare operations mostly internal. There's no public Russian company accessible to any Russian that does what the example companies above do, for instance. It's all government-led. So is the existence of these companies some outcome of the legal or financial system in that country?
Certainly some is antisemitism. To imply, as you have, that there is 0% legitimacy to any other reasons to hate the behavior of the current Israeli government is just as pro-genocide as you claim antisemitism.
Most people I know who oppose Israel's actions in Gaza have no problem with Jewish people; many themselves are Jewish.
No religions are states, that is just your political opinion. I think it's a really toxic opinion because it then leads to the question of the potential allegiance to a foreign nation of anyone based on their religion. This is the same reason why a Catholic president was once controversial, because back then people believed there was a Catholic state secretly controlling them.
In my political opinion Israel is an artificially created state which is why it's so unstable and we should simply walk away and cut our losses on this. I believe my opinion is the prevailing populist opinion too so y'all have to contend with that.
There needs to be some compromise between our points of view or else we'll continue to get more war and violence. I think our country needs to recognize our responsibility for this mess and should offer land in North America of equivalent value for any Zionist refugees and then leave the poor people of that land alone. I ultra extremists would feel right at home in the Catskills lol.
...are also widely considered bad actors. Yet, it isn't "islamophobia" when you criticize Iran or "anti-Orthodox" when you call Russia to account.
Curiously, however, when you similarly criticize the actions of this specific Israeli government and its leaders, you are slandered with the term "antisemite" and there are orgs that exist to doxx you and get you fired from your job.
If that's your first instinct, then by your standards no country can be criticized for much of anything. After all, pointing out the negative outcomes of a purposefully designed system is the exact same as prejudice based on immutable birth characteristics.
No country's people should be blanket stereotyped. That's my first instinct. 'why are people from xyz nation more likely to be associated with(negative thing)....'. nah, fuck that kind of talk.
Where did you see me saying that? I didn't even mention any people or generalize that all of them are this or that. Saying that cyberwarfare companies are more likely to be in Israel, which is what I did, seems like the most objective way of framing my observation. Other replies already gave some good reasons for why that may be, and all of them have to do with the systems built within the country, not some inherent property of their people. They could change these systems if they wanted to, it's not inherent to them.
>Right, this discussion totally isn't being used as a bash Israel/isrealis as inherently bad with lots of blanket statements.
I see lots of (maybe un-carefully-worded, maybe?) bashing of the actions of the current Israeli government, and its defense forces and intel apparatus.
That's 100% fair game, anywhere on the planet.
What's I don't see is the rank antisemitism you claim, except for a few outlier recently-created accounts.
The most despicable thing I see at scale in the conversations is the attempt to silence critics of Israel with slanderous accusations of antisemitism. It used to work, as a tactic, but it (like the "racism card") has been vastly overplayed and is rapidly losing its value.
Ah I shouldn't call out what I think is racism because 'it doesn't have impact' anymore. Nah. You think labeling nations /communities and by extension their peoples is fine. I don't. It's simple as that.
I didn't attempt to silence anyone. I simply called out what I see. Silencing is what HN does when they moderate the Ukraine Russian discussions different than their newer standard for Israel Palestine.
"it's the shiftiness of jews'. Racism doesn't exist anymore, and calling these discussion anti-semitic is me just shielding isreal as a tactic. Fuck off.
If you think that one person's comment is the distillation of the whole thread, then you're not paying attention to the rest of the thread (or very knowledgeable about statistics). I clearly acknowledged the existence of antisemitism in these discussions, but also that it is an outlier. Good job, you found the outlier! Hooray!
>Racism doesn't exist anymore
Who said that?
>calling these discussion anti-semitic is me just shielding isreal as a tactic.
Yes, when the discussion is about the current government of Israel, the IDF, its intel apparatus, and their actions.
> "it's the shiftiness of jews'. Racism doesn't exist anymore, and calling these discussion anti-semitic is me just shielding isreal as a tactic. Fuck off.
Can't find the quoted phrase in the referred comment: did you just make it up or did he edit it out? Other than that, he made some observations about Judaism. Off-topic perhaps but nowhere near racist. Fuck off.
I went out of my way to write the comment in as neutral of a tone as possible. I didn't even state my opinion on Israel or anything it's involved in to avoid starting a flamewar in what would otherwise be a standard question about adversarial technology and cyberwarfare. The only expressed opinion was about the companies themselves, which I think it more than warranted. Yet, as I said in a sibling comment, people are seeing ghosts anyway and disregard the perfectly normal question because they think I'm not really curious about it and am asking it for nefarious reasons.
again 'I'm not racist, I'm just connecting the dots around crime statistics in an impartial way'. This thread was filled with all kinds of nefarious stuff around the same topic at the time I posted, and of course was disclaimered as 'totally not anti-semitic' even though time and again jewish people have said the discussion around IP often veers into 'the stereotype is deserved' and 'if American jews don't like it they need to distance themselves from Israel more' (a race now has to take affirmative action to show they 'are the good ones'?) and that that does in fact feel anti-semitic to them. But then the 'anti-zionsim' card gets played (with zero explaination of what anti-zionism means exactly, does it mean a nation of 8 million jews, the majority left on the planet, just gets wiped out and jews what? Go where? ) and it can't be anti-semetic to say 'the steretype is justified' and 'you need to prove you are one of the good ones by stating publicaly your opinion on something half way around the world'.
here's a nice response for you 'it's the shiftiness of jews'. There's your totally not racist as fuck/antisemitic dot connecting.
I kinda wish these threads wouldn't get 'cleaned up' so we can see the actual totally 'not antisemitic' HN discourse plain as day. I'm sure the above comment will get removed/cleaned up and you can go back to 'connecting the dots around crime statistics isn't a core part of racist cannon'.
Oh well, each individual must be judged on their actions and merits, but this doesn't prevent us from observing how groups behave on average. Nobody ever shouted racism when it's said that French are chauvinistic or that Germans follow rules strictly- it won't and shouldn't tell you anything about single individuals but you know there's a grain of truth in the generalisation.
Opposed to noticing what else? Vibes? Sound a lot more racist than factual and provable realities based on real data.
Finding an understanding patterns and acting according to them is the most logical and natural thing a human or any life form can do. You would call someone speciest for not hugging a bear just to feel ideologically pure.
I'd rather have nations be held accountable for being bad global participants than hiding behind cries of -isms. Israelis can always elect a better government if they don't like the stereotypes the current one earns them.
You might also look into the tale of the boy who cried wolf. The more you keep shoutin "antisemtism" in an attempt to shut down criticism the more people will learn to just ignore that word or ascribe to it a meaning far different from the one you want.
The same reason why many great tech companies originate from Israel. That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
But something tells me that the way you framed your question, is not about the companies and more about you and how you view Israel.
I in fact tried to word this as neutrally as possible, but people are already seeing ghosts just because it has a hint of negativity towards the country, which should be expected because most people agree that these technologies are not actually good for the world.
> The same reason why many great tech companies originate from Israel. That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
You never said what the reason for that is. Their society doesn't seem more tech-oriented than comparable countries. Their universities are OK, but not the best in the world. So what in their society caused this?
Careful. The trolls are out. Half of them are trying to prove Israel is a nation full of demonstrably evil people, and half of them will tar you with antisemitism if you don't love Bibi and all his works.
This bullshit polarization of ideology ruins civil discourse. It's possible to condemn Hamas' slaughter of innocents, and condemn Israel's slaughter of innocents. And to still realize there are innocent Palestinians and Israelis who are not working to make things worse.
Culturally, Israel has a strong emphasis on entrepreneurship, coupled with general lack of tolerance for bureaucracy, makes for pretty agile organizations.
In the military side, it creates a country sized funnel that picks the best people and places them together trying to solve problems that would seem impossible. When these people are discharged, they are friends that knows how to work best together. Think of it like a larger and more focused version of an Ivy League school
Because they are the best at spying in the world by far, and are willing to splash the cash. They're what Silicon Valley would have been if it kept doing government contracts instead of just selling ads.
If Mossad is willing to give you a hundred million to make your startup a spyware company, you're obviously going to agree.
Their military is very good at cyber-warfare. The gap has narrowed in the last decade, but before that there wasn't even a distant second, maybe Russia. People serve in those units, acquire very useful and specific skills, then start companies that offer commercial variants of cyber-warfare, or become subcontractors for other governments.
They're even better at sextortion. Jeffrey Epstein is the posterchild for their efforts, along with his Mossad agent father-in-law Robert Maxwell, and handler Ehud Barak. It's likely that many of Israel's "triumphs" over the last few decades were less a result of hacking and more a result of blackmail, similar to the FSB/KGB.
Mandatory military service, too. You have to imagine that the US would have a similarly disproportionately-scaled cyber-warfare industry if it also had mandatory military service and good sorting of capable people into those units.
> a haven for American pedophiles/criminals who end up fleeing the country
Only Jewish pedophiles & criminals.
Israel will not let in random non-Jewish criminals to flee prosecution, only those who are provably Jewish are granted citizenship and non-extradition.
This is where the wall broke down for me. Criticizing Israel is okay, but criticizing Jews is not. However this is one example of being "above the law" which affects all jews, not only israeli citizens.
There are many ways in which Israel differs. For one it's a 78 year old colony that excludes the indigenous Palestinian population from returning to their ethnically cleansed homes. They also allow people to convert to Judiasm and enter, so it actually has nothing to do with their ethnicity and is solely based on religion.
>The Law of Return offers citizenship to Jews wishing to immigrate, as well as non-Jews with at least one Jewish grandparent (see "Who is a Jew under the Law of Return?"), as well as their spouses
I agree it's racist, but they also allow converts:
> Converts to Judaism who wish to immigrate to Israel are evaluated on a case-by-case basis by the Israeli Interior Ministry, which determines whether the conversion was sincere in its view
The reasoning behind the 1970 amendment is usually traced to the Nuremberg Laws. Nazi Germany defined a Jew for the purposes of persecution as anyone with a Jewish grandparent. The amendment drew Israel’s circle of protection at the same radius: if having one Jewish grandparent was enough to be persecuted, it should be enough to be given refuge.
They are certainly not engaging in genocide. The population of Palestinians has increased by 5% over the past 3 years. Even the population of Gazans has not decreased.
I wasn't making an argument for or against the legitimacy of Israel; I was arguing that self defense explains Israel's immigration laws better than a sense of racial superiority.
It's one thing to accuse Israelis of paranoia, hypocrisy, or even genocide, and it's another to deny that the primary motivation to have Israel be a jewish ethno-state was to have a refuge from persecution.
It isn't clear if the accusation is that I knowingly am telling lies, or that I am gullible and repeating lies. Either way, we could go back and forth all weekend and probably still not agree on much. Cheers.
> For one it's a 78 year old colony that excludes the indigenous Palestinian population from returning to their ethnically cleansed homes.
The ethnic cleansing that happened when Israel gained independence was not in just one direction, Israel also did allow plenty of Arab/Palestinians to stay and gave them citizenship where feasible. It's not surprising however that Israel doesn't currently offer citizenship to a population that largely doesn't think Israel should even exist. States don't normally give citizenship to their non-citizen enemies.
> They also allow people to convert to Judiasm and enter, so it actually has nothing to do with their ethnicity and is solely based on religion.
It's not solely based on religion. It's also quite rare for people to convert to Judaism in general so that exception has little practical implications.
Guess where the company big AI labs are using for security sandbox is from? The one that was involved in both big hacking scandals from "rogue agents" by OpenAI and Anthropic?
It is standard that companies within a country act in the interests of its security services. Israel has a lot of ad-tech companies and thus it makes sense that they are roped into serving Israel's security services.
This is the same issue that the US government has with Chinese networking companies, it is too easy for the Chinese government to pressure these Chinese networking companies to put in back doors in the interests of national security. The US likely knows this because it pressures its own companies in similar ways.
Bills like the US CLOUD Act (there are similar ones in the EU and China) force service providers to illegally spy on people overseas (via unauthorized use of anything they can access—consider Microsoft’s Windows backdoors).
I think the only technical solution available to individuals is to boycott non-verifiably e2ee services and corporate operating systems (especially including android).
A few weeks ago the FBI tipped the Argentinian police that some 15 year old kid from buenos aires province had asked chatgpt for ideas to plan a school massacre.
In the interest of balance, how many times did the FBI snoop into innocent people’s private lives with no warrant or worse, goaded some weak-minded individuals into planning crimes together in sting operations (i.e. people who needed convincing to commit the crime, so not quite clean but not the masterminds either)?
If you put out a fire how many are you allowed to set while people applaud selectively?
I don’t think they’re striking a good balance between how invasive they are compared to the real results they deliver.
> I think the only technical solution available to individuals is to boycott non-verifiably e2ee services
If the world moved that way overnight, I wonder where digital spy budgets would go. Into traditional techniques, cracking encryption, banning encryption, or a more educated guess?
It's not "illegaly spy", it' just spy. National security laws make sure that these requests are all legal - from that particular country's point of view who is forcing the provider to supply the info... and illegal from all the other country's point of view.
The root of this problem is that nation states have the final say in what they consider legal. But that difficulty is by design and is very difficult to fix.
Israel was created by ethnically cleansing Palestinians during the Nakba. That's not a democracy, ethnically cleansed Palestinians aren't even allowed to live on their land, let alone vote. That's not including all of the Palestinians that have been straight up murdered.
In addition Israel is an apartheid state with many undemocratic features:
> ethnically cleansed Palestinians aren't even allowed to live on their land, let alone vote
America was a democracy while we were exterminating our native population. Democracy is a system of government. Voters can democratically vote for terrible things.
Israeli Arabs are allowed to vote.
> Israel is an apartheid state
This is a valid argument, though still stretched–America didn't cease to be a democracy while we occupied Germany and Japan.
Murdered people can't vote. People forced off their land and over an artificially created border can't vote. Israel is no democracy.
> America was a democracy while we were exterminating our native population.
I would argue that it was not for the very same reasons (and of course there were many other classes not allowed to vote at the time). Killing someone robs them of their right to vote.
> Murdered people can't vote. People forced off their land and over an artificially created border can't vote
Sure. But this also describes a lot of well-accepted democracies' histories.
Perhaps you're thinking of a liberal democracy?
> would argue that it was not
Sure, according to a personal definition that countries cease to be democracies any time they go to war (or more narrowly, commit war crimes), Israel is not a democracy...
> there were many other classes not allowed to vote at the time
Most democracies also prohibit children and non-citizens from voting. The term you may be looking for is full democracy. And I think most people and experts agree Israel is not a full democracy [1].
> Most democracies also prohibit non-citizens from voting.
I mean we're talking about all Black people, Indigenous people and women! I think arguing semantics isn't helpful.
Israel is an illegitimate state practicing crimes against humanity. That some of the colonizers can vote isn't really relevant. I actually think this can help us reflect on the true nature of the US as well and push for things like land back to Indigenous people and reparations for Black people.
> we're talking about all Black people, Indigenous people and women
Yes. Athens was similar–a minority of the population could vote. It was a deeply flawed democracy, but a democracy nonetheless.
> That some of the colonizers can vote isn't really relevant
Literally America! Also all of Europe depending on when you draw the line. Also all of the Middle East for the same reason. (Also most extant Native American tribes.) Hell, even in Palestine we can only say more than 50% of the population traces from Bronze-Age heritage.
By your definition, democracy does not exist and cannot exist in most parts of the world.
> this can help us reflect on the true nature of the US
It really can't if we're redefining precedented terms. America, like Israel, is a flawed democracy.
> Most democracies also prohibit children and non-citizens from voting
In the case of Israel these 'non-citizens' are under brutal military occupation where each day Israel steals more and more of their land. There's no 'home country' they could return to because Israel is occupying it. They're not illegal immigrants. They ARE home and yet being treated by Israel like invaders.
> They ARE home and yet being treated by Israel like invaders
Which is illiberal and flawed. It doesn't mean Israeli citizens don't democratically choose their leaders.
Note that this cuts both ways. If Israel isn't a democracy, the Israeli people have no moral culpability in their state's actions because we have no way of knowing if they actually support it.
> There's no 'home country' they could return to because Israel is occupying it
Agree this is tragic. But again, historically not unique. Displaced people have existed across the history of democracy.
Something being wrong doesn't automatically make it all kinds of wrong. Israel illegally occupying the West Bank and Gaza and having unresolved reparations around the Nakba doesn't have much relevance to whether it's a democracy. Just whether it's a liberal or full one. (Among all of the other issues.)
Democracy doesn't mean voters can't choose to be awful.
By the way, the word "Nakba" is linguistically related to the Shoah, a.k.a. The Holocaust. If they admitted the Nakba happened they'd be admitting they did a Holocaust, so they don't admit that.
Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.
Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
I'm sure Google's latest push to make it inconvenient to install apps from outside Google's Playstore, where Google charges a 30% commission, is going to solve that.
> useless as a way to prevent people from being hacked
From being hacked by others. Google was just trying to protect their property, which is the ability to spy on their users' every move. Google themselves really don't need to "hack" their users for that, they already have all the access and all the data they could ever want. And they also have the ability to brick their users' devices at a moment's notice the same as Apple does.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Totally not useless. It costs a lot more to pay a spyware firm then to have an employee send an email / ask a judge (like that's even necessary).
I feel quite confident of my messages privacy on my Pixel with GrapheneOS given most people I message are on iPhones which are second in security to Pixels running GrapheneOS. Not to mention my threat model doesn't include mercenary spyware, as most people's doesn't.
>Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.
If you're talking about the sideloading restrictions those were intended to stop social engineering and scams, not from getting hacked via 0days.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Source? play services is privileged but not that privileged.
However, this hack could have happened whether sideloading was allowed or not.
In fact, following the OP's link to https://citizenlab.ca/research/how-discover-tech-turned-targ..., "the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries" so it's not just apps but ordinary websites you visit in your android chrome browser.
My understanding is that there are hundreds, perhaps thousands, of high impact vulnerabilities on Chrome/Safari. We don't get to hear about most of them because it would become tedious quickly.
Yes, Google's move to block people from installing software on their own devices is orthogonal to this. I was merely saying that some measures have massive negative effects and basically irrelevant positive effects in the grand scheme of things.
It's really sad this got taken off the front page (347 points, posted 2 hours ago at the time of this comment). Israel is deeply intertwined with the tech industry and they use tech extensively in extremely hostile ways. It's relevant to this site discussion and the votes demonstrate that. There's no reason to hide the elephant in the room, let's address it, now is the time.
As much as it sucks for the ecosystem that's built itself up around the world wide web, good ad blockers and fingerprinting protection are as important as firewalls and antiviruses now. There's no more babies in this fetid bathwater.
>During our analysis of the Controlium platform, we observed that the source code mentioned an endpoint called “/csv-download”, which accepted start and end date parameters. When we sent normal HTTP GET requests to this endpoint without any password, special headers, or authentication token, we received logs showing which users had logged in to Controlium, and from which IP addresses.
It's kinda funny that a website with an article titled "Online ads weaponised to deliver ‘zero-click’ spyware" immediately loads a splash that asks users with adblock installed to disable it.
The separation between advertising and editorial has never been greater. Brought to you by the marketing wizards who saw you bought a vacuum cleaner on Amazon and concluded you love buying vacuum cleaners so here’s some more.
Aren't earliest government backed recommendations, to block all ads for security reasons, something like 20 years old? For example, this one: https://www.cisa.gov/sites/default/files/publications/Capaci...
is from 2013. I am sure there were earlier I just can't find them.
"Researchers also recommend that users at high risk of targeting use ad blockers, disable ad tracking, and regularly reset mobile ad IDs.". Not "recommend". Everyone must use uBlock Origin or at least some type of ad blocker in every device.
Then also mandatory pi-hole on every house.
Even if you are used by Windows OS, you must use an adblocker. Even if you use Chrome. On every browser.
Internet without ublock origin looks and feels horrible, something about insulting basic human decency with o slaught of ads desperately taking so much space.
Ads providers should be held responsible for delivering malware. All the tracking (that includes fingerprinting for clients that do not want to be tracked) should also be illegal.
How is this acceptable for society goes beyond me. And then corporations blame individuals when they get scammed. It is your fault that we have all your information and leak it everywhere, when it is not just directly sold.
And add jail time to fines. Fines means nothing for the rich.
If such a thing were passed, it can't apply retroactively. But yes, google people would go to jail when they inevitably flout it as they are accustomed to doing. We should make this happen.
People in the US have a unique window of opportunity starting TODAY (Oct 2026) in many places with early voting. I implore everyone who is able to vote in the midterms to do so.
You will have to look at the candidates in your area and do your due diligence. Its unlikely a given candidate will be perfect, but there is generally tremendous differences between them as far as overall posture on privacy and surveillance.
Not tremendous differences, mass surveillance of the people is one of the few issues that are truly bipartisan, but there's candidates better than others.
None of them, but if one did I bet they'd get support from voters and less bribes from the tech industry. As long as politicians value the bribes more than the support the people will never get representation. We should probably pass laws that stop companies from stuffing the pockets of politicians with money, but what politician is going to support a law that takes their bribe money away?
nah, you'll never get there that way. Even if there was willpower to do it legislating these things is too hard.
What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).
If they win the landscape will change. It would set a precedent for civil liability for infecting your users even when it's not your content directly. That would likely spook the shit out of the market, security becomes a feature.
Why the website instead of the ad provider? The website didn't server the ad. The ad provider did and should be the responsible part to ensure what it provides is not malicious.
Attacking a single website does nothing. If you bankrupt the site, there are millions more sites. If you attack the ad provider, bankrupting it, and shutting it down, millions of sites are now protected.
The website is signing up for a service. You could say that a website continuing to use the service of a known malicious ad provider is problematic, but are there any ad providers known to have not served malicious something?
I think you're also confusing multiple malicious activities occurring on the web. Data harvesting is another thing that needs to be banned into oblivion. Rarely are sites doing that natively. It is being done as a second part of service the site wants. A site/app wants naturally wants to seen analytics about how visitors are using the site/app, so they include some third party tool that provides that data to an extent at the cost of collecting/keeping that data for their own use. Want to make it easy for users to interact with social platforms regarding your site/app, they now get to collect/keep that data. That's a different thing than being served malicious ads.
The website is partnering with another business, often as their primary or only means of revenue. That is their entire business. This is not you signing up for a service like Netflix. It is a B2B partnership, and in fact, if you look at the direction money is flowing, they're the ones selling the service (surreptitious access to users' computers). It is their responsibility to choose their business partners and what ads they'd be running. If they're not doing any examination of what they're inflicting on their users, and just letting whomever's buying send whatever payloads they'd like, then yeah that's negligent at best.
"I'll pay you if you run this software on your visitors' computers without asking questions" is not a "service" you sign up for. People don't pay you as a service. That's about as shady a deal as it sounds.
IMO the ad provider is fully at fault for allowing script tags and other potentially vulnerable features in ads. Why can't the ads just be static? I mean I get why they want it, but it should not be allowed, and IMO that's where the ad provider is almost fully at fault
Websites can set CSP to not allow ad providers to serve scripts. They're the ones adding those scripts to their page, and are equally at fault. Though static ads can still point people into a fraud pipeline, and websites running those ads should be held accountable for that too.
It's fully possible to individually negotiate with someone that wants to publish an ad on your site. If you choose to take money from literally anyone who wants to do so, then why would you not be accountable when they inevitably use you to target users for fraud? You chose to take their money and not even look at what you were publishing.
Ideally, you'd sue the website because the website is responsible for everything that shows up on the website they control, and the website would turn around and sue their ad provider because they paid that ad provider for a service that wasn't malware delivery and as a result of that ad provider's crimes (or negligence) the website now has legal costs and harm to their reputation.
It shouldn't fall on the person just going to a website to track down the vendors and third parties the website contracts with.
The lawyers should name everyone involved with unauthorized access to your computer as defendants , the obviously innocent parties can be dropped before it gets to trial.
I don't understand how you could arrive at this perspective. If you're doing business with ExampleCorp and one of their subcontractors malfeasantly mishandles things, would you say that ExampleCorp had nothing to do with it? If not, why does that change when the interaction happens via example.com?
I don't think we should try to split accountability at all here.
The ad platform that allows malware to be served to anyone is at fault.
As is the individual website that has selected to allow a 3rd party's code to be delivered to your machine without controlling that risk, often for very silly reasons.
> What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).
You're wrong on legislating these things. If the ad network is forced into KYC for their ad distributions and they are excluded from safe harbor, like a TV network would be, then I guarantee those ads cease to exist.
This mentality of "it's to hard" doesn't get things done.
I do agree that some greedy lawyers and civil liability would solve this, but that's not a long term solution at all.
I think it would be nice for them to be held accountable but I get the feeling this is part of a wider nation state intelligence apparatus and I doubt that they will hold themselves accountable.
So you search for company A wanting to buy their product. You check out. Basically every setup I've audited has every tracking product ever for everything.
So you buy X, and the company sends that purchase event with your information to Meta, Google, TikTok, Applovin, Klaviyo, and 10 others.
This idea is hopelessly entrenched in every marketing department, who has leadership's ear: We HAVE to send EVERYTHING to EVERYONE otherwise our ROAS will go DOWN!
Every platform works this way, they're all set up to put giant red banners on your marketer's dashboards
"You could be getting 50% better results if you sent <customer_2nd_grade_report_card>!"
This is not the problem. You visiting any website can lead to your computer running the same code.
The main problem is that the exploits from js to code execution or data exfil are possible in the first place. The issue is that you have JS, which is generally pretty isolated, able to talk to bundled libraries (like libwebrtc), which often contain the exploits and share the same memory space. There needs to be a intermediate layer between JS talking to any such library, like process isolation with IPC for communication.
Sure, but there's a big difference between going to a sketchy, malicious site vs a reputable site that does serve ads and now being at the mercy of any arbitrary crap in the ad you didn't choose to see
Not quite. Most people in society are completely oblivious to this happening. And their lack of awareness is why the exploiters don't face more public opposition.
> And add jail time to fines. Fines means nothing for the rich.
This, pretty much. Money removes consequence form your actions. If every time you screwed up, instead of being fined you had to wear a silly hat, go on TV and apologize, or get some time behind bars, even if it were 1 or 2 days it would be very effective.
If only! I think we can no longer afford to ignore all these security threats and should make online advertising wholesale illegal. But I won't hold my breath.
The ads are getting insane, they're trying to fill every bit of space you can look with ads. You go to a restaurant there's ads on your placemat. You go to the grocery store there's ads in your cart. They put chargers in the parking lot so now there's ads out there.
Streaming services used to be bad enough with ads in the shows, now they put an ad on the screen when you pause it. Peacock just started putting ads in the login screen.
If we don't stop this, pretty soon they're going to have ads in the stars as satellite constellations arrange themselves to sell you Twitter subscriptions. They're not going to stop even when there's an ad no matter where you look.
I'm reminded of the ending of the 2008 film Hancock in which Hancock defaced the moon with a corporate logo. But it was okay because it was "for a good cause".
Okay but my point wasn't about an advertisement or a poster on a wall, it was about advertisements on every blank surface, so I'm not sure your reply is relevent to what I said. If your point is just everything in moderation, I can agree with you, but we're well past the advertisers being moderate with what they're pushing.
I don't see how anything in this exploit requires ads. It could just as well be done by enticing the target to view a malicious web page, such as a post in a subreddit or facebook group the target is known to read, or even by just sending him a link in an email or chat which will often trigger an automatic "preview" of the link in the email or chat client. Or by other social engineering techniques.
The ad-tech network probably does make it easier, because any page that includes their ad network could deliver the malicious ad.
It’s to do with hiding malware/spyware in an image which ends up in your cache on device. I can’t go much further into details but all this takes is for you to visit a site that serves it via ad network.
Israel has been known to have some sneaky spyware in the past with Pegasus.
There is a tinfoil narrative that suggest that entire formats are in bed with intelligence services. It sounds pretty wild, but other zero-click attack vectors have been possible through sabotaging the parsing of file formats. ie. send a message -> hacked. How? the message wasnt even opened. How is, an app like Messenger receives a photo attachment binary, tries to unpack it and in doing so receives an instruction that stops the parser and executes arbitrary instructions.
Yeah, but you need to know where to look for it, the average person is never going to be able to afford the amount of tokens that will take to find a bug like this, especially if it was implanted on purpose.
Shrink the surface to scan. Not foolproof but can be an improvement. After watching many conference videos on mobile OS hacking, the strategy should really be to focus on components that were touched recently in new updates (and the most popular components like messaging). Once software is mature, they don't go and change everything with every release. It's been a few years, but an interesting insight I learned at CCC was that the most touched components in new OS releases are the ones most likely to have contributions by junior developers trying to push some commit to satisfy their boss and thus have security flaws. Testing can only catch so much.
Tons of SV companies really... it's quite disturbing how obvious the compromise vectors are but big companies and startups alike seem to just allow it with no consideration for the security implications.
I think lots of it has to do with how well the hasbara covers up the scandals from the wider publics perception, combined with the cultural bandwagon of considering them an ally even when their repeated actions say otherwise.
edit: also the idea that they have such good tech and its a pragmatic decision ignores the history of how and who they got it from and the intentions for it. I say this as someone who worked directly with Mellanox for example, before aquisition by Nvidia... I always thought kernel level shims for networking stacks from an Israeli company was dangerous... but the speeds!!!
well yes, that is the surface. it's the surface being created with no recourse from the user side, that is intentional... the tinfoil hat theory is that it is, anyway.
How the ad-based spyware actually worked (from the Citizen Lab and Confiant reports):
- It came in through the front door. Discover-Tech ran its own ad-buying platform and was listed as a "certified" vendor by Google and IAB Europe for six years. Nothing was hacked to get in. It bid in ad auctions like any other buyer.
- The ads looked harmless. Plain banners for games, AliExpress deals and an IP-lookup site. Hidden inside each one was a small script that quietly phoned home when the ad loaded.
- Everyone who saw an ad was profiled. The script collected device details, IP addresses and, on many sites, the publisher's own cookies, sometimes including logged-in session tokens. Cookie-syncing with other ad networks built a huge identity graph.
- Only chosen targets got the payload. A gatekeeper server checked each device's ad ID and IP. Most people got nothing back. A selected target got code that handed them off to spyware maker Candiru, and the code was served only once, which made it very hard for researchers to capture.
- The handoff was built to defeat inspection. Encrypted channels, rotating hosting, anti-bot checks and even a fake "Copyright Google" comment to fool human reviewers.
- It worked. At least 45 devices at Al Jazeera were targeted, and spyware was recovered from an infected machine. Its ads also appeared on networks belonging to NATO, the UN, the European Parliament, the ICC and various defence ministries.
- The scale was huge. Billions of bids and ads in nearly 200,000 apps and websites, including Duolingo, Viber, Yahoo Mail, dating apps and period trackers, yet almost no sign of real advertisers or revenue.
Wait what, so there is no content disarm between companies making ads, and the publishers? They can literally push whatever they want? Wild.
Edit:
the TFA answers: "Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user." Its wild! I thought the ads are sanitized, go through a CDR of sorts, and whatever javascript is permitted is authored by ad networks, not the buyers. Sheesh. Thats just RCE.
> Wait what, so there is no content disarm between companies making ads, and the publishers? They can literally push whatever they want? Wild.
RTB (real-time bidding) does not incentivise publishers to care about what ads are actually being shown to individual users, so long as CPM is maximised.
I was looking for this comment. I'm wondering the same. Are ads just iframes that could have js? Therefore this is basically a zero click js (is this the first?) that just happens to be distributed via ads?
Agreed it's against the guidelines as written but the interpersonal exchange is no different than someone quoting a blog post (and then not linking to it, to be fair). Something like this doesn't feel strictly bad, assuming disclosure and a link to the chat, sources included.
They use ad network to try to target individual user visiting a page (eg you know your target is a male, 60 years old, living in that area, with a few other checks you can almost uniquely identify your target)
Then the ad network delivers a targeted ad that exploits a vulnerability (eg a broken JPEG decoder that, when sent a bad image, allows to run arbitrary code on your machine), and from there you have access to the computer
People have disliked ads since ads existed. Carl Sagan's 1985 book Contact includes a brazillionaire S.R. Hadden who made his fortune by inventing an adblocker for television. https://en.wikipedia.org/wiki/Contact_(novel)
The FBI has previously recommended running adblockers as a method to prevent malware and especially scamming. Nobody cares much.
It’s a low-hanging fruit that has high value, particularly for less savvy internet users. Scams have always been the biggest threat. I’d say the majority of internet ads are scams, and the platforms often don’t make it clear what is or is not an ad.
But, we always knew the risk of malware was there. In the modern age, ads are basically never delivered as static assets. They’re delivered as small applications, with code. So, we’re relying on our sandboxing mechanics to work perfectly, and predictably they don’t. The solution is to block the code altogether; to block ads.
Online ad networks are zero-click spyware and their entire purpose is to maniputate the user against his own interests. The only reasonable thing to do is to block them entirely and for everyone.
If someone you care about doesn't run an ad blocker, it's time to change that. They don't even have to be gullible and likely to click on things they shouldn't. Zero click is zero click. Don't just tell them they should. They likely won't. Go with them to their computer and install an ad blocker for them on the spot. It's time.
Maybe Google, Yandex, etc. will decide this is the last straw and finally get serious about filtering malicious ads out of their services. Past history indicates they won't. I feel sorry for anyone who depends on ad revenue, but not sorry enough to expose people I care about to this crap.
It seems to be app-based. So DNS blocking could work; it's easily circumvented by the platforms, but it's rarely circumvented. like mobile games with those ads.
You should threat model, but if you want to maximally protect yourself, use Vanadium or Brave Browser and GrapheneOS and no privacy invasive apps.
This was my first question as well. There’s a big gap between “ad network delivers JS” and a zero-click browser exploit. CitizenLab has done some great research including OSINT on the former, but there’s a conspicuous gap between it and the DLL ending up on the victim’s machine.
Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle...
I wonder how we're going to unwind this mess in the upcoming years. It seems as if there was a concerted effort to plan this all out before Trump got elected, and then everything fell into place. They obviously have a post Trump plan ready to go. I partially blame the left(really the moderates) in the U.S. For being so unbelievably complacent that it led us to this mess. I just wonder how we're going to unwind this. Nothing lasts forever, but the transition in between states always tends to be disrupting.
So reading the article, it feels a bit confusing what zero click exploit they are talking about. It sounds like they are talking about CVE-2021-21166, but if they really are talking about an exploit from 5 years ago, i feel like their intro paragraph is rather misleading.
Awful lot of words here, but not much explanation of the actual capabilities of the "zero-click spyware". Tacking on the phrase "zero-click" suggests some kind of browser exploit, but it seems like this is just the same sort of thing as tracking cookies, third-party telemetry etc.
Yes, in fact I skipped to that section. It describes targeting, and then a vague mention of ad impressions leading to "connections" to a C2 server (but the simple fact of contacting a domain doesn't establish C2; anyone can send an AJAX request anywhere). Then they describe a "fingerprint" of servers which appears to consist of... HTTP responses with several blank fields and a claim of running on Apache. Then they say that they found a compromised DLL, which they attribute to the ads based on the DLL hard-coding some domains related to the ad campaign.
But there is nothing explaining how the DLL becomes zero-click compromised by the ad.
and they’re just as troublesome as they were before,
to the degree they’re provably being used to decide who to send malicious payloads to…
Zero-click simply highlights if the user needs to actively interact with an element to get a malicious payload - or not.
This did get me interested in the specifics of the payload, though:
“It maintains persistence via COM hijacking by overwriting a legitimate COM class registry key’s DLL path with a first-stage DLL dropped in C:\Windows\system32\IME\, and it stores encrypted second-stage payloads in the configuration directory. A signed third-party driver (physmem.sys) enables kernel-level memory access and API call proxying to avoid detection. To preserve system stability, DevilsTongue reinjects the original COM DLL during hijacking, disguising this action through shellcode manipulation of the LoadLibraryExW return value. All additional payloads are decrypted and executed only in memory, allowing the malware to steal credentials from LSASS and browsers, access Signal messages, and use browser cookies to impersonate victims on platforms like Facebook, Gmail, and VK. The malware’s use of scrubbed metadata, encryption, and unique hashes for each file further complicates detection and analysis.”
Targets could have been identified using pretty basic advertising and marketing techniques. Bid requests broadcast IP, device details, and ad IDs to every bidder. Intersecting topic audiences across a few months of Al Jazeera stories could narrow that audience to a few individuals. The ad ecosystem already does set-intersection de-anonymization to identify interests and profile customers.
The article contains no information on which browsers are impacted, what exploit is being used, if it has been patched, etc? Does anyone know more about how this ad network is exploiting browsers to install spyware on the users machine?
Buried in the Citizenlab report are links to CVEs from Windows and Chrome that the report says were exploited. These CVE's date back to the early 20's and have been patched.
As I skimmed the CitizenLab report, it was particularly interesting to see the history of the company and how they may have been acquired specifically to use as a covert operation.
How paranoid should one be of, say for example, a wasm vulnerability exploited on zero day by a bad JS ad?
I am scared for my parents to get exposed to this kind of thing from bad ad network actors. Does anyone have some practical concrete recommendations they took? Like I don't think they can install ublock origin and whitelist sites on demand in Firefox they way I do.
The only practical thing right now is to make sure they don't have the money on device and have 2 fac for email and bank accounts. But every now and then there are phishing attamepts that they could fall prey to.
> I am scared for my parents to get exposed to this kind of thing
It's tough. One option is to hope/assume that exploits only compromise user accounts rather than the whole computer.
In that case you can blacklist the banking website from the day-to-day browser as a reminder to switch to the other account, and configure the other account's browser so that it can do little else.
Install uBlock Origin and don't whitelist any sites. The default filter lists break almost nothing, only once you start including the "annoyances" lists etc. do you start running into significant breakage.
Without an ad blocker, they will be exposed to such an amount of social engineering (ranging from dropshipping sites, to subscription scams, to scam shops that don't ship at all but steal your CC data, to fake sites for government services, to attempts to trick you into installing malware) that you can't expect them to resist it. If installing uBO seems hard, resisting this or cleaning up the consequences is harder.
The amount of "hey have you heard of this great new product I saw" <photo of a handwritten note of the content of a scam site> went down from weekly to near zero once I got a relative to use an ad blocking browser.
I would be interested in knowing which devices were (or still are) vulnerable to these zero click exploits. And how those exploits (used to) work, specifically.
For as clever as some of the spy techniques are, they sure don't seem to be very good on opsec.
> We found two world-readable Apache Druid instances running on Discover-Tech’s website mtrtb[.]com. The druid.mtrtb[.]com endpoint contains bidding data for Discover-Tech’s MyDSP platform
Incredible that they don't clearly say what the exploit is and what OS/hardware/apps is/are vulnerable. Still, quite a lot of interesting info about the modern ad delivery networks sewer system...
Taboola ads is zero click garbage which makes ones eyes bleed. This stuff is just a tad more sinister or a step further than that but along the same lines, more or less.
I doubt it's that easy to click on a link and install malware without the user knowing. Most browsers are highly secure and finding a zero day isn't that easy these days because both sides use A.I. to find vulnerabilities and to secure against them.
It’s not “easy”, it requires a complex infrastructure of exploit devs (who can sell their findings for millions in some cases) and the companies who package these exploits together with implants and sell them.
> Reuters has reported that billions of dollars’ worth of Meta’s ad revenue comes from ads for scams, illegal gambling, pornography and other banned content. In the US, ICE and other government agencies have bought software that uses ad tech data to track people’s movements.
I don't know if an ad blocker protects against Discover-Tech’s Controlium but in general you'd be a fool to allow ads in your browser in at this point. The ad industry is pretty shady all round.
For years there was a strong segment of HN commenters who would come on and declare a moral imperative for not using ad blockers and looking at every ad you could in order to support a website.
One must wonder how many were genuine vs an influence op.
Or genuine people who ate an influence op before posting here.
The whole point of an influence op is to find a bunch of useful idiots to provide a large multiplicative factor.
And that's the problem with arguing that something is an influence op, because it is going to be mostly genuine people by the time it gets to you, even though you're not wrong.
Once again proving that ads are an unacceptable security threat. All those sites now deploying ad-blocker blockers should assume liability for whatever ad software they force their readers to run.
Apps should be required to disclose every single ad network they use as part of their app store disclosures. I want a lot more transparency as to where the ads are coming from inside the app itself.
I've witnessed consumer apps throwing quite heinous malware/sketchware advertisements and watched the banners rotate between 4-5 different ad vendors to keep things hot and spicy.
The incentives are lopsided, there’s so much money to be made by selling access to you and your devices, and controlling you, than just taking your money.
Indeed, it seems there are some externalities that a 100% free market doesn’t protect against for which regulation is probably the best tool.
A regulation here that applies to all app stores is even business friendly as an appstore which wanted to do this already wouldn’t be punished by trying to do this on their own, for the reasons you mentioned.
Back in 2012 The Jester claimed he used targeted spyware to target Mir Islam or Josh the God leader of UGNazi which according to him led to his arrest, though law enforcement never confirmed it.
Interestingly enough they have his laptop he used for a while in a museum.
All ads should have to appear in an <advertisement> node, and users should have the option of disabling javascript within an advertisement. Make it the fucking law.
The lesson from story: Install adblockers on all your devices
Given whom did this attack, I would not be surprised if it was used as intel for strikes on journalists.
There are reliable sources from inside the Israeli Intelligence apparatus that have stated on record that decisions were made to sacrifice 500+ innocent civilians to carry out a strike on one human target. I bet such a strike would be more likely if spyware indicated that one of the innocents was an "enemy" journalist.
Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle...
The CTO happens to have worked for Radware
Nope. If the messenger has a history of being unreliable, it's valid to call him out. I'm glad you read a TikTok guide on fallacies, but this isn't one of them.
> Related work by the research group Confiant also suggests that Discover-Tech’s ads have been shown to users of the networks of government entities in Europe and the US, as well as the UN, Nato, the international criminal court and the International Atomic Energy Agency.
Yet we don't sanction Israel nor hold them accountable in any way. Of course they're spying on members of the UN and ICC, of course. Israel is at war with the entire world right now, and my politicians continue to support them. Thankfully many people have woken up, but the situation is dire.
Based on responses from roughly 46,700 people assessing 129 countries, Israel ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
That conflates the state with a business headquartered in it. It begs the question of what the sanctions would be for: is the argument that this firm is an arm of Israel, that Israel turns a blind eye to abusive businesses, or something else?
Yes, obviously the state and this company are the same thing. Why would a private company spy on the ICC and the UN? I’m sure there are plenty of 8200 people involved.
In case my point was unclear: Discover-Tech served ads to many clients. As far as I could tell, it's the paper's authors who singled the ICC and UN out.
That might be why the authors, in that disclaimer:
• used "in and of itself" without a footnote
• downplayed "confirm targeting" by sticking "or infection with spyware" into the same sentence.
My Democratic Rep (who is a Zionist) voted with the Republican Party to financially sanction and impose visa restrictions on members of the International Criminal Court for issuing an arrest warrant for Netanyahu, so the ICC could hold Netanyahu for trial.
I will never vote for this particular (D) candidate again. Fortunately, the (L) candidate seems reasonable.
If indeed your representatives support Israel or the genocide in Gaza, I urge you to consider voting 3rd party. In two-party elections, candidates mostly just try to be a little better than their opponent. What forces them to do more isn’t a third party actually winning. It’s a real risk that enough fed-up voters will go third-party and cost them the election. This is basic game theory optimization.
Oh darn, maybe we should just ban the entire online advertising industry. Gosh, what value we'd lose if we couldn't have our personalized attention destroying glitter boxes.
My opinion on web infra patronage has shifted over time, I used to generally accept that for small websites to exist advertising was a necessary evil since they were too niche to have a real revenue source. Then I ran one and I realized that there's far more labor costs involved in maintaining a site than infra costs and that for niche hobbies and communities ten bucks can just find its way into a central pot every month to keep the lights on by those with a bit more to spare.
I am now of the opinion that web communities can survive in the same way arts and other liberal pursuits have always survived. People with a bit more to spare put more into the pot to create the community they want to exist in and "freeloaders" is an alien concept to the genuinely interested since that money is being spent to create a place where meeting can take place without a financial requirement.
>I am now of the opinion that web communities can survive in the same way arts and other liberal pursuits have always survived.
And the only 'users' of these websites will be rich people? Because the moment a paywall goes up on a website it becomes unusable for a large portion of the planet.
Were the hypothetical "paywalls everywhere" scenario to play out, sites would quickly consolidate their subscriptions. So a subscription to something like Engadget would get you access to a wide swath of sites, making the paywall a lot more palatable overall. This would be the inevitable outcome because it would be the most natural way for sites to compete with other sites.
It doesn't matter because simply having to pay any amount at all makes those sites inaccessible. Most of the world do not have credit cards.
But that aside, I think what we would see is a lot more Facebookification. A bunch of walled gardens that you pay a subscription for and then you get access to a whole slew of sites that FB buys up. Of course, they will make sure every site ends up toeing their line too.
Not at all, a few people pay to make it available as a service to others because they want it to exist. It's like this website - there are no (traditional) ads and most of us have paid nothing to use it. A small expenditure creates a good community for technical discussion that the hosts value existing and for being able to occasionally promote their ventures on.
It wouldn't work like that. Yes, there are some exceptions, but that wouldn't work for the vast majority of sites. The rest of them would end up being Facebook pages or Fandom wikis or similar.
I'm not certain how early you saw the internet - but a lot of people threw up websites hosted on consumer quality computers sitting in the corner of their room. Don't underestimate people.
Cool, cool… the “pot of money” model you’re proposing is possible right now, yet is used essentially nowhere outside of substack writers. That’s a very clear signal.
If you ban online advertising, every publisher you know and like will either exit the market or need to use a paywall (which are famously… popular and successful for niche publishers? No.)
You can call online advertising loathsome if you want (indeed a lot of it sucks - no argument!) but it pays for content that everyone consumes. (Unless you only use HN, which is 99% of the time a collection of links to other sites with ads or paywalls or both.)
Regulate online advertising - fine. But “banning” it (what would that even involve?) is not a serious suggestion.
I'm still of the opinion that the end of online advertising would be a significant net benefit to society, if for no other reason then the incentives to keep you interacting with a social network / website / app / media / etc. fade away.
> If you ban online advertising, every publisher you know and like will either exit the market or need to use a paywall (which are famously… popular and successful for niche publishers? No.)
Tons of webforums have donation links or premium memberships. People will pay for their name to be displayed in a different color and basically nothing else, and it's not super hard if you have a few hundred users to pay for servers this way.
It's a fine model so long as you don't need it to scale to one million active users.
Why would anyone trust any Israeli cybersecurity firm at this point? Any website or service knowingly utilizing their services is a huge risk. They're already deeply embedded in federal and local governments so there is a strong sense of doom.
What can we expect from the most unpopular country in the world:
Based on responses from roughly 46,700 people assessing 129 countries, X ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
I'm of the belief that when that happens, it is state-sponsored bots messing with the voting. Sometimes when I make a comment on political matters, it gets waves of upvotes and downvotes.
Thanks by the way for introducing me to that graph. I didn't know that anyone collected that kind of stuff.
You may not have been following the news lately (or historically), but Arab countries have been bombing each other over the past 6 months without any involvement of Israel. Not to mention the historical in-killing in Syria and many other such conflicts in the Middle East that have nothing to do with Israel.
Probably happens with Russia, US, etc as well, but the "hasbara" campaigns through the years have the effect of making people assume the mossad is all powerful etc etc. You inspire fear on your enemies, but also your friends.
edit: and I have been hasbar'd now for simply stating the fact that making people fear you instead of love you has consequences. oh well.
Obviously not the first time an Israeli tech firm is responsible for these types of exploits, and at this point I'd go so far as saying that any Israeli-based tech company (especially cyber security ones, of which they have a strong industry) should be considered beholden to the government of Israel and hence, probably not trustworthy. How could you be sure whether they will act like a trustworthy independent entity, or compromise your data for the benefit of the state?
I would sooner trust a Chinese company than an Israeli company. Is there any country less trustworthy and more hostile to users?
Define "hostile to users" a bit more. Chinese devices recklessly place rando back-doors into things, opening up them up to everyone and their mother. Average consumer router firmware? Compromised. They swallow up any and all information they can get their hands on and operate scam centers where they can utilize the info to blackmail people. Israel seems to have a more targeted approach, albeit there is definitely a blast radius. I'm not sure I can say any one country is worse than the other when it comes to cybersecurity. That includes: USA, Iran, North Korea, China, Israel, Russia etc. They all put consumers at risk; whether it's immediate or down the line when the exploits are revealed and other bad actors (scammers) are able to leverage them. It's a lose-lose for us either way.
I would also love this clarification, because not trusting an Israeli company is one thing, but with China, you're choosing to trust a government that is decades-old at being untrustworthy, not just a company. And whether or not the Israeli government can persuade a company to work with them notwithstanding, it's a known out truth that the Chinese government is in the business of its businesses.
> Define "hostile to users" a bit more
Exploding pagers. Israel literally killed people with consumer tech.
> Define "hostile to users" a bit more.
They use this software to find and kill people. Which they then publicly brag about. How much more hostile do you want to be?
> How much more hostile do you want to be?
There is no limit. The request is not coming from genuine curiosity — they are asking for a stricter definition so that they can attack any one that you provide, no matter how sensible. The befuddlement is deliberate.
Incorrect. I was genuinely curious and the person you responded to even proves my point in needing clarification because they're referring to an intentional "enemy" (which is relative here), but my understanding of OP's "users" is the average consumer like you or I. That's why I asked what the definition of "hostile to users" is here because hostile to a specific military or organizational target (like Israeli compromised devices do) is not the same as hostile to Frank sitting in a cubicle in Wisconsin (like Chinese compromised devices do).
EDIT: I looked at your comment history and it's full of snarky comments like the one you made here. You're either trolling or you lack a serious self-awareness in your contributions to this platform. Maybe time to step back and examine if it's worth even being on here if you can't control your emotions and have a civil conversation instead of these virtual drive-by shootings where you don't even engage with the actual person you're commenting about. This is not Reddit.
This is a weird question and comment because a country doesn't generally make the software. But I suppose they seem to have a lot of influence on the companies. Like surveillance cameras in China.
If I was to say which countries do the most to restrict digital freedom, I'd say look at this table: https://eylenburg.github.io/countries.htm
If I was to say what companies have done the most to take the most privacy from the most people, it would be American big tech like Google and Meta.
There's some okayish software from Israel I can think of, like Zcash.
These Israeli ones are literal criminal companies. What Meta does should be illegal. Both are immoral.
A single spyware against a journalist is much worse than a single Facebook user, but for the total impact on society, they both destroy democracy and human rights significantly.
>I would sooner trust a Chinese company than an Israeli company
As for trust, with privacy I'm a big proponent of avoiding it. Use E2EE or self host if you have to. The country does not matter so much.
> as for trust, avoid it
We all end up running closed source code somewhere
If you do you'll be much better off avoiding Israeli tech
As a rule if you boycott everything Israeli it'll be smarter, more ethical, and safer
Zcash was created as an alternative to Monero. In Monero, every transaction is completely anonymous. In Zcash, transactions can be chosen as anonymous or not, so users can be pressured to avoid anonymous transactions, and to avoid associating or transacting with users who use anonymous transactions. This is apparently the main advantage and selling point of Zcash.
Some multinationals have their R&D offices in Israel, there's a lot of pretty good research coming out. Russia would probably be worse in terms of trust and they are openly hostile to the West unlike Israel.
> openly hostile to the West unlike Israel
Israel has openly and publicly threatened western politicians and citizens that don't aid their agenda however, many times. Like Russia, they have also shot down commercial airliners.
Unlike Russia, they have killed American sailors whilst directly attacking American naval assets.
https://en.wikipedia.org/wiki/Israeli_espionage_in_the_Unite...
That doesn't make any sense. China is a full dictatorship, Israel is not.
Vote me down all you want for saying something about Israel that's not super negative, but it's not a "which country do I dislike most" competition when it comes to facts.
It's an ethnic supremacist theodicy, is that better or worse than a dictatorship?
Also, meta discussion about down votes is against him policy, yet magically you're exempt, typical of **
China being a dictatorship means bad things for Chinese citizens but not necessary for the rest of the world.
Israel being a (disfunctional and rather illiberal at this point) democracy, means it's much better for it's own citizens (excluding Arabs ofc), but says nothing about the people outside. Same for the US BTW.
You wouldn’t put personal data and trust in a Chinese app.
Israel still have the reputation of being part of the ‘free world’ in the collective mind.
that is more dangerous.
> You wouldn’t put personal data and trust in a Chinese app.
At this point, I don’t agree. I’m an immigrant living in the US currently. From an infosec and real-world consequences perspective, I have much less reason to fear what the Chinese government or corporations could do with my information than what either the current US government or its major tech corporations might do.
> Israel still have the reputation of being part of the ‘free world’ in the collective mind.
That collective mind is cognitively challenged and extremely ignorant, but it doesn’t mean I have to be.
wonder how long they'll be able to uphold this reputation, it's a bit puzzling to me that they still have one after three years of genocide in Palestine/Gaza and attacks on Lebanon, Iran, Qatar, Yemen and Syria. with the president having a warrant for war crimes and being investigated in his own country. and far-right government officials proudly saying that they want to eradicate their arab neighbors, and other heinous shit.
seems to me like lots of people are wary of ever criticizing or changing their mind about Israel, because their population once was the target of arguably the most heinous genocide in history, so far, which i'm of course very sorry for. must've caused some heavy, multi-generational trauma, other than that i can't explain why they're acting the way they do. don't make the mistake of translating official government statements or looking at population surveys, truly horrific, barbaric stuff. but of course the only terrorists in all of this are their neighbors which they keep in open-air prisons they at this point have bombed to rubble.
It comes down to trust them about what.
If I were engaged in anything hostile to Israel I utterly would not trust Israeli stuff. But Israel is normally quite careful about target selection, if I was not engaged in anything hostile to Israel I would expect anything they slip in to be secure and to not do any harm beyond it's existence. A scene from Lebanon not too long ago makes it very clear: A whole bunch of people milling about, setting up for selfies and the like--then we see the building behind destroyed by an airstrike. Clearly all those people around knew the building was going to be destroyed and they trusted Israeli accuracy enough to be standing not too far from where the bomb would land.
China, though, I would utterly not trust target selection or security against misuse.
Many, many, many Fortune 500 companies use Israeli cybersecurity services.
I guess that your concerns are not aligned with reality, or the benefits far outweigh whatever it is you think may happen.
(Talking as an Israeli working in cybersecurity)
Or maybe fortune 500 companies have different vulnerabilities, financial power, and concerns than individual humans.
A good chunk of the EU powergrid uses Israeli made embedded systems.
which is profoundly stupid from a digital sovereignty and security standpoint.
No kidding.
> Many, many, many Fortune 500 companies use Israeli cybersecurity services.
It's possible for this to be true, and that they spy on said companies on behalf of the government of Israel. It makes it easier to do so.
I'm saying they shouldn't do that, because there is a decent chance those Israeli companies may do things at odds with their customers' best interests (because they cannot or would not say no to a government request).
Hopefully that will change soon.
> should be considered beholden to the government of Israel
Do we have evidence this is a state operation versus a criminal group?
Excellent question. It seems likely because:
* The state of Israel does authorize spyware sales (eg NSO Group has to get a license from the Ministry of Defense, and Israel's Defense Export Control Agency states that its decisions take national security / foreign policy into account).
* In the case of Pegasus, NYT had reported that Netanyahu intervened to make an exception allowing sale of Pegasus to Saudi Arabia (as political leverage). NSO group execs used Israeli diplomatic passports when they traveled and stayed at the Israeli embassy.
* The government doesn't crack down on these industries, which it would do if it really considered them criminal.
* In this particular case, one of the main targets was Al Jazeera, which seems unlikely that a criminal company would want to target vs. a state actor.
So yea, the government seems to allow these companies to engage in what other countries would consider criminal activity. You can then kind of choose your spot on the spectrum of: "I think this is some broad conspiracy the government purposefully designed for large-scale espionage" or just "The Israeli government thinks it would be good to have great cybersecurity skills in the country so they bend the rules a little".
A good well-researched read is The Palestine Laboratory by Antony Loewenstein.
Exactly. There's plenty of public-private partnerships in Israel and there is zero chance that a spyware firm would go unnoticed. Israeli academia, defense industry, and government is tightly interconnected. See Unit 8200, for example, which basically works as an incubator for Israeli cyberspace fraudsters. Denying Israeli government involvement here is just as dumb as denying Russian government involvement in Fancy Bear.
Don't be antisemitic.
Jewish and Israeli are not identical. It's possible for someone to have negative views of the country without that being a stance on people who are Jewish.
Actual report from Citizen Lab:
* https://citizenlab.ca/research/how-discover-tech-turned-targ...
OK, I read the report, but I'm still not clear on what the browser vulnerability is. This clearly seems like something browser vendors should be able to patch, correct?
The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited.
It was a Windows exploit that ran. An adBlocker (funnily enough) would've been an excellent defense against this, given that the exploit ran in JavaScript served in targeted ads.
Though, there is a browser patch for this, don't advertise so much identifiable information that an advertiser can identify a user or their employer. That's the defense, but it'll never happen.
The os exploit is, within this context, after the fact and therefore a non sequitur. You should look up the Project Zero watering hole analysis where they revealed something like 17 0-days being delivered to visitors of one particular site. It's likely that citizen labs only had windows exemplars.
Do you have a link? Why would a site burn 17 0-days like that?
(This comment must have been posted in one of the other threads before we merged them hither. I don't recall which one, but the other links are in the toptext.)
Very weird to me that they never recommend that the industry could stop adding javascript to their website. They recommend millions of layer of "security" but never recommend the end of javascript. This is outrageous to me. Disable javascript!!!
My question is, why is Israel so good at this? It seems to be at least the 4th cyber power of the world, after the US, Russia and China, if not actually on par or better.
I guess it is because it has been under the threat of larger enemies from its birth, so it must leverage whatever it has to survive. And once you grow an organization and let it loose, you don't have much control over it anymore, and it grows in the wild like a flower.
Because it's the only country allowed get away with stuff that would be an international scandal if a normal country did it.
More specifically, it can steal military and tech secrets from the USA and keep getting invited back. Total impunity.
And also injure and kill our sailors: https://en.wikipedia.org/wiki/USS_Liberty_incident
In that one incident, they killed and injured more than double the number killed and injured by Al Qaeda in the attack on the USS Cole.
Did we forget about Snowden?
Everyone knows Snowden so I guess it was quite big scandal
Everyone knows Snowden was a bad boy who got himself into trouble.
That’s as much as your mom knows.
Circles probably matter. I am actively in communication with several hundred people of all ages outside of tech. I have never heard anyone say anything except: (1) positive of Snowden, and (2) negative of the NSA.
> Circles probably matter.
Yes.
> I have never heard anyone say anything except
What’s this have to do with the people you don’t hear talking about him being mostly totally ignorant about the person and subject?
And Gitmo, lies leading to invasion of Iraq, Abu Ghraib, all of the times we whoopsies a JDAM into a school or wedding…
But yeah the country under an eternal international microscope is the one “getting away with it.”
US gets away with it because no one can challenge their military might, Israel gets away with it because any criticism of the state is “anti-Semitic”. Not the same thing
No one can challenge our military might?
...Did you just emerge from a bunker that you entered in 1946? Here in 2026 we're on quite a losing streak against MUCH weaker opponents. I mean I get it, you're doing the "Jewish conspiracy" thing and reality, truth, words having meanings are all inconsequential to you, but you have to try harder than this.
This doesn't work anymore
Even the US had big scandals with Abu Ghraib and waterboarding, with big public debates. Even if this was just about public image and hypocritical, not about real values, it shows some capacity for shame.
Though this may be changing now with Trump and the israelification of america.
Big scandals that led to... prosecutions of the people involved at a high level? Systemic change?
Come on... Snowden told us that we were all being spied on and we made some movies, some books, a lot of blog posts and that was it.
Abu Ghraib? The people literally on film doing things were prosecuted, and it was passed off as an essentially low-level problem.
Gitmo still exists and has prisoners.
We invaded Iraq on a lie, literally lied to the UN about a nuclear threat that didn't exist. Elected that guy a second time, just like Reagan and Nixon and Trump.
What we're good at is public debate that goes nowhere and losing wars in the Middle East.
I'm not saying that justice was served, just that they had to go through that public spectacle of pretending to care, unlike others.
So yours is a call for more hypocrisy because that is... fairness? Or you're asking for the nations of the world to do better including Israel?
It's hard to tell, on the surface it looks a lot like the usual "Sinister conspiracy" stuff that leaks out of sewer gratings online.
Just like frontier models get away with things no humans would.
All normal countries spy on their enemies and all normal countries spy on their friends. All normal countries use cyber-espionage. All normal political groups condemn the actions of groups they oppose and excuse the same actions when committed by those they support.
1. For all normal countries, if they get caught, there's consequences. For Israel there's no consequences even if they get caught.
2. Israel is embedded in US politics. So US government is allowed to purchase this from Israeli contractors but I doubt they would be allowed to purchase sensitive stuff like from a neutral country like UAE.
So, the US is the customer and also protects Israel so Israel has built an entire industry around it.
> an international scandal if a normal country did it
Russia, China and America each have notable offensive cyberwarfare capabilities. (Pyongyang is a nuclear-armed cybercrime ring at this point.)
You just listed some of the most sanctioned countries in the world #1 and #3.
China doesn't have large sanctions because it plays a key role in the economy, but the US had massive regime change intelligence operations against them in the 90s, but they failed and were dismantled.
Integrated selection pipeline spanning 15 years from age 4 up until age 18.
It’s an interesting question. I would also guess that this kind of behaviour would be illegal for private companies in many countries even if you don’t do it domestically.
Putting it amongst that cohort and suggesting it's a flower is definitely one reading I guess.
“Threat of larger enemies” yeah that’s the direction the threat goes.
The US, to its eternal shame, guarantees their security.
Israel is not particularly skillful: they're a little bully getting in some punches while a big bully holds back the rescuers. Ooh, tough guy!
Cope harder. The US guarantees the security of many nations, including many of the failed states in the Middle East. Look at Saudi Arabia, being completely helpless and begging everyone for help with the Houthis.
I partially agree: Israel is a little bully who should be extremely worried about the track record of their big bully brother.
Dude, the cover we give Saudi Arabia is also shameful. And when you look at "businesses" like NSO Group, those things are even directly related.
But good on you for recognizing that we have a pattern of this kind of thing, even if you've stopped just short of noticing that it's a problem.
That's been the status quo for decades, but between Trump convincing folks that the US won't protect them and Iran convincing folks that the US can't protect them, and Hegseth focusing more on culture war stuff rather than policy objectives it's a guarantee that's looking a bit thin.
Iran isn't convincing anyone. It's a rogue terrorist state that has pissed off all of its neighbors by launching missiles at them and harassing their ships in international waters. The country is sinking, inflation and unemployment are rampant, its currency is worthless, but the mullahs will do whatever it takes to stay in power.
The US side of the bargain was that we can protect you, period.
I think its pretty clear to everybody now that we cannot protect you if your enemies are:
- sufficiently crazy
- willing to spend $1 attacking for every $50 we spend "defending"
It's now a very different kind of bargain.
>Israel is not particularly skillful
"The people I don't like are always unskilled." You shouldn't hate your enemies; it affects your judgement.
"threat of larger enemies from its birth"?
Israel is the one occupying and bullying its neighbors, spying on its "allies", doing air-strikes on neutral countries, attacking US research ships, and performing piracy and kidnapping in international waters.
Back when I was a tech journalist, back in the 90s I visited Israel once and interviewed a number of their tech companies - admittedly most in the cyber-security space.
They ascribed a lot of the tech innovation to conscription - lots of the founders had learned a lot while in technical posts in the army and put that to use when they left.
Most people have heard of the Mossad, but Unit 8200 of the IDF deserves the same notoriety. The state selects bright young techies and trains them in the absolute state-of-the-art in cybercrime. What could go wrong?
https://en.wikipedia.org/wiki/Unit_8200
>The unit is composed primarily of 18–21 year olds. As a result of the youth of the soldiers in the unit, and the shortness of their service period, the unit relies on selecting recruits with the ability for rapid adaptation and speedy learning. Afterschool programs for 16–18 year olds, teaching computer coding and hacking skills, also serve as feeder programs for the unit. Former Unit 8200 soldiers have founded and hold top positions in many international IT companies, including in Silicon Valley.
>According to the Director of Military Sciences at the Royal United Services Institute in 2015, "Unit 8200 is probably the foremost technical intelligence agency in the world and stands on a par with the NSA in everything except scale."
Multiple reasons. America gives Israel special protection for everything they do, Ashkenazi and general Jewish culture values education more than anyone outside of East Asia, and a lot of Soviet Jewish scientists had to work for the military so they came to Israel with cryptography or spy tech experience.
> Ashkenazi and general Jewish culture values education more than anyone
I would recommend you to visit Israel and traditional orthodox jews. Women are serving as "birthing machines", constantly pregnant, and doing all house chores. Education for women is strongly discouraged. Men are "studying", but useless memorizing of old texts.
Normal education in western sense is strongly discouraged in traditional jewish culture!
That is only one part of Israeli society.
Two things can be true at the same, although I agree with your assessment of future prospects - and the recent OECD report on school performance could be read that way too (or blamed on the war as the government has).
https://www.timesofisrael.com/israel-plummets-to-worst-ever-...
Israel is not just one homogeneous people, there are some orthodox jews who study biblical texts, treat women as birthing machines, and (personal opinion) contribute little to our society.
Yes, orthodox jews are a significant part of the population (~1.4 million in 2025 [1]), and I wouldn't go there looking for modern ideas like women's rights, but go a couple km in any direction and you'd find completely different people, living modern lives just like in the rest of the western world. Schools, research universities (Tel Aviv University, Waitzmann Institue of Science, Technion), tech companies, startups, makerspaces, and many more.
[1] https://en.wikipedia.org/wiki/Haredi_Judaism
Traditional Judaism has this really weird (to me, a goy) emphasis on finding loopholes in rules. I always remember these ropes they place around New York City and other places so they can stay "indoors" on, I think it was, the Shabbat, by walking underneath the rope, which is a type of ceiling.
As I understand it, they know God's not stupid and sees right through this sort of thing, but they believe God put rules like "stay indoors on the Shabbat" in place so that He could entertain Himself by watching the creative loopholes humans come up with. Other Shabbat loopholes include putting things on timers the day before, paying a non-Jew to do things that Jews are forbidden to do, or legally transferring ownership of the cupboard full of bread to a non-Jew for the one day a year when Jews aren't allowed to own bread.
And as I understand it, they do this with all things, from a young age. Cultivating this mindset definitely has something to do with their cybersecurity prowess.
'It's due to the shiftiness of jews'. Nice discussion Dang.
> Traditional Judaism has this really weird (to me, a goy) emphasis on finding loopholes in rules.
As an atheist Jew, it's weird to me as well...
> stay "indoors" on, I think it was, the Shabbat
Can't say I'm familiar with that one. What I'm generally familiar with is that you're not allowed to "work" on Shabbat, and the definition of work is extremely broad. For example, lighting a fire is considered work, turning a light switch on creates a tiny spark between the contacts, that counts as fire, so it's work.
This extends to pretty much every electrical device, so for those who observe Shabbat, using a computer or phone, turning the AC on or off, is all disallowed.
As a result there are many workarounds as you've described, timers, non-Jews (though you can't ask directly! You can say "it's hot in here", but not "Please turn the AC on"), fridges without a light bulb inside, and more.
> they do this with all things, from a young age.
Religious families do, to varying degrees. But I've met plenty of extremely talented programmers and hackers who do not follow any of the Jewish law.
Edit: Just noticed your username, I also want to say I really like your projects on YouTube!
And also it has help, it is unlikely it acts alone. Example Stuxnet. Israel has the talent so they are a convenient and willing proxy too for getting shady shit done.
Don't forget the compounding effect. Say, one country (or city or community) decides to invest their efforts into area X (e.g. clock making in Switzerland). They do it and become better and better. As long as they keep doing that they can become #1 in the world. Regardless of any reasons "why them".
There's no reason Netherlands are better at chip lithography except that they're doing it (Dutch agriculture success can be attributed to good soils/climate/geolocation, but not chips). There's no reason Hollywood is better at filmmaking. Kinda chaos theory -- small changes to initial state leads to huge changes in the later outcomes.
Regarding the Netherlands, it doesn't hurt that TSMC happened to be cofounded by the same Dutch company that spun out ASML
Yep, exactly my point "small change in initial parameters".
Also, how it stops to be. Specializations like that get disrupted if there's an easier way to make money (aka Resource curse, aka Dutch Disease [1]).
Same thing with Israel -- if they had some easier way to make moneys they would go for it. But constant demand from their defense kept if afloat.
[1] https://en.wikipedia.org/wiki/Resource_curse
I would like to give a real world example of this too.
If you want to do something artistic or start a business based around Art, Montreal is perfect for it, for the very same reason above.
Initially the govt invested in the arts to preserve French culture, which resulted in a lot of art infrastructure being made, cheap ateliers, fabric suppliers, paint suppliers, &c. Which attracted a lot of artists, which then increases the demand for the art infrastructure, which makes the city easy to make art in.
It makes it stupid easy to make stuff and find the skilled artisans you need to make it. Much easier than any other Canadian city I've lived in.
Just curious which city is the best city for computer system programming?
Galesburg Illinois
Depends what "best" means. Best city for cheapest workers in that area? Best city for highest paying employers in that area? Just these two would yield different cities.
Santa Clara, CA. Lots of computer systems around.
The Hollywood case has a quirk that is relevent to the extensional content of HN:
West coast filmmakng started in the Bay Area (at the time the largest conurbation in the west) but moved south because of the year 'round weather.
But why the west? Because Edison controlled the filmmaking patents and demanded not just royalties but script oversight as well. By moving west, they could ignore the patents because they were simply too hard to enforce from such a long distance.
So ironically, given how things worked out, IP piracy is at the root of Hollywood.
Yep, but Edison is long gone, while Hollywood kept compounding over time. There's zero other reasons Hollywood is _currently_ better than any other place for filmmaking.
The term you’re looking for is “path dependence” and I was agreeing with you.
The only reason I even commented was because IP issues are popular and relevant on HN
This, plus all jewish folks I've ever met are naturally smart (not genetically of course, more like societal pressures/expectations/upbringing), hard working like few others, and seem to genuinely veer towards numerical jobs - banking and finance, math, applied math like security, cryptography, trading and so on. Very similar to Iranians to be fair, if US and British MI6 wouldnt be meddling in Iranian internal politics and supporting corrupt shah to steal all the oil cheaply those 2 would be together a superpower on global scale. Israel was very very lucky to not have any oil on their territories.
Plus very much present in US politics and power circles for some reason.
2 examples out of many - my boss is a prime example, every thought somehow infused with money (I work in a bank). My ex gf was exactly the same (she is a successful commodity trader). Just very, very different mindset to the core to say typical european one (I mention folks who are europeans and I've never been to Israel, so extrapolating a bit here).
> it has been under the threat of larger enemies
It has always been at odds with its neighbors and has persecuted its occupied people, for far too long. It has further facilitated other tyrant governments in the control of their people. The cyberwarfare industry in Israel is directly part of the controlled Defense Industry.
It is not under threat. It has sought to be a formidable threat to everyone.
Israel is definitely a threat to its enemies, but even if you think it's all their fault and they deserve it (I do not think that), it's pretty obvious that Israel also faces many threats.
Perhaps you don’t know the history or simply choose to ignore it. Initiating bombing, ethnic cleansing, stealing land, property and occupation of people for eight decades, while publicly declaring a desire to invade all the regional nations to create a greater Israel apartheid regime does generate pushback. Imagine that.
See professor john mearsheimer on the history & future of israel
https://www.youtube.com/live/z8wooQEYyzc?si=_STtJSdEjDUwIl72
I’m well aware of the history.
What I meant was, I don’t think Israel is the only guilty party in that decades old conflict, nor the only side with agency to choose how to react in the conflict.
Read the Hamas charter, Iran’s statements about Israel, etc. Israel is not unique in choosing violence.
The Hamas charter is more-or-less isomorphic to the Likud charter, Likud being the currently ruling political party of Israel. So it's not fair to assign asymmetric blame to those charters.
On the contrary, I was using those charters to establish shared blame, rather than singling out Israel for every act of aggression in the conflict.
The idea of Israel being under threat has been inculcated into every Israeli and Zionist. Significant casualties of historical facts had to occur such as The first arab israel war is described as arab world fighting Israel, Even though Israel conquered significant parts of UN partitioned Palestine. The arab govts were too new to be a threat. And they were too disunited then and now. Since inception, Israel has been behind every attack and disruption to peace.
It's the spy agencies you hear nothing of you should worry about.
> has been under the threat of larger enemies from its birth
As everybody else in the planet. Israel is not special in that sense.
Not really. Most countries don't face realistic threat of invasion, especially post world war 2.
Over the last 50 years, the probability of anyone invading france, canada, australia, etc has been next to 0. The only countries that really had to worry are the ones that straddle the regions of influence during the cold war.
> the probability of anyone invading france, canada, australia, etc has been next to 0.
Good for them. They learned to cooperate with their neighbors, created alliances and friends, and restrained to kill other people.
If you have one enemy, the enemy is the problem
If everybody else is your enemy, YOU are the problem.
Check your behavior and see if you can improve as human being.
This is an extremely weak argument.
Pre-1967 Israel didn't control the West Bank or Gaza. So most of the bad stuff people claim about Israel today didn't really exist.
Yet all its neighbours wanted to destroy it.
Lebanon who in theory should have no dispute with Israel bombarded it with ten's of thousands of rockets, mortars, anti-tank munitions etc. After Oct 7th.
The bit you're missing in your overly simplistic analysis is that Israel is really surrounded/attacked by a single religious/political ideology. There is no "everybody else here".
And what you are missing is that Israel acts don't call for friendship even in the people that would want this friendship.
Israel has stolen as much military and industrial secrets from US as they could grab. Has violated every international law. There are strong suspicions to be behind Epstein honey trap for riches and politicians all around USA and Europe. Has funded Hamas. Has an horrible relationship with human rights, longer than the bible. Has called non Jews "human animals", and acted accordingly, even to the point of doing competitions about "who can destroy more kneecaps or shoot more testicles in a week", among starving people that were trying to obtain food none less. Has treated 5Yo children like partridges in a hunting party. Has killed thousands of journalists, doctors, nurses and NGO staff without even trying to pretend that they care. Has put spy devices in friend's phones each time they could. Was caught messing with the elections in UK. Has used, discarded, and left each politician that supported them, alone and hanging dry in the elections, from Biden, to Trump, to Merz.
US does not want the demise of Israel, but Israel does not even try to pretend that they respect the opinion of US. Even after all this time, is all grab and cash. And US is always cleaning the mess that they left behind.
And the only thing that we can hear from them is "Why everybody hates us?" Really?. Clean your acts first.
> If everybody else is your enemy, YOU are the problem
Because morality is a numbers game?
If Israel nuked everyone but one of their enemies, would they be in the right, as then they would have only one enemy?
> If Israel nuked everyone but one of their enemies, would they be in the right, as then they would have only one enemy?
Depends. Their current friend will most likely become their enemy by then too.
Because the problem that's common to a set of situations is the common factor in those situations, not the uncommon one.
But that's mostly true because those countries are rich and fly half the world away to attack poorer countries and usually by bombing them from far away. Eg syrians can't realistically gather enough money and weapons and planes and bombs to bomb paris. Or iraqis london. Etc. On the other hand, they can gather a few fanatics, give them guns and have them shoot a bunch of people, or bomb something, or worse. But then we get the "why did those people get radicalized? was it GTA?" articles.
TBH, considering the number of dead in palestine and the number of people in europe/us who literally lost everyone who ever mattered to them, the number of "terrorist" attacks seems relatively low.
Why is that relavent? The point is that some countries have more immediate security fears then others. It doesn't matter what structural factors lead to that. Countries with realistic security fears are going to invest differently than those that don't. Countries like people do whatever they think is in their best interest.
If your point is the world is unfair, then yes obviously that is true, nobody disputes that.
If france decided they needed to exert their "political pressure" over eg. germany, they'd have the same problem and all the realistic security fears, because germany is a rich country and they share a border. Same for the opposite direction with a few more historic events related to that. Same with france vs uk wars, and many many other wars in europe.
But hey, having your capital cities bombed is expensive, transport is cheap, and so it's easier to bully countries in a different continent, eventually bomb and invade them, becuase you're pretty sure they won't be able reach you back home with conventional war means (planes, rockets, tanks,...).
And yes, it's relevant, some politicians in one of those "safe" countries decided to bomb some country in a different continent, and you, a normal football fan or a party goer get killed when those people come and fight back in "unconventional means" (eg 2015 in paris). Somehow no one treats those as "we're at war with them, we bombed them first, they're just fighting back".
> Over the last 50 years, the probability of anyone invading france
Wat.
Sure, maybe if NATO stopped the USSR in the Fulda Gap. But you know that the USSR's war plans definitely involved invading France, right?
And don't make the mistake of judging probability with the benefit of hindsight, that'd be a terrible intellectual tarpit to fall into.
To a certain extent, i think its because Israel benefits from being seen as "scary" so there isn't as much pressure to keep this sort of thing on the down low, where in any other countries there is more pressure to keep grey-area stuff like this secret to prevent blowback.
A few potential possibilities that may or may not be popular here.
- Compulsory military service means the government captures the best and brightest of the country.
- An extraordinarily outsized number of nobel prizes belong to Ashkenazi Jews, and other indicators of intelligence (lack of propensity for violent crime, lifetime earnings, etc) are also quite high for the whole group.
You conclude that they’re good at it because they keep getting caught? Fascinating.
Given the number of enemies Israel has, it has to be prudent and explore every opportunity it has. One strategic mistake could be fatal.
We have had viruses leaked by other countries in the past, with US and Germany coming to mind. If I remember right it was around 2005-2010 when democratic nations officially started to state that they had a right to use malware against criminals and military targets, and from that on it has just kept going. As I recall, Bruce Schneier and FSF made a bit of articles and talks where they tried to get people to understand that once democratic nations starts to use malware offensively they also generally stop protecting their citizens from those security holes.
That we don't hear about it more often seems to me that nations that develop this stuff seem to have gotten better in making malware more precise in what they target and less leaky to the general population, but it could also be that media just don't report about it as much. When a gangs anonymous chat get hacked, or a tor hidden service website get taken down, news seems more interested in talking about the crime than what security vulnerability that the police used.
Country that prizes education and is constantly under threat. Plus, most folks do serious time in the army and only after that do they go to college.
They get away with genocide, it's no wonder that they can get away with this.
> why is Israel so good at this?
Unit 8200 [1]. Also, Israel doesn't extradite its own citizens and seems to turn a blind eye to criminals doing nonsense abroad. (Similar to Russia and China.)
[1] https://en.wikipedia.org/wiki/Unit_8200
That unit is a symptom of their prodigious skill not the cause. Israelis are good at cyber for the same reason the US is good, and the same reason Russia is good. They have an outsized tech industry.
> That unit is a symptom of their prodigious skill not the cause
"Unit 8200 was established in 1952," and apparently the Technion – Israel Institute of Technology was founded in 1912 [2]. I don't think Israel became a tech centre until the 1980s or 90s.
I'm not an expert on this. But similar to how military spending created Silicon Valley, I think Israeli military structure created its tech industry.
[1] Wikipedia
[2] https://ats.org/explore/videos/1912-today-the-institution-th...
Because Apple, Intel and Samsung have huge engineering labs there and employ IDF & intelligence people to work in those corporation’s labs. It means they have very detailed knowledge of their products as they have all internal documents and also design software & hardware.
That is why both Apple & Samsung have malware from Israel on their phones. The USA has the NSA building and exploiting products for surveillance and penetration globally.
Netanyahu recently was on a US broadcast, he held up a phone and stated to the reporter interviewing him, that Israel can penetrate any device obtaining it contents and then blackmail or discredit the owner of said device.
The USA now examines phones at airports to see if people are saying things the current administration doesn’t like.
Fewer internal barriers.
> My question is, why is Israel so good at this?
American money, tech and intel, plus they are vastly overstaffed for the size of territory they want to defend.
Because they are arrogant as fuck, barge their way in, shove everyone else out of the way and genuinely believe they are gods chosen people. Are you surprised that a country that regularly spits on Christians and turns cities into concentration camps while running the world's biggest pedo blackmail ring, "right to return for pedos" offer, exploding pagers and spyware operations - happens to be the best?
For the same reason Russia is so good at producing mobsters - the government turns a blind eye or even acts as an incubator for scammers. Your question is like asking why the Philippines is so good at sex tourism.
AdTech engineer here (some 13 years in the industry). A couple of notes:
- The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.
- To the point below that "ad providers should be held responsible." There is no such thing as "ad provider." The AdTech ecosystem is teeming with different niches and business models - see the famous LUMAscapes diagrams: https://lumapartners.com/lumascapes/ . The sheer volume of traffic makes it virtually impossible to vet even a fraction of it. Google has thrown a lot of compute power to pre-scan 3p creatives and even then bad actors can sneak through. Add to this a lot of sophistication on their side (from different landing pages based on the perception of the type of user to farming throw-away advertiser accounts aimed at running just one campaign like that to hijacking legit accounts through sophisticated technical and people engineering means). In the end, politicians full of indignation do what politicians always do - sue or fine Google and call it a victory, whereas the true bad actors just keep going.
Prior to online ads, that is ads that existed on TV, print media, etc, ads were properly vetted. Very few outright scams made it through.
So, it’s definitely possible, especially with human review and static ads. No code. It might not be possible at scale. To me, that’s just not an excuse. If you can’t do something safely at scale, then you shouldn’t. If that means generalized online ads can’t exist then… so be it.
Online ads are definitely still possible. For example, im sure Disney reviews and approves all ads that run on Disney plus. So just do that, and if you can’t do that for e.g. YouTube then dont.
Late night infomercials for get rich quick scams and spam fax machine ads were all over the place by the late '80s sadly.
Not in Australia at least. There were ads for flash in the pan fitness and weight loss devices and various other wastes of money, but outright scams and illegal devices would have their ads pulled real quick.
I think your answer gives us a clue about what went wrong and where.
The fact that internet advertising is run by the big US tech behemoths, makes them difficult to go after by countries that have previously had sane advertising standards. The lack of US regulation is the winning car in the race to the bottom.
You clearly misunderstand the sheer scale of online advertising (compared to linear TV ads, magazine ads etc). There is no chance you can vet every single creative and a landing page (one public number is 30B daily ads just served by Google alone in 2012 - which is probably closer in spirit to the Punic Wars than to 2026).
That's the first point. Now, who should be responsible for getting the ads? The website? That will absolutely kill the monetization model and it is simply unrealistic. Which means, that responsibility now should be pinned on someone else. Who would that be? My point being that no one there has an inherent lawful obligation to provide such vetting, which would be a) costly and b) only applicable to one player (out of many).
And then we get to bad actors. If I were a really motivated bad actor as early as in 2005, I was serving different creatives and different landing pages to different audiences - a perfectly well-behaved ones to Google's crawlers (again, Google does A LOT to fight malware), a questionable quality clicky ones to general audiences and maybe malware-ridden ones to specifically targeted audiences. And you would not be able to catch me in real time - only after the fact, once the campaign was run and someone looked at the evidence (assuming it was collected, which it isn't normally)
it has to be the website to start with; if the website is hosting malware, then it's the website's problem. Soon after that's implemented, the adtech companies will begin competing to solve the website's problem by promising clean, malware free ads, and will begin aggressively vetting ads. The monetization model will be preserved and the incentives will be properly aligned.
There is no universe in which 'gosh it's just too hard' is the correct answer.
> 30B daily ads just served by Google
I'm assuming that means ad impressions and not unique ads.
You have to be specific what you mean by "ads" then. If you mean creatives that ultimately rendered - you are absolutely correct. I don't have any stats handy to check the ratio between the two to estimate the number of unique creatives, but I believe it is a) several orders of magnitude smaller but b) still very very large.
And again, we are talking about logical creative (the actual visible part). Click URLs and such will definitely be different.
If it is indeed impossible to vet all the traffic passing through your networks, then perhaps your networks' existence is itself the issue. Maybe it is indeed not possible to vet 30 billion ads, just like it's difficult for Facebook to moderate all 3 billion users.
Perhaps the actual problem then are these monolith platforms that have done such a good job "eating the world" that they can no longer properly function.
If you really read what I wrote above - there is no "monolith" (and yes, Google is everyone's favorite Boogeyman). AdTech is a primordial pool all kinds of actors, each of which has found a profitable niche to "add value" (or to bullshit partners about "adding value").
I spoke of the network in specific. Whether we're discussing one firm dumping industrial quantities of sewage into the internet, or 10,000 tiny ones, doesn't really change at all that there's industrial quantities of sewage.
I'm critically uninterested in the fictions of the business idiot class. I'm sure for many purposes it's important for all the papers to have the proper LLC's on them. For the purpose of burning it to the ground though, it's not overly important.
They definitely have not 'solved scale' as it refers to commonly understood 'for for purpose'.
They 'solved scale' for being able to profit from it though.
That's a problem for adtech to figure out. Consumers shouldn't suffer.
While I respect that you are posting constructively here you might also be the physical embodiment of the old joke that it is difficult for someone to accept a truth when their continued employment depends upon its falsehood.
The Web used to be a great place before surveillance capitalism and adtech took over. Some of us remember it. People participated because they wanted to. People contributed content because they enjoyed it. The incentive was a sense of community and contribution and shared knowledge - and usually there was no expectation of direct financial gain. Basic hosting was included in everyone's normal ISP plan. SEO wasn't a thing. Blogspam just to generate pages to host ads wasn't a thing. AI slop just to generate even more pages to host ads wasn't a thing. And there was still more genuine and worthwhile content out there than anyone could read in a lifetime.
If 95% of the modern Web disappeared tomorrow and all that was left was what people or organisations were still willing to contribute because they enjoyed it and/or it provided some direct benefit then the Web would probably be a much better place. I cite as exhibit A the fact that we're all here posting our thoughts on HN - itself a site that has always run without any of the intrusive advertising we're talking about - without any compensation or reward other than the enjoyment of the discussion and perhaps the chance to learn something new.
I see no reason to tolerate any sort of online advertising that conflicts with the above ideals. We should simply set rules that decide what is acceptable and drop legal nukes on any company - or indeed any entire business model or industry - that fails to comply. Low key advertising for YC's next round? I doubt a single contributor here minds the little banner that pops up at certain times of year. In-your-face auto-play videos that accidentally (or not - it doesn't matter) advertise something dangerous before your kid's favourite show plays? Sue everyone and punish the offending businesses without mercy. It's really not that complicated.
It was allowed to grow to its current "sheer scale" due to lack of regulation, be that internal or legislated.
Continued lack of regulation, throwing up ones hands and saying "well, it's too big now" will not allow it to be solved.
What has been 'normalised' in the online advertising industry sets my teeth on edge as someone with some amount of security and privacy awareness. Hence I go out of my way to block as much of it as possible, for myself and family and friends.
Even the FBI and NSA make public their recommendation to run ad blockers as a safety requirement for internet browsing. I would have thought this may be some kind of red flag to say that maybe you're doing something not quite as well as would be satisfactory.
I find myself a bit astonished whenever people have trouble with this idea.
We can just decide that if you can't afford a person to vet the ad, it's not allowed to run.
Yes. That will destroy the current online advertising industry. As tempting as it is to say "that's the point", that is in fact not the point. The point is, we are completely in our rights as a society to say through regulation that if you can't vet an ad with a human, you can't run it, and the capital structure can damned well do what it does best and accommodate that whether they like it or not. We absolutely can write laws that say that Google is to some extent directly liable for the ads they run. Nothing is stopping us, at least in principle.
Does that mean it will be a lot harder for the advertising industry? Yes. So be it. That is not a reason this can't happen. Is it expensive for them? Yes. I don't care that this means that they won't be able to run anywhere near as many ads.
It is not a stopper that it would be really hard for them. It should be harder than it is. It should not be profitable to build a vast surveillance apparatus to squeeze literal fractions of a penny at a time out of us. It should not be profitable to have this massive machine that can push such targeted malware at as.
We're not talking about some minor tweaks that they can toss a few AI tokens at. We're talking about regulation that would rewrite the entire social contract of advertising. A social contract that we have not really signed, either individually or collectively. We can do that. We can rewrite the contract. It's a permissible thing.
We don't have to have a massive surveillance state just to serve us ads. We don't have to have sports gambling advertising on television. We don't have to have billboards on our highways. We don't have to have extra-cheap mailing rates for ads. We don't have to have Roblox and other video game systems exploiting our children's psychologies with deceptive game currency practices and gambling mechanics. We don't have to have state-sponsored gambling running what everyone knows is a backdoor tax on the poor. None of these things are physically inevitable. None of these things are socially inevitable. There are reasons why these things do exist, which economists and game theorists and political theorists have various words for, but none of the reasons are because they are mandatory and we're just stuck with them forever because there are no other possible worlds.
If you can't do something responsibly at scale then you don't do it at scale at all.
One economic consequence is advertising gets expensive and limited to big players, like on TV. Make of that what you will.
No, it just means it costs more and you have to care a lot more about targeting.
Good. Advertising is already incredibly expensive for society. It's time to stop externalizing the costs.
https://en.wikipedia.org/wiki/HeadOn My strongest argument that ads were never properly vetted. https://en.wikipedia.org/wiki/Homeopathy There's whole sections of homeopathy in stores. So it's still occurring.
Disney (CTV) doesn't take any open auction demand. All their programmatic demand is deals - meaning that they carefully plan those campaigns with highly reputable agencies and advertisers. There is zero chance for a contentious scammy crypto exchange ad (or even a moderately innocent crypto wallet one) to show on their properties.
Which you can absolutely do, when you are Disney (read, agencies fight to run a campaign with you). When you are, let's say, TechCrunch, the situation changes - you can still strike some deals but a lot of your demand is not the same grade.
So? Your business relying on serving malware is not a valid excuse for serving malware.
I just don’t find business model arguments particularly convincing. If your business model can’t support itself, I don’t think that’s justification to go out and do whatever.
Back in the day web sites that were ad-supported had their own departments that dealt with ad sales, so it's not like it can't be done.
Direct deals are different than programmatic.
Yes, exactly, if programmatic deals aren’t possible to do safely then dont. There’s tons of stuff you can’t do safely programmatically, so we get people involved. Many such domains exist. The idea that advertising can’t be one of them is just the status-quo, not the only option.
Tell that to the people raking in billions (ie: google)
Your appeal to authority as an "AdTech Engineer" works against you when support your own industry. You have a conflict of interest. Of course you will try to do damage control and PR.
I was surprised by the opening statement too. These guys are the literal scourge of the modern web and he's proud he's been at it for 13 years? Not sure we're on the same page, lol.
Clearly not, but I'm surprised it's so common to write someone off for their industry, just because said industry is evil.
Why is that surprising at all?
Or you can read what they said and see that it's neither. Not sure why credentials would have any bearing on the material of their comment.
They're pointing out the article lacks substance implied by its title, and essentially that it would be nice to see the actual bad actors being prosecuted instead of the middleman. Both positive things to hear for me? Who cares if they work for the industry.
(The former thing is positive because it saves me time reading the article for information that won't be there.)
I don't have any conflict of interest. I'm proud of my work and I think it is great. I personally dislike ads as much as the other guy, but I am pragmatic and I have enough sense to understand that this economics has flourished because it maximizes common good: content creators are incentivised to produce good content and get properly and sustainably rewarded, regular users don't get nickel and dimed every time they load some web page.
To paraphrase Churchill, it is a terrible model but others are worse.
Not seing your conflict of interest or not admitting to it doesn't meant you don't have one.
> There is no such thing as "ad provider."
If a website serves me malware, the website's owner should be liable to me. They may then be able to sue someone else, in turn. But I chose to interact with them and then they chose to outsource stuff to crooks.
This would be complicated to implement. But it's absolutely doable.
No, it's not. It completely upsets the economics of content management and makes it absolutely impractical for content owners to monetize through ads. No ad revenue would be worth such liability.
Then there are all kinds of fun scenarios - from drive-by malware to landing page malware to malware served after clicking an ad ON A LANDING PAGE. Who would assume responsibility for those?
Bottom line, this is not much different from "regular" crime. It happens. Governments employ police and various deterrents to reduce it. But it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness.
So you're saying we're all fucked and there's nothing we can do?
I think we currently are - but not because of online ads. :-)
My main concern is supply chain attacks. I'm afraid, the frequency and sophistication of such attacks will only increase, thanks to really powerful LLMs. From there - to running keyloggers and stealing your bank credentials etc.
"in-part because of ads" seems more reasonable, tbh.
When I worked at an adtech company almost ten years ago, this sort of shit was the exact concern of me and my colleagues. We've had time to do better but guess we're just fucked.
I think I've sent this template before:
"But not because of <industry I am employed by>"
What, your ad provider would just need to indemnify you for the consequences of their own fuckups. This is pretty basic stuff.
As for the ad provider, it is trivial to not deliver criminal payloads if your business starts from the assumption that doing so is costly instead of something you can foist on society for your own benefit.
> completely upsets the economics of content management and makes it absolutely impractical for content owners to monetize through ads
Why? An insurance product wouldn't wipe out ad revenues.
> this is not much different from "regular" crime. It happens
Why do you think parking lots have signs that say they aren't responsible for goods stolen out of cars parked there? Because that liability, by default, exists. And if a parking lot is a robbery hotspot, and the owners don't bother putting up cameras or whatnot, they'll absolutely start facing lawsuits and investigations.
> it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness
Nobody argued as much. That doesn't mean we give negligent actors monetizing malware a free pass.
> It completely upsets the economics of content management
Exactly. It moves the economic incentives from "serve the ads from the highest bidder and turn a blind eye to the fact that that's a scammer/malware" to "drop an ad platform that can't or won't keep the scammers/malware out".
Or even better, refusing to use ad platforms that let the ads serve arbitrary code. There is no strict reason why an ad can't be an image (re-rendered by the platform) and a link. Slapping scripts all over the place just makes it easier to collect data (among other things to verify that all the companies involved in serving your ad aren't cheating you, because the ecosystem is full of scammers in all directions).
The deterrent here would be prosecuting the accomplices involved in, and directly getting paid for, the crime.
But it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness.
How can you exercise situational awareness against a zero-day attack?
There are several parties who have an opportunity to detect that problem before it causes serious damage to people visiting a website. The visitors themselves are not among them. Trying to make those visitors responsible for the consequences is nonsensical.
> No ad revenue would be worth such liability
And this would motivate fundamental change in the industry to be able to track down the bad actors.
KYC exists for various industries in order to track down the person responsible for bad actions. Implement KYC for the advertising chain, or something equivalent, to ensure there's a validly registered sue-able entity at the end of it.
> be mindful and exercise situational awareness
I'm not going to say victim blaming, but a good percentage of the population just aren't capable of this, especially with "the sheer scale" of advertising they're exposed to. It's exhausting to be on guard for the entirety of your life.
Might as well say: don't use the internet. That might actually be the best advice to come from all this.
This was my main question as well. I read the report, but I'm still not clear on what the browser vulnerability is. This clearly seems like something browser vendors should be able to patch, correct?
The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited. The step-by-step info graphic in the article literally skips over how the infection actually occurs.
>The sheer volume of traffic makes it virtually impossible to vet even a fraction of it
No, it doesn't. Your company is too much of a cheap fuck to do it and would rather offload that cost on society, no matter how bad the effects of it is.
>There is no such thing as "ad provider."
Only when it's to your advantage, because you're very happy to refer to yourself as an ad provider in every single marketing piece.
>AdTech engineer here (some 13 years in the industry)
You've made the world miserable for the past 13 years and have the gall to come over and pretend you're a poor innocent little thing who can't do nothing UwU there's just too much how could we be held responsible.
Also, society/law is willing to let them do it/get away with it, rather than holding them responsible.
> virtually impossible to vet even a fraction of it
It’s a choice, and on the other side of that choice is profit.
I also have a choice. I choose to filter out as many ads I can. That is my vetting process.
Not to jump on you after everyone else did (although I agree with them), but they didn't give you a solution. The solution is unfortunately for everyone a robust KYC regime. Then the linkages stop being impossible to track and instead become merely burdensome.
> AdTech engineer here (some 13 years in the industry).
How do you even plan to explain it to your grand-children?
Obvious sarcasm aside, I compel you to ponder on this question next time you read "free" content on the web (a newspaper, a dedicated niche site or anything in between).
I send them a dollar or two in Monero, anonymously. That has me for a year, no?
https://www.therage.co
I want to pay a real and honest price for everything.
Former Adtech dev here - yeah, that justification worked for me for a while but when I was ordered to "just go look at this porn site and figure out what they're doing to open popunders despite the latest browser updates and then apply it to our adverts" too many times, I jumped ship.
But sure, "free content cos adverts", you keep believing that for as long as you can, I jumped ship after 13 years of it, which ironically appears to be how long you've been in the industry.
Let me just say though - adverts can still support free content without all the absolutely scummy things the adtech industry does. You don't have to track users across everything you can possibly track them across to still make money - my former company at one point was going to partner with Shazam to track people via transponders in bus-stop / train station billboards.
That's not "supporting the free Internet", that's "making some amoral shareholders richer".
Hopefully you'll figure out the difference with a few more years under your belt.
Most free works on the web is produced by users who receive absolutely zero ad money or any direct compensation whatsoever.
If anything, the ad industry helps kill honest contributions because they financially reward dishonest ones who are better at playing the SEO game or other such tactics than they are at giving visitors what they are actually looking for.
And at the end of the day, ad-supported content isn't free at all because we all pay for it in the end - and much more than what the website receives because there are entire industries inbetween that take their cut.
This argument reminds me of when I dealt with telecommunication providers in a law enforcement context.
Their argument was often that the complexities and volume of data, messages, devices just made it impossible for them to help law enforcement even when justified. Almost as if they were apologetic -- they simply cannot help!
But I was in a room once with a very senior police official, prosecutor and several telco reps when the simple question was asked: why is it not impossible then also to do billing?
Every time the conversation moved away from this point, it was forced to return by the non telco members: they knew it would cost money for the telco to help. And any argument against that was simply foregoing that cost at the expense of the safety or well-being of the public, and was unacceptable.
You may feel (in my example) their are many arguments against state surveillance, but the core truth is that all of these ad providers could indeed have systems that at least attempt to prevent this kind of activity -- it would just reduce profits to do so.
Lastly on the zero click lack of detail: it's kind of irrelevant. The exploit might be complicated, but the vector is clear -- the ad network.
> The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.
It read to me like it was assumed to be using OS/browser/application-level exploits to get further access to target devices. I suspect the CitizenLab report is light on details in particular because they don't actually know them:
> In most cases, the user who sees the ad is not selected for targeting, and the server will not return any JavaScript to be executed.
> A large number of ads placed by Discover-Tech contain a script tag pointing back to what the company refers to as a “NOAS server” (also called a “getAd server”). This tag causes the ad, when rendered, to connect back to Discover-Tech, submit advertising identifiers for the user (either a cookie ID or a mobile ad ID), and automatically execute any JavaScript code returned. The NOAS server decides, apparently based on a combination of the source IP address and the advertising identifiers, whether the target is eligible to receive any JavaScript. If so, then code is returned. If not, a 0-byte response is returned. The NOAS server is a key part of Discover-Tech’s strategy, allowing Discover-Tech to avoid directly sharing malicious code, or even pointers to malicious code, with the companies who serve and display the ads.
I think the simple argument here is that the ad ecosystem should be rebuilt on the default assumption being that ad creatives should be an image and a link with no support for arbitrary rich content.
It would break the long tail of the ad ecosystem, but a bunch of people think the tradeoff is fine.
Given how much of online advertising is now in walled gardens rather than display ads, I think this shows this is more doable than the people who are part of the open ecosystem want it to be.
I and many people believe that google intentionally chooses to keep harmful ads (deceptive, scamming, or leading to malware) this is because it's often very blatant and often survives being reported
Google is able to provide an AI-generated answer for every query, yet somehow can't use the same AI to check whether the sponsored result is an obvious scam.
Not sure why this guy is getting a lot of shit. I play at adops, but I haven't done much with it since we set everything up.
Ads drive the internet. Sorry, but it's true. And you, the technical people, have no real idea of the scale. I don't like ads, but was amused when I had to turn off all my blockers to get stuff done. Many people in the adops world dislike ads, but money.
The point he's making is simple: the ad networks are not responsible for the ad payload. And you might argue the point, but your arguments are worthless. Even finding the entity responsible for the payload will be difficult, and they're probably overseas. Are you going to sue them? No, you're not. Can you actually prove damages, even if you did decide to sue? Probably not.
The structure in the article sounds nefarious, but it's literally the adtech stack. The only thing the company must be doing that's abnormal is tracking all the users in one specific IP range and associating it was a company, likely with their emails. I never touched the targeting section of the stack, but I presume that's possible but not "normal."
Israel has been a nexus of cybercrime for as long as they've been on the internet at all.
https://en.wikipedia.org/wiki/Download_Valley
It was so successful that IronSource, one of those companies, ended up merging with Unity and I think they got like 25% of the company: https://en.wikipedia.org/wiki/IronSource
holy cow
How was I not aware of this. Concerning.
Games are an underrated vector for similar campaigns.
Edit: for the doubters, malware-via-game has already been happening https://www.malwarebytes.com/blog/news/2025/07/steam-games-a...
They've also been a nexus of cyber security: Palo Alto Networks, Checkpoint, Wiz, etc are all Israeli companies.
The Ones Who Sell The Panic Sell The Cure.
Palo Alto used booth babes in 2025. I have zero respect for them since that.
Are you saying there's no work for both babes either? What a dry market!
Palo Alto Networks is not an Israeli company. But it has acquired many Israeli companies
the founder is !
The founder was former checkpoint engineer and unit 8200 in Israel. It isn't HQed in there but there are ties.
It's the same skill set, many acquire it via the IDF, so unsurprising.
Specifically Unit 8200, which really has no counterpart elsewhere in the world given Israel's mandatory universal conscription. Imagine if you could systematically screen every young adult in a country, identify those with the strongest math/quantitative skills or promising deep tech skills and divert them into one single security special ops org for several years. You'd get the concentration of skill that Unit 8200 has been producing.
I don't see why other countries couldn't do this? Doesn't Russia kinda do this as well? Its a matter of will.(Just my opinion).
Does Russia have mandatory *Universal* conscription? I didn't think they did. Maybe recently?
North Korea does this too, actually (and like Israel, for both genders). It's probably one of the significant reasons why NK has such a comparatively effective offensive cybersecurity group, despite how unlikely that would seem given their overall industrial capacity.
NK likely also gets a bit of a boost because of the extended length of mandatory service. Males on technical teams have to serve for 13 years.
Russia has historically not had mandatory universal conscription.
Which is surprising that these organizations have trust; like our employers probably wouldn't be comfortable shipping all their code to / embedding agents from cybersecurity firms in Russia
That explains a lot. You're basically just fishing for downloads in your target networks. You don't actually care if anyone clicks the ads in the installers, the sole purpose of the adware is to get arbitrary software running alongside the installer, so that you can compromise their machine.
Also affordable generic drugs. YMMV.
Why do some of the most evil tech companies, especially ones that use exploits and zero-days as part of their business model, disproportionately originate from the same small (population-wise) country? The company from the article, all the other examples everyone here lists, Candiru, NSO... All Israeli.
Seems pretty straightforward. If you are surrounded by adversaries that vastly outnumber you, you invest in other forms of strength
Its easy to be surrounded by enemies when you keep giving them reasons to hate you.
Palestinians aside, what reasons do neighboring countries have to hate Israel from it's very first moment?
A lot of the immediate neighbors attacked Israel at its birth, and further away countries just seem to hate Israel due to religion/ethnicity/populism (?), countries like Pakistan, Malaysia, etc.
> Palestinians aside,
That easy huh
> My friend recommended a documentary to me recently about Hitler. It was about Hitler's atrocities. But my friend, god love her, she couldn't think of the word atrocities. She tried to cover for a second; she went "ahhh—" while she searched for a synonym, but it didn't come out right.
She said, "Gary, I saw this very interesting documentary about Hitler's shenanigans." [audience laughter] Shenanigans! [he chuckles] Not even close!
And, as a Jew, I'm obviously not oversensitive, but when people trivialize Hitler's monkey-business... [audience laughter] When the Nazis' hijinks, tomfoolery, and ballyhoo is understated, I feel it does a disservice to the millions who were, ahhh, inconvenienced by Hitler's mischief! [audience laughter]
Tomato, tomahto. Shenanigans, genocide.
(Gary Gulman bit)
https://youtube.com/watch?v=d4pOPNUcHNc
Ethnically cleansing Palestine is reason enough to hate Israel. As an American I’ll add that I hate their influence on my country via bribes and blackmail, and how they strip my rights (anti-BDS laws…) and steal my tax dollars. Spying on everyone via things like the OP don’t help either.
hah, I've got something for your anti bds law if you're put in front of court:
funding Israel violates the separation of church and state.
You don't even need to go that far. These anti-BDS laws are clearly against the constitution and get struck down without issue. The real problem is that it's much easier to create these BS laws and put them on the books than it is to repeal them, because repealing them requires court challenges, lawsuits, and then these supporters go and make alterations to the law to meet the criteria of the challenges and ram them through again. Then we go through this whole cycle all over again. To solve this problem, you really need to go after the public officials that are being pushed to pass this garbage by consistently holding their feet to the fire and not tolerating this with punishments of losing their elections. The country is shifting towards that, but there's so much BS going on elsewhere that this takes a back burner in people's minds.
Well, Syria and Lebanon both hold some pretty serious resentment over the recent landgrabs. With the whole "acquiring buffer zone for the buffer zone" business in former and the population expulsions in the latter.
But they hated Israel before the recent land grab, right? And they seem less bothered by the much bigger Turkish land grab.
I answered your question, no need to move the goalposts. Countries usually don't like having their land occupied. As far as I know the Turkish occupation zone in Syria has been dissolved.
The original formation was a land grab. Jews owned 6% of the land in Mandatory Palestine in 1947. The other 94% was ethnic cleansing.
But if that were the cause why do countries like Malaysia and Pakistan have diplomatic relations with let's say a country like Australia?
I dont understand the analogy but none of those countries are committing ongoing massive human rights violations or apartheid conditions?
> The other 94% was ethnic cleansing.
That's not really an accurate characterization of the situation as much of the land was uninhabited/unregistered and/or state owned. The Negev desert for example is a large percentage of the total land area and was effectively uninhabited and not privately owned. Land ownership records at the time were also not particularly clear and often there were disputed claims. Also Israel has about 20% Arab/Palestinian citizens so it's not like they ethnically cleansed everyone like Egypt/Jordan did with the Jews in Gaza and the West Bank when Israel gained independence.
Indiscriminate bombing of innocent people, maybe?
https://www.bbc.com/news/articles/cwylx1vq18zo
Your comment makes no sense whatsoever. Moreover your account was created minutes ago. What time does your shift end?
The whole idea of Greater Israel would make anyone in the region queasy. The logic is pretty hard to dispute when Israelis claim the lang is God given. The "God given" land actually extends much farther beyond Israel's boundaries so I'd say people of those countries are rightful feel as they do.
Like immagine if the rhetoric of Turkey was constantly talking about expanding to Greece and how the land of Greece is historically the Turks. Obviously that would make any Greek uneasy.
The Turks would never dream of irridentism, expansion, a Blue Homeland, the destruction of neighbouring peoples or neo-Ottomanism. Absolutely never.
And the Greeks are historically famous for being quite laissez-faire when it comes to their eastern borders.
source: https://www.youtube.com/watch?v=qsbm-YGRmCs
Seeing how things have played out this year, maybe this will end up being their undoing. Israel has made it clear that the next domino to fall after Iran is Turkey. I don't even know how that would work. Isn't Turkey a NATO ally? At some point, this has got to stop. After everything that's come out this year, I wonder if an alternative world where a lot of these Middle Eastern countries developing into stable democracies could have occurred had Israel been contained or never been created.
The idea of “greater Israel” is a bogeyman that lives in the heads of people that hates Israel in several factors of greater numbers than there are people in Israel who believe that.
You can literally count with both hands the amount of people in Israel that advocate for “greater Israel”
Few countries have given back so much land for peace. Consider of the percentage of land returned for peace with Egypt.
Israel refuses to even define its borders. And current behaviour demonstrates why.
> Israel refuses to even define its borders. And current behaviour demonstrates why.
States like Israel formally define their borders via mechanisms like peace deals that include bilateral recognition of agreed upon borders, like Israel has with Egypt and Jordan.
You can't realistically define borders properly otherwise, trying to define borders via unilateral declaration doesn't really work when there are 2 states next to each other, the borders ultimately need to be negotiated bilaterally between those states with both sides recognizing the same borders.
Because Israel invaded a land that had been settled by Arab Muslims for centuries, claimed a portion for itself exclusively, proceeded to ethnically cleanse an even bigger portion, all with the support of their extremely powerful western backers. Asking "why did the others hate them" is like asking "why would Europeans hate the Chinese if they had invaded, settled and ethnically cleansed half of France (with the promise of taking even more later)"?
The Shia from South Lebanon still remember the seven Shia villages in Palestine that were ethnically cleansed by Zionist forces in 1948. [1]
It's still a major propaganda point for Hezbollah.
[1] https://en.wikipedia.org/wiki/Shia_villages_in_Palestine
You're right. Never in history and never anywhere else in the world have Jews been persecuted.
It isn't really unique to Israel, though. There's conflict practically everywhere where major cultures/religions have drawn up borders, or within the backwash of fading empires (Britain, Ottomans, Soviets, French...).
https://www.cfr.org/global-conflict-tracker
None of those have as much impact on Americans day to day life as Israel does.
Lets zoom out: The whole world is about to enter a massive economic calamity, all because Americans got tricked into to electing the current knucklehead in the White House who took a ~$300 million bribe from an Israeli supporter to start this war.
None of those other conflicts will affect the entire world as what Israel has done.
> all because Americans got tricked into to electing the current knucklehead in the White House who took a ~$300 million bribe from an Israeli supporter to start this war.
From what you've said. It sounds like America is to blame here, tbh. $300mil is chump change in international bribery/development. If your establishment sells itself so cheaply, that's on America.
Besides, what's happening in Iran is minuscule compared to what happened during the 'War on Terror'. Play imperial games, win imperial prizes.
Agreed, the system needs reform so a country the size of Slovenia can't dictate US actions so easily. Reform is hopefully coming but too slowly.
>Besides, what's happening in Iran is minuscule compared to what happened during the 'War on Terror'. Play imperial games, win imperial prizes.
Disagree, Those wars were confined to an adversary that was already a few rungs down on the ladder and couldn't crash the world economy. Iran is larger than Iraq + Afghanistan combined, has very large mountainous terrain which has a lot of easy hiding spots for drones/launchers, has the fourth largest collection of trained staff in the field of nuclear science (more than France) and even became space launch capable in 2009.
Thats is like night and day difference between Iraq/Afghanistan.
I agree with what you're saying, but I think you're discounting the geopolitical impact the War(s) on Terror had.
America needed to push cheap credit to boost confidence after 9/11, oil prices skyrocketed and haven't really come back down, hugely expensive wars were funded on debt. It's arguable that these all directly contributed to the GFC in substantial ways.
Global confidence in American leadership plummetted since these wars, and opened the door for China and 'multi-polarity' to enter the stage which has caused a new wave of proxy wars as powers are trying to get a piece of the new round of global empires. We have Russia making moves (apparently also kickstarted by Gadaffi's death), UAE and Turkey playing games in the Sahel, dicerolled team selections in Libya, China testing the waters in Myanmar and Laos, fuckeries in Venezuela and Cuba, Syria, Azerbaijan....
If anything, Israel have been baited into their current actions just like America were as new and old powers try and undo 'centuries of shame', etc.
Americans didn't get tricked into electing Trump. Don't let Americans off the hook like they're naive schoolchildren. Americans knew what Trump represented, they were warned vociferously and repeatedly about him, his entire life and his public opinions have been well documented, and he isn't exactly subtle or capable of duplicity.
Jan. 6th wasn't enough to disqualify him from a second term. The Epstein files weren't enough to get him removed from power. ICE wasn't enough to get him removed from power. Blatant disregard for the courts, threatening allies, arbitrary and insane tariff policies weren't enough to get him removed from power. No President in the history of the United States has been as secure in his position as Donald Trump is. The Supreme Court even went out of its way to make him immune from prosecution for any crime he might possibly commit while in office.
Israel may have (probably did) talk Trump into the war but Americans are the reason Trump was in that position to begin with, and he is there because Americans want him there.
>Americans didn't get tricked into electing Trump. Don't let Americans off the hook like they're naive schoolchildren.
The fact that they are still trying last minute fuel price manipulation in the hopes of converting some people into Trumps good graces proves that you are wrong. The country is very large. In 300+ million people you will find a large distribution of people in terms of skills and ability to discern fact from fiction. The bottom 10% of the distribution is still ~30 million people. Some % of these people vote. Lets not even consider the bottom 50% percentile.
>Jan. 6th wasn't enough to disqualify him from a second term. The Epstein files weren't enough to get him removed from power. ICE wasn't enough to get him removed from power. Blatant disregard for the courts, threatening allies, arbitrary and insane tariff policies weren't enough to get him removed from power.
You are conflating two different things. This is a failure of the system. This takes time to reform. There are attempts going back years. When you have so many layers of people who benefit from the existing status quo the only way you speed up the fix this without decades of sludging through roadblocks is if a national calamity happens that finally forces change(economic or other challenge). Otherwise too many people are insulated from the downsides of the system until they aren't anymore and then something changes.
>but Americans are the reason Trump was in that position to begin with, and he is there because Americans want him there.
Objectively this is a stated fact (unless you believe the election was rigged). But it glosses over so much nuance and context.
Russia didn't create Trump. They're not solely responsible for Trump.
The same can be said of Brexit, Victor Orban, AfD, etc. All of these bad things were, nevertheless, boosted by Russian ops with the same general strategic goal in mind.
My point is that being at war with your neighbor(s) is not a unique situation, but only Israel has acquired such an extreme abuse-through-tech slant because of it. Why?
My guess (not any more informed than anyone else's) is that it's because they absolutely need US support, and intelligence is one of the few things they could offer them so they invested _a lot_ into it
One factor is that Israel generally refuses to extradite their citizens who are accused of crimes in foreign countries. So they effectively operate with a certain level of legal immunity.
Yes, in general Israeli intelligence and hacking groups tend to enjoy far fewer consequences when they screw up than their Western counterparts, which then allow them to be far more aggressive.
I was only really aware of the many high profile cases of sex offenders exploiting this, I never thought of the cybercrime angle.
The perpetrator of the viral "you're stealing my house," "if I don't steal it someone else would steal it," video was purported to be an alleged sex offender who fled to Israel to escape charges.
I don't know if that's true since I haven't seen any evidence for it, but I would not be surprised.
If there is no punishment for shooting school kids with a sniper rifle, there isn't going to be punishment for any lesser evils.
hell and america will send israeli's that commit horrible crimes in us territory back to israel before anyone can actually consider prosecuting them.
It isn't all Israel. North Korea, Russia, and Iran have long been known to be where most cyber crime comes from. Israel is there, but they are an also-ran compared to the others. (but Israel does tend to have more sophisticated attacks). The US also has done a large share, but mostly that is government attacks on other governments (that we know of).
Israel has a lot of enemies that going against them. Which is why they have incentive to be good at this - to attack back. Corporate attempts are just ways to make money.
I'm going to stay out of the political issue of what any actor should do.
This is true, but as far as I know, the other countries (except the US, which however is far larger than Israel) keep their cyberwarfare operations mostly internal. There's no public Russian company accessible to any Russian that does what the example companies above do, for instance. It's all government-led. So is the existence of these companies some outcome of the legal or financial system in that country?
>Israel has a lot of enemies that going against them.
Why do you think that is?
lol downvotes
antisemitism
>antisemitism
Certainly some is antisemitism. To imply, as you have, that there is 0% legitimacy to any other reasons to hate the behavior of the current Israeli government is just as pro-genocide as you claim antisemitism.
Most people I know who oppose Israel's actions in Gaza have no problem with Jewish people; many themselves are Jewish.
Israel is not a religion.
True, but it's the only Jewish state.
Speaking as an escaped Christian fundamentalist -- religious faith and religious nationalism are actually two different things.
No religions are states, that is just your political opinion. I think it's a really toxic opinion because it then leads to the question of the potential allegiance to a foreign nation of anyone based on their religion. This is the same reason why a Catholic president was once controversial, because back then people believed there was a Catholic state secretly controlling them.
In my political opinion Israel is an artificially created state which is why it's so unstable and we should simply walk away and cut our losses on this. I believe my opinion is the prevailing populist opinion too so y'all have to contend with that.
There needs to be some compromise between our points of view or else we'll continue to get more war and violence. I think our country needs to recognize our responsibility for this mess and should offer land in North America of equivalent value for any Zionist refugees and then leave the poor people of that land alone. I ultra extremists would feel right at home in the Catskills lol.
Maybe they should work on seperating that like all modern democracies have.
But North Korea, Russia, and Iran isn't supported on our tax dollars. In this case we're literally paying another country to infiltrate ourselves.
>North Korea, Russia, and Iran
...are also widely considered bad actors. Yet, it isn't "islamophobia" when you criticize Iran or "anti-Orthodox" when you call Russia to account.
Curiously, however, when you similarly criticize the actions of this specific Israeli government and its leaders, you are slandered with the term "antisemite" and there are orgs that exist to doxx you and get you fired from your job.
Isn't that weird?
> I'm going to stay out of the political issue of what any actor should do.
Thankfully, in many such cases, we can call the skyman to rescue:
https://www.chabad.org/library/article_cdo/aid/689306/jewish...
'I'm not racist against blacks, I'm just pointing out crime statistics in certain communities' vibes
If that's your first instinct, then by your standards no country can be criticized for much of anything. After all, pointing out the negative outcomes of a purposefully designed system is the exact same as prejudice based on immutable birth characteristics.
No country's people should be blanket stereotyped. That's my first instinct. 'why are people from xyz nation more likely to be associated with(negative thing)....'. nah, fuck that kind of talk.
Where did you see me saying that? I didn't even mention any people or generalize that all of them are this or that. Saying that cyberwarfare companies are more likely to be in Israel, which is what I did, seems like the most objective way of framing my observation. Other replies already gave some good reasons for why that may be, and all of them have to do with the systems built within the country, not some inherent property of their people. They could change these systems if they wanted to, it's not inherent to them.
Right, this discussion totally isn't being used as a bash Israel/isrealis as inherently bad with lots of blanket statements.
>Right, this discussion totally isn't being used as a bash Israel/isrealis as inherently bad with lots of blanket statements.
I see lots of (maybe un-carefully-worded, maybe?) bashing of the actions of the current Israeli government, and its defense forces and intel apparatus.
That's 100% fair game, anywhere on the planet.
What's I don't see is the rank antisemitism you claim, except for a few outlier recently-created accounts.
The most despicable thing I see at scale in the conversations is the attempt to silence critics of Israel with slanderous accusations of antisemitism. It used to work, as a tactic, but it (like the "racism card") has been vastly overplayed and is rapidly losing its value.
Ah I shouldn't call out what I think is racism because 'it doesn't have impact' anymore. Nah. You think labeling nations /communities and by extension their peoples is fine. I don't. It's simple as that.
I didn't attempt to silence anyone. I simply called out what I see. Silencing is what HN does when they moderate the Ukraine Russian discussions different than their newer standard for Israel Palestine.
Your fair discussion distilled:
https://news.ycombinator.com/item?id=50112408
"it's the shiftiness of jews'. Racism doesn't exist anymore, and calling these discussion anti-semitic is me just shielding isreal as a tactic. Fuck off.
If you think that one person's comment is the distillation of the whole thread, then you're not paying attention to the rest of the thread (or very knowledgeable about statistics). I clearly acknowledged the existence of antisemitism in these discussions, but also that it is an outlier. Good job, you found the outlier! Hooray!
>Racism doesn't exist anymore
Who said that?
>calling these discussion anti-semitic is me just shielding isreal as a tactic.
Yes, when the discussion is about the current government of Israel, the IDF, its intel apparatus, and their actions.
>Fuck off.
When you have no point, use anger.
> "it's the shiftiness of jews'. Racism doesn't exist anymore, and calling these discussion anti-semitic is me just shielding isreal as a tactic. Fuck off.
Can't find the quoted phrase in the referred comment: did you just make it up or did he edit it out? Other than that, he made some observations about Judaism. Off-topic perhaps but nowhere near racist. Fuck off.
I went out of my way to write the comment in as neutral of a tone as possible. I didn't even state my opinion on Israel or anything it's involved in to avoid starting a flamewar in what would otherwise be a standard question about adversarial technology and cyberwarfare. The only expressed opinion was about the companies themselves, which I think it more than warranted. Yet, as I said in a sibling comment, people are seeing ghosts anyway and disregard the perfectly normal question because they think I'm not really curious about it and am asking it for nefarious reasons.
again 'I'm not racist, I'm just connecting the dots around crime statistics in an impartial way'. This thread was filled with all kinds of nefarious stuff around the same topic at the time I posted, and of course was disclaimered as 'totally not anti-semitic' even though time and again jewish people have said the discussion around IP often veers into 'the stereotype is deserved' and 'if American jews don't like it they need to distance themselves from Israel more' (a race now has to take affirmative action to show they 'are the good ones'?) and that that does in fact feel anti-semitic to them. But then the 'anti-zionsim' card gets played (with zero explaination of what anti-zionism means exactly, does it mean a nation of 8 million jews, the majority left on the planet, just gets wiped out and jews what? Go where? ) and it can't be anti-semetic to say 'the steretype is justified' and 'you need to prove you are one of the good ones by stating publicaly your opinion on something half way around the world'.
here's a nice response for you 'it's the shiftiness of jews'. There's your totally not racist as fuck/antisemitic dot connecting.
https://news.ycombinator.com/item?id=50112408
I kinda wish these threads wouldn't get 'cleaned up' so we can see the actual totally 'not antisemitic' HN discourse plain as day. I'm sure the above comment will get removed/cleaned up and you can go back to 'connecting the dots around crime statistics isn't a core part of racist cannon'.
Oh well, each individual must be judged on their actions and merits, but this doesn't prevent us from observing how groups behave on average. Nobody ever shouted racism when it's said that French are chauvinistic or that Germans follow rules strictly- it won't and shouldn't tell you anything about single individuals but you know there's a grain of truth in the generalisation.
Ah the good old 'I'm just noticing crime statistics'.
Opposed to noticing what else? Vibes? Sound a lot more racist than factual and provable realities based on real data.
Finding an understanding patterns and acting according to them is the most logical and natural thing a human or any life form can do. You would call someone speciest for not hugging a bear just to feel ideologically pure.
I'd rather have nations be held accountable for being bad global participants than hiding behind cries of -isms. Israelis can always elect a better government if they don't like the stereotypes the current one earns them.
You might also look into the tale of the boy who cried wolf. The more you keep shoutin "antisemtism" in an attempt to shut down criticism the more people will learn to just ignore that word or ascribe to it a meaning far different from the one you want.
I get it, anti-semitism doesn't exist because 'Israel bad'. But also, as you state, the stereotype is earned.
Yes, and?
In this book, they explain that it's because this industry is de-regulated:
Pegasus: How a Spy in Your Pocket Threatens the End of Privacy, Dignity, and Democracy by Lauret Richard
The same reason why many great tech companies originate from Israel. That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
But something tells me that the way you framed your question, is not about the companies and more about you and how you view Israel.
I in fact tried to word this as neutrally as possible, but people are already seeing ghosts just because it has a hint of negativity towards the country, which should be expected because most people agree that these technologies are not actually good for the world.
> The same reason why many great tech companies originate from Israel. That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
You never said what the reason for that is. Their society doesn't seem more tech-oriented than comparable countries. Their universities are OK, but not the best in the world. So what in their society caused this?
Careful. The trolls are out. Half of them are trying to prove Israel is a nation full of demonstrably evil people, and half of them will tar you with antisemitism if you don't love Bibi and all his works.
This bullshit polarization of ideology ruins civil discourse. It's possible to condemn Hamas' slaughter of innocents, and condemn Israel's slaughter of innocents. And to still realize there are innocent Palestinians and Israelis who are not working to make things worse.
There are answers to these questions but they will put you at odds with those who hold to the other position.
Simply asking the question is going too far for most.
Paul wrestles with this in Romans 9:6.
It’s a mix of culture and army bias.
Culturally, Israel has a strong emphasis on entrepreneurship, coupled with general lack of tolerance for bureaucracy, makes for pretty agile organizations.
In the military side, it creates a country sized funnel that picks the best people and places them together trying to solve problems that would seem impossible. When these people are discharged, they are friends that knows how to work best together. Think of it like a larger and more focused version of an Ivy League school
> The same reason why many great tech companies originate from Israel.
wait - what's the reason, though? i don't understand what you're trying to say.
> That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
you cite two american companies with presence in Israel to defend your claim that "many great tech companies originate from Israel".
> is not about the companies and more about you and how you view Israel
your entire response is predicated on your view of Israel but you haven't explained what your view actually is or what it's based on.
Because they are the best at spying in the world by far, and are willing to splash the cash. They're what Silicon Valley would have been if it kept doing government contracts instead of just selling ads.
If Mossad is willing to give you a hundred million to make your startup a spyware company, you're obviously going to agree.
> If Mossad is willing to give you a hundred million to make your startup a spyware company, you're obviously going to agree.
what a sad take.
Their military is very good at cyber-warfare. The gap has narrowed in the last decade, but before that there wasn't even a distant second, maybe Russia. People serve in those units, acquire very useful and specific skills, then start companies that offer commercial variants of cyber-warfare, or become subcontractors for other governments.
They're even better at sextortion. Jeffrey Epstein is the posterchild for their efforts, along with his Mossad agent father-in-law Robert Maxwell, and handler Ehud Barak. It's likely that many of Israel's "triumphs" over the last few decades were less a result of hacking and more a result of blackmail, similar to the FSB/KGB.
Like Monica Lewinsky, for starters?
They probably didn't arrange for that affair to happen, but they did use it for blackmail nonetheless.
Mandatory military service, too. You have to imagine that the US would have a similarly disproportionately-scaled cyber-warfare industry if it also had mandatory military service and good sorting of capable people into those units.
Because those are typically created by ex-military people who had become civilians and now they need to make money with the skills they have.
OK this might be a wild (conspiracy) theory, but what if Israel is just an arms-length scape goat for the US?
That country has long been known as a haven for American pedophiles/criminals who end up fleeing the country.
> a haven for American pedophiles/criminals who end up fleeing the country
Only Jewish pedophiles & criminals. Israel will not let in random non-Jewish criminals to flee prosecution, only those who are provably Jewish are granted citizenship and non-extradition.
This is where the wall broke down for me. Criticizing Israel is okay, but criticizing Jews is not. However this is one example of being "above the law" which affects all jews, not only israeli citizens.
I'm trying to be nice here, but yes, it's a racial nationalist policy. We don't have many of those countries left in the world.
> We don't have many of those countries left in the world.
It's fairly common in Europe[0].
[0] https://en.wikipedia.org/wiki/Jus_sanguinis#Leges_sanguinis_...
There are many ways in which Israel differs. For one it's a 78 year old colony that excludes the indigenous Palestinian population from returning to their ethnically cleansed homes. They also allow people to convert to Judiasm and enter, so it actually has nothing to do with their ethnicity and is solely based on religion.
>The Law of Return offers citizenship to Jews wishing to immigrate, as well as non-Jews with at least one Jewish grandparent (see "Who is a Jew under the Law of Return?"), as well as their spouses
This is clearly a racial ideology.
I agree it's racist, but they also allow converts:
> Converts to Judaism who wish to immigrate to Israel are evaluated on a case-by-case basis by the Israeli Interior Ministry, which determines whether the conversion was sincere in its view
That makes the policy sound gratuitous.
From https://masaisrael.org/law-of-return-israel
Had Israel been predicated in any way legitimately on the holocaust as their founding mythos, they certainly would not be engaging in genocide.
They are certainly not engaging in genocide. The population of Palestinians has increased by 5% over the past 3 years. Even the population of Gazans has not decreased.
https://www.ohchr.org/en/instruments-mechanisms/instruments/...
It is not a great law but it is what genocide is agreed to be and it is not based on amount. It's all about intent which is very hard to prove.
I wasn't making an argument for or against the legitimacy of Israel; I was arguing that self defense explains Israel's immigration laws better than a sense of racial superiority.
It's one thing to accuse Israelis of paranoia, hypocrisy, or even genocide, and it's another to deny that the primary motivation to have Israel be a jewish ethno-state was to have a refuge from persecution.
Do the lies ever end? Nobody believes this.
Talk to any Jew who has left the cult; they’re huge racists foundationally, no group is comparable.
It isn't clear if the accusation is that I knowingly am telling lies, or that I am gullible and repeating lies. Either way, we could go back and forth all weekend and probably still not agree on much. Cheers.
> For one it's a 78 year old colony that excludes the indigenous Palestinian population from returning to their ethnically cleansed homes.
The ethnic cleansing that happened when Israel gained independence was not in just one direction, Israel also did allow plenty of Arab/Palestinians to stay and gave them citizenship where feasible. It's not surprising however that Israel doesn't currently offer citizenship to a population that largely doesn't think Israel should even exist. States don't normally give citizenship to their non-citizen enemies.
> They also allow people to convert to Judiasm and enter, so it actually has nothing to do with their ethnicity and is solely based on religion.
It's not solely based on religion. It's also quite rare for people to convert to Judaism in general so that exception has little practical implications.
Guess where the company big AI labs are using for security sandbox is from? The one that was involved in both big hacking scandals from "rogue agents" by OpenAI and Anthropic?
There's a reason for that. Israel is a test bed to remove freedoms world-wide through digital surveillance.
It is standard that companies within a country act in the interests of its security services. Israel has a lot of ad-tech companies and thus it makes sense that they are roped into serving Israel's security services.
It is no different that Israel's location tracking of StarLink terminals worldwide: https://www.newarab.com/news/israel-tech-firms-can-locate-an...
This is the same issue that the US government has with Chinese networking companies, it is too easy for the Chinese government to pressure these Chinese networking companies to put in back doors in the interests of national security. The US likely knows this because it pressures its own companies in similar ways.
Bills like the US CLOUD Act (there are similar ones in the EU and China) force service providers to illegally spy on people overseas (via unauthorized use of anything they can access—consider Microsoft’s Windows backdoors).
I think the only technical solution available to individuals is to boycott non-verifiably e2ee services and corporate operating systems (especially including android).
A few weeks ago the FBI tipped the Argentinian police that some 15 year old kid from buenos aires province had asked chatgpt for ideas to plan a school massacre.
just to confirm your info... https://buenosairesherald.com/society/argentine-teenager-pla...
In the interest of balance, how many times did the FBI snoop into innocent people’s private lives with no warrant or worse, goaded some weak-minded individuals into planning crimes together in sting operations (i.e. people who needed convincing to commit the crime, so not quite clean but not the masterminds either)?
If you put out a fire how many are you allowed to set while people applaud selectively?
I don’t think they’re striking a good balance between how invasive they are compared to the real results they deliver.
to be clear: I'm against this "pre-crime" FBI bullshit. it's overreach.
> I think the only technical solution available to individuals is to boycott non-verifiably e2ee services
If the world moved that way overnight, I wonder where digital spy budgets would go. Into traditional techniques, cracking encryption, banning encryption, or a more educated guess?
Banning encryption. The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia!
It's not "illegaly spy", it' just spy. National security laws make sure that these requests are all legal - from that particular country's point of view who is forcing the provider to supply the info... and illegal from all the other country's point of view. The root of this problem is that nation states have the final say in what they consider legal. But that difficulty is by design and is very difficult to fix.
Difference being we're pretending that Israel is a democracy that values human rights, so nobody makes a real stink about it, unlike with China.
Only the national brass is pretending at this point.
Why Israel is not a Democracy?
Israel was created by ethnically cleansing Palestinians during the Nakba. That's not a democracy, ethnically cleansed Palestinians aren't even allowed to live on their land, let alone vote. That's not including all of the Palestinians that have been straight up murdered.
In addition Israel is an apartheid state with many undemocratic features:
https://static1.squarespace.com/static/66a134337e960f229da81...
> ethnically cleansed Palestinians aren't even allowed to live on their land, let alone vote
America was a democracy while we were exterminating our native population. Democracy is a system of government. Voters can democratically vote for terrible things.
Israeli Arabs are allowed to vote.
> Israel is an apartheid state
This is a valid argument, though still stretched–America didn't cease to be a democracy while we occupied Germany and Japan.
Murdered people can't vote. People forced off their land and over an artificially created border can't vote. Israel is no democracy.
> America was a democracy while we were exterminating our native population.
I would argue that it was not for the very same reasons (and of course there were many other classes not allowed to vote at the time). Killing someone robs them of their right to vote.
> Murdered people can't vote. People forced off their land and over an artificially created border can't vote
Sure. But this also describes a lot of well-accepted democracies' histories.
Perhaps you're thinking of a liberal democracy?
> would argue that it was not
Sure, according to a personal definition that countries cease to be democracies any time they go to war (or more narrowly, commit war crimes), Israel is not a democracy...
> there were many other classes not allowed to vote at the time
Most democracies also prohibit children and non-citizens from voting. The term you may be looking for is full democracy. And I think most people and experts agree Israel is not a full democracy [1].
[1] https://en.wikipedia.org/wiki/The_Economist_Democracy_Index
> Most democracies also prohibit non-citizens from voting.
I mean we're talking about all Black people, Indigenous people and women! I think arguing semantics isn't helpful.
Israel is an illegitimate state practicing crimes against humanity. That some of the colonizers can vote isn't really relevant. I actually think this can help us reflect on the true nature of the US as well and push for things like land back to Indigenous people and reparations for Black people.
> we're talking about all Black people, Indigenous people and women
Yes. Athens was similar–a minority of the population could vote. It was a deeply flawed democracy, but a democracy nonetheless.
> That some of the colonizers can vote isn't really relevant
Literally America! Also all of Europe depending on when you draw the line. Also all of the Middle East for the same reason. (Also most extant Native American tribes.) Hell, even in Palestine we can only say more than 50% of the population traces from Bronze-Age heritage.
By your definition, democracy does not exist and cannot exist in most parts of the world.
> this can help us reflect on the true nature of the US
It really can't if we're redefining precedented terms. America, like Israel, is a flawed democracy.
> Most democracies also prohibit children and non-citizens from voting
In the case of Israel these 'non-citizens' are under brutal military occupation where each day Israel steals more and more of their land. There's no 'home country' they could return to because Israel is occupying it. They're not illegal immigrants. They ARE home and yet being treated by Israel like invaders.
> They ARE home and yet being treated by Israel like invaders
Which is illiberal and flawed. It doesn't mean Israeli citizens don't democratically choose their leaders.
Note that this cuts both ways. If Israel isn't a democracy, the Israeli people have no moral culpability in their state's actions because we have no way of knowing if they actually support it.
> There's no 'home country' they could return to because Israel is occupying it
Agree this is tragic. But again, historically not unique. Displaced people have existed across the history of democracy.
Something being wrong doesn't automatically make it all kinds of wrong. Israel illegally occupying the West Bank and Gaza and having unresolved reparations around the Nakba doesn't have much relevance to whether it's a democracy. Just whether it's a liberal or full one. (Among all of the other issues.)
Democracy doesn't mean voters can't choose to be awful.
By the way, the word "Nakba" is linguistically related to the Shoah, a.k.a. The Holocaust. If they admitted the Nakba happened they'd be admitting they did a Holocaust, so they don't admit that.
This is not the definition of democracy. You just invented something. Which is cool but is not relevant.
People in Gaza who are indigenous to Palestine cannot vote in elections occurring in Palestine. That's not a democracy.
Now you are also inventing history. People in Gaza voted to elect Hamas in 2006. Since then the PA didn't held an elections.
What it has to do with Israel?
This is abhorrent. Every government spying on everyone.. and who benefits from all of this?
Can we get an alien invasion already please, god
Except this isn't the security services they are serving it's a mercenary spyware vendor.
Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.
Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
I'm sure Google's latest push to make it inconvenient to install apps from outside Google's Playstore, where Google charges a 30% commission, is going to solve that.
> useless as a way to prevent people from being hacked
From being hacked by others. Google was just trying to protect their property, which is the ability to spy on their users' every move. Google themselves really don't need to "hack" their users for that, they already have all the access and all the data they could ever want. And they also have the ability to brick their users' devices at a moment's notice the same as Apple does.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Totally not useless. It costs a lot more to pay a spyware firm then to have an employee send an email / ask a judge (like that's even necessary).
I feel quite confident of my messages privacy on my Pixel with GrapheneOS given most people I message are on iPhones which are second in security to Pixels running GrapheneOS. Not to mention my threat model doesn't include mercenary spyware, as most people's doesn't.
>Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.
If you're talking about the sideloading restrictions those were intended to stop social engineering and scams, not from getting hacked via 0days.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Source? play services is privileged but not that privileged.
> If you're talking about the sideloading restrictions those were intended to stop social engineering and scams
No, those restrictions were intended to keep Android users in the playstore ghetto (which is suffed to the gills with scams.)
However, this hack could have happened whether sideloading was allowed or not.
In fact, following the OP's link to https://citizenlab.ca/research/how-discover-tech-turned-targ..., "the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries" so it's not just apps but ordinary websites you visit in your android chrome browser.
So there's some sort of Android/iOS vulnerability in Chrome/Safari that they're exploiting?
No info on if a recent version patches this?
It also mentions a "Windows DLL" - so they're somehow infecting Windows desktop too?
My understanding is that there are hundreds, perhaps thousands, of high impact vulnerabilities on Chrome/Safari. We don't get to hear about most of them because it would become tedious quickly.
Yes, Google's move to block people from installing software on their own devices is orthogonal to this. I was merely saying that some measures have massive negative effects and basically irrelevant positive effects in the grand scheme of things.
Is GrapheneOS affected?
It's really sad this got taken off the front page (347 points, posted 2 hours ago at the time of this comment). Israel is deeply intertwined with the tech industry and they use tech extensively in extremely hostile ways. It's relevant to this site discussion and the votes demonstrate that. There's no reason to hide the elephant in the room, let's address it, now is the time.
This is even crazier than the last time Citizen Lab found an Israeli zero-click spyware (Pegasus). You could call it a sequel
Don't call it a comeback, I been here for years Rocking my peers and putting suckas in fear
Is that the song from LL Cool J?
You were expecting Leviticus?
Y'all will be shocked at how much of the VPN space is owned/controlled by Israel.
https://share.gemini.google/DbWctQhiJXMh
my guy really linked his gemini chat as a source
As much as it sucks for the ecosystem that's built itself up around the world wide web, good ad blockers and fingerprinting protection are as important as firewalls and antiviruses now. There's no more babies in this fetid bathwater.
>During our analysis of the Controlium platform, we observed that the source code mentioned an endpoint called “/csv-download”, which accepted start and end date parameters. When we sent normal HTTP GET requests to this endpoint without any password, special headers, or authentication token, we received logs showing which users had logged in to Controlium, and from which IP addresses.
Absolute morons.
It's kinda funny that a website with an article titled "Online ads weaponised to deliver ‘zero-click’ spyware" immediately loads a splash that asks users with adblock installed to disable it.
The separation between advertising and editorial has never been greater. Brought to you by the marketing wizards who saw you bought a vacuum cleaner on Amazon and concluded you love buying vacuum cleaners so here’s some more.
The site works much better with JS disabled.
Aren't earliest government backed recommendations, to block all ads for security reasons, something like 20 years old? For example, this one: https://www.cisa.gov/sites/default/files/publications/Capaci... is from 2013. I am sure there were earlier I just can't find them.
"Researchers also recommend that users at high risk of targeting use ad blockers, disable ad tracking, and regularly reset mobile ad IDs.". Not "recommend". Everyone must use uBlock Origin or at least some type of ad blocker in every device.
Then also mandatory pi-hole on every house.
Even if you are used by Windows OS, you must use an adblocker. Even if you use Chrome. On every browser.
Yes. Browsing without an adblocker is analogous to driving without a seatbelt. Sure, you can do it - but it's a terribly unsafe idea.
Internet without ublock origin looks and feels horrible, something about insulting basic human decency with o slaught of ads desperately taking so much space.
If you work for an ad tech firm you are one of the baddies.
Ads providers should be held responsible for delivering malware. All the tracking (that includes fingerprinting for clients that do not want to be tracked) should also be illegal.
How is this acceptable for society goes beyond me. And then corporations blame individuals when they get scammed. It is your fault that we have all your information and leak it everywhere, when it is not just directly sold.
And add jail time to fines. Fines means nothing for the rich.
That would mean some google people going to jail...
Stop, stop, I can only dream so hard.
If such a thing were passed, it can't apply retroactively. But yes, google people would go to jail when they inevitably flout it as they are accustomed to doing. We should make this happen.
People in the US have a unique window of opportunity starting TODAY (Oct 2026) in many places with early voting. I implore everyone who is able to vote in the midterms to do so.
Which candidates support the "put ads providers in jail" platform?
You will have to look at the candidates in your area and do your due diligence. Its unlikely a given candidate will be perfect, but there is generally tremendous differences between them as far as overall posture on privacy and surveillance.
Not tremendous differences, mass surveillance of the people is one of the few issues that are truly bipartisan, but there's candidates better than others.
None of them, but if one did I bet they'd get support from voters and less bribes from the tech industry. As long as politicians value the bribes more than the support the people will never get representation. We should probably pass laws that stop companies from stuffing the pockets of politicians with money, but what politician is going to support a law that takes their bribe money away?
nah, you'll never get there that way. Even if there was willpower to do it legislating these things is too hard.
What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).
If they win the landscape will change. It would set a precedent for civil liability for infecting your users even when it's not your content directly. That would likely spook the shit out of the market, security becomes a feature.
Why the website instead of the ad provider? The website didn't server the ad. The ad provider did and should be the responsible part to ensure what it provides is not malicious.
Attacking a single website does nothing. If you bankrupt the site, there are millions more sites. If you attack the ad provider, bankrupting it, and shutting it down, millions of sites are now protected.
Your logic just doesn't compute
Seems to me the website is negligent and the ad provider is an accessory (e.g. helping to select targets for fraud), at the very least.
The website is signing up for a service. You could say that a website continuing to use the service of a known malicious ad provider is problematic, but are there any ad providers known to have not served malicious something?
I think you're also confusing multiple malicious activities occurring on the web. Data harvesting is another thing that needs to be banned into oblivion. Rarely are sites doing that natively. It is being done as a second part of service the site wants. A site/app wants naturally wants to seen analytics about how visitors are using the site/app, so they include some third party tool that provides that data to an extent at the cost of collecting/keeping that data for their own use. Want to make it easy for users to interact with social platforms regarding your site/app, they now get to collect/keep that data. That's a different thing than being served malicious ads.
The website is partnering with another business, often as their primary or only means of revenue. That is their entire business. This is not you signing up for a service like Netflix. It is a B2B partnership, and in fact, if you look at the direction money is flowing, they're the ones selling the service (surreptitious access to users' computers). It is their responsibility to choose their business partners and what ads they'd be running. If they're not doing any examination of what they're inflicting on their users, and just letting whomever's buying send whatever payloads they'd like, then yeah that's negligent at best.
"I'll pay you if you run this software on your visitors' computers without asking questions" is not a "service" you sign up for. People don't pay you as a service. That's about as shady a deal as it sounds.
Is a general contractor who subs out the electrical also blame free when the house burns down?
IMO the ad provider is fully at fault for allowing script tags and other potentially vulnerable features in ads. Why can't the ads just be static? I mean I get why they want it, but it should not be allowed, and IMO that's where the ad provider is almost fully at fault
Websites can set CSP to not allow ad providers to serve scripts. They're the ones adding those scripts to their page, and are equally at fault. Though static ads can still point people into a fraud pipeline, and websites running those ads should be held accountable for that too.
It's fully possible to individually negotiate with someone that wants to publish an ad on your site. If you choose to take money from literally anyone who wants to do so, then why would you not be accountable when they inevitably use you to target users for fraud? You chose to take their money and not even look at what you were publishing.
> The website didn't server the ad.
Sure it did. The content coming from elsewhere doesn’t change their decision to include it when the user loads their page.
It just makes the decision wildly important.
This is no different than the “I’m too big, can’t tell what my subsidiaries are doing!” wink
Pay attention, do due diligence to do things correctly, or don’t do them.
Ideally, you'd sue the website because the website is responsible for everything that shows up on the website they control, and the website would turn around and sue their ad provider because they paid that ad provider for a service that wasn't malware delivery and as a result of that ad provider's crimes (or negligence) the website now has legal costs and harm to their reputation.
It shouldn't fall on the person just going to a website to track down the vendors and third parties the website contracts with.
The lawyers should name everyone involved with unauthorized access to your computer as defendants , the obviously innocent parties can be dropped before it gets to trial.
I don't understand how you could arrive at this perspective. If you're doing business with ExampleCorp and one of their subcontractors malfeasantly mishandles things, would you say that ExampleCorp had nothing to do with it? If not, why does that change when the interaction happens via example.com?
I don't think we should try to split accountability at all here.
The ad platform that allows malware to be served to anyone is at fault.
As is the individual website that has selected to allow a 3rd party's code to be delivered to your machine without controlling that risk, often for very silly reasons.
> What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).
Laughable. As countless class action lawsuits have demonstrated the victims are never made whole (https://instituteforlegalreform.com/wp-content/uploads/2020/...), the criminals get a slap on the wrist fine that is a tiny fraction of the profit they made doing crime, and the lawyers walk away with pockets filled with cash while nothing changes. (https://link.springer.com/article/10.1007/s10611-024-10170-w)
Fine's and class action lawsuits don't work. Throw some CEOs in jail and things will actually change.
You're wrong on legislating these things. If the ad network is forced into KYC for their ad distributions and they are excluded from safe harbor, like a TV network would be, then I guarantee those ads cease to exist.
This mentality of "it's to hard" doesn't get things done.
I do agree that some greedy lawyers and civil liability would solve this, but that's not a long term solution at all.
I think it would be nice for them to be held accountable but I get the feeling this is part of a wider nation state intelligence apparatus and I doubt that they will hold themselves accountable.
I'm not sure you understand what you're asking for, or if you do you have not followed the results of this to its conclusion
This comment is meaningless without stating the unintended consequence you believe you’ve identified.
We should make targeted advertising illegal, full stop. This would remove so many perverse incentives in the system.
The default setups are also _crazy_.
So you search for company A wanting to buy their product. You check out. Basically every setup I've audited has every tracking product ever for everything.
So you buy X, and the company sends that purchase event with your information to Meta, Google, TikTok, Applovin, Klaviyo, and 10 others.
This idea is hopelessly entrenched in every marketing department, who has leadership's ear: We HAVE to send EVERYTHING to EVERYONE otherwise our ROAS will go DOWN!
Every platform works this way, they're all set up to put giant red banners on your marketer's dashboards
"You could be getting 50% better results if you sent <customer_2nd_grade_report_card>!"
Its basically how all the ad platforms fundamentally work: they use conversion events to train their ad algorithms.
It seems like ads already violate the law via whatever that "unauthorized usage" law is that the government likes to throw around.
Too bad no one has the guts to enforce the law that way.
This is not the problem. You visiting any website can lead to your computer running the same code.
The main problem is that the exploits from js to code execution or data exfil are possible in the first place. The issue is that you have JS, which is generally pretty isolated, able to talk to bundled libraries (like libwebrtc), which often contain the exploits and share the same memory space. There needs to be a intermediate layer between JS talking to any such library, like process isolation with IPC for communication.
Sure, but there's a big difference between going to a sketchy, malicious site vs a reputable site that does serve ads and now being at the mercy of any arbitrary crap in the ad you didn't choose to see
> How is this acceptable for society goes beyond me.
Easy, when your society glorifies and deifies greed, you can excuse literally any act so long as it makes enough money.
That's it. That's the entire explanation. It's capitalism and greed.
> That's the entire explanation.
Not quite. Most people in society are completely oblivious to this happening. And their lack of awareness is why the exploiters don't face more public opposition.
That's true, even what they know is happening is so abstract and hidden that they don't really understand it.
Vast majority of people will gladly sell their privacy.
All ads are malware.
And all spyware is "mercenary" spyware, at least in the sense that the creators only care about money and are willing to hurt others to get it.
> And add jail time to fines. Fines means nothing for the rich.
This, pretty much. Money removes consequence form your actions. If every time you screwed up, instead of being fined you had to wear a silly hat, go on TV and apologize, or get some time behind bars, even if it were 1 or 2 days it would be very effective.
It's fun to see adtech digging a hole for themselves ...
If only! I think we can no longer afford to ignore all these security threats and should make online advertising wholesale illegal. But I won't hold my breath.
The ads are getting insane, they're trying to fill every bit of space you can look with ads. You go to a restaurant there's ads on your placemat. You go to the grocery store there's ads in your cart. They put chargers in the parking lot so now there's ads out there.
Streaming services used to be bad enough with ads in the shows, now they put an ad on the screen when you pause it. Peacock just started putting ads in the login screen.
If we don't stop this, pretty soon they're going to have ads in the stars as satellite constellations arrange themselves to sell you Twitter subscriptions. They're not going to stop even when there's an ad no matter where you look.
The moon as a giant Pepsi logo.
> ads in the stars
I'm reminded of the ending of the 2008 film Hancock in which Hancock defaced the moon with a corporate logo. But it was okay because it was "for a good cause".
Showing an advert is fine. A poster on a billboard is not deploying mass surveillance.
It's both, there is no mass advertising without mass surveillance.
No, it really isn’t.
Putting a static, printed poster on a wall is in no way analogous to surveillance.
Okay but my point wasn't about an advertisement or a poster on a wall, it was about advertisements on every blank surface, so I'm not sure your reply is relevent to what I said. If your point is just everything in moderation, I can agree with you, but we're well past the advertisers being moderate with what they're pushing.
this is why adblock is completely necessary, not just for your eyes, but for security.
I don't see how anything in this exploit requires ads. It could just as well be done by enticing the target to view a malicious web page, such as a post in a subreddit or facebook group the target is known to read, or even by just sending him a link in an email or chat which will often trigger an automatic "preview" of the link in the email or chat client. Or by other social engineering techniques.
The ad-tech network probably does make it easier, because any page that includes their ad network could deliver the malicious ad.
The main thing ads allows is "zero-click" - so they don't need to click a link or anything to get exploited.
How does this actually work? Are they talking about browser fingerprinting or something else?
If I had to ponder a guess…
It’s to do with hiding malware/spyware in an image which ends up in your cache on device. I can’t go much further into details but all this takes is for you to visit a site that serves it via ad network.
Israel has been known to have some sneaky spyware in the past with Pegasus.
https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zer...
https://citizenlab.ca/research/how-discover-tech-turned-targ...
Here is a better article https://citizenlab.ca/research/how-discover-tech-turned-targ...
Looks like it's much worse, they get more information due to exploits, and they can take full control of your machine.
Article on the CitizenLab website: https://citizenlab.ca/research/how-discover-tech-turned-targ...
This should have been the OP.
There is a tinfoil narrative that suggest that entire formats are in bed with intelligence services. It sounds pretty wild, but other zero-click attack vectors have been possible through sabotaging the parsing of file formats. ie. send a message -> hacked. How? the message wasnt even opened. How is, an app like Messenger receives a photo attachment binary, tries to unpack it and in doing so receives an instruction that stops the parser and executes arbitrary instructions.
With all the AI decompilation going on would it not be possible to find these things in the binary by now?
Yeah, but you need to know where to look for it, the average person is never going to be able to afford the amount of tokens that will take to find a bug like this, especially if it was implanted on purpose.
Shrink the surface to scan. Not foolproof but can be an improvement. After watching many conference videos on mobile OS hacking, the strategy should really be to focus on components that were touched recently in new updates (and the most popular components like messaging). Once software is mature, they don't go and change everything with every release. It's been a few years, but an interesting insight I learned at CCC was that the most touched components in new OS releases are the ones most likely to have contributions by junior developers trying to push some commit to satisfy their boss and thus have security flaws. Testing can only catch so much.
Go to LinkedIn, and check how many ex Unit 8200 (a group you never really quit until you are 50)...work for the Apple iOS dev team...
Tons of SV companies really... it's quite disturbing how obvious the compromise vectors are but big companies and startups alike seem to just allow it with no consideration for the security implications.
I think lots of it has to do with how well the hasbara covers up the scandals from the wider publics perception, combined with the cultural bandwagon of considering them an ally even when their repeated actions say otherwise.
edit: also the idea that they have such good tech and its a pragmatic decision ignores the history of how and who they got it from and the intentions for it. I say this as someone who worked directly with Mellanox for example, before aquisition by Nvidia... I always thought kernel level shims for networking stacks from an Israeli company was dangerous... but the speeds!!!
It's routine for apps like Messenger to pre-download attachments (eg to compute a resized preview of the image etc)
well yes, that is the surface. it's the surface being created with no recourse from the user side, that is intentional... the tinfoil hat theory is that it is, anyway.
or maybe the actual reason is so that when someone sends you a picture you can see the picture
How the ad-based spyware actually worked (from the Citizen Lab and Confiant reports):
- It came in through the front door. Discover-Tech ran its own ad-buying platform and was listed as a "certified" vendor by Google and IAB Europe for six years. Nothing was hacked to get in. It bid in ad auctions like any other buyer.
- The ads looked harmless. Plain banners for games, AliExpress deals and an IP-lookup site. Hidden inside each one was a small script that quietly phoned home when the ad loaded.
- Everyone who saw an ad was profiled. The script collected device details, IP addresses and, on many sites, the publisher's own cookies, sometimes including logged-in session tokens. Cookie-syncing with other ad networks built a huge identity graph.
- Only chosen targets got the payload. A gatekeeper server checked each device's ad ID and IP. Most people got nothing back. A selected target got code that handed them off to spyware maker Candiru, and the code was served only once, which made it very hard for researchers to capture.
- The handoff was built to defeat inspection. Encrypted channels, rotating hosting, anti-bot checks and even a fake "Copyright Google" comment to fool human reviewers.
- It worked. At least 45 devices at Al Jazeera were targeted, and spyware was recovered from an infected machine. Its ads also appeared on networks belonging to NATO, the UN, the European Parliament, the ICC and various defence ministries.
- The scale was huge. Billions of bids and ads in nearly 200,000 apps and websites, including Duolingo, Viber, Yahoo Mail, dating apps and period trackers, yet almost no sign of real advertisers or revenue.
Citizen Lab: https://citizenlab.ca/research/how-discover-tech-turned-targ...
Confiant: https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zer...
Citizen Lab also has a shorter executive summary: https://citizenlab.ca/research/exposing-adfection-executive-...
Wait what, so there is no content disarm between companies making ads, and the publishers? They can literally push whatever they want? Wild.
Edit:
the TFA answers: "Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user." Its wild! I thought the ads are sanitized, go through a CDR of sorts, and whatever javascript is permitted is authored by ad networks, not the buyers. Sheesh. Thats just RCE.
> Wait what, so there is no content disarm between companies making ads, and the publishers? They can literally push whatever they want? Wild.
RTB (real-time bidding) does not incentivise publishers to care about what ads are actually being shown to individual users, so long as CPM is maximised.
I was looking for this comment. I'm wondering the same. Are ads just iframes that could have js? Therefore this is basically a zero click js (is this the first?) that just happens to be distributed via ads?
Did you AI generate this? The wording looks suspicious and sure enough, it's flagged by pangram as AI.
I found it to be an excellent, easy-to-read summary.
Which is what AI is RLHF'd to do, but using AI, much less undisclosed AI is against HN guidelines.
> Don't post generated text or AI-edited text. HN is for conversation between humans.
Agreed it's against the guidelines as written but the interpersonal exchange is no different than someone quoting a blog post (and then not linking to it, to be fair). Something like this doesn't feel strictly bad, assuming disclosure and a link to the chat, sources included.
They use ad network to try to target individual user visiting a page (eg you know your target is a male, 60 years old, living in that area, with a few other checks you can almost uniquely identify your target)
Then the ad network delivers a targeted ad that exploits a vulnerability (eg a broken JPEG decoder that, when sent a bad image, allows to run arbitrary code on your machine), and from there you have access to the computer
Looking at the bright side, we might just be able to make people really dislike ads.
For those who haven't learned their lesson yet, I doubt anything could move the needle.
People have disliked ads since ads existed. Carl Sagan's 1985 book Contact includes a brazillionaire S.R. Hadden who made his fortune by inventing an adblocker for television. https://en.wikipedia.org/wiki/Contact_(novel)
The FBI has previously recommended running adblockers as a method to prevent malware and especially scamming. Nobody cares much.
It’s a low-hanging fruit that has high value, particularly for less savvy internet users. Scams have always been the biggest threat. I’d say the majority of internet ads are scams, and the platforms often don’t make it clear what is or is not an ad.
But, we always knew the risk of malware was there. In the modern age, ads are basically never delivered as static assets. They’re delivered as small applications, with code. So, we’re relying on our sandboxing mechanics to work perfectly, and predictably they don’t. The solution is to block the code altogether; to block ads.
Online ad networks are zero-click spyware and their entire purpose is to maniputate the user against his own interests. The only reasonable thing to do is to block them entirely and for everyone.
archived, no ads or trackers: https://nonograph.com/online-ads-weaponised-to-deliver-zero-...
If someone you care about doesn't run an ad blocker, it's time to change that. They don't even have to be gullible and likely to click on things they shouldn't. Zero click is zero click. Don't just tell them they should. They likely won't. Go with them to their computer and install an ad blocker for them on the spot. It's time.
Maybe Google, Yandex, etc. will decide this is the last straw and finally get serious about filtering malicious ads out of their services. Past history indicates they won't. I feel sorry for anyone who depends on ad revenue, but not sorry enough to expose people I care about to this crap.
Would installing ad-blocker software give me any protection from this stuff?
It seems to be app-based. So DNS blocking could work; it's easily circumvented by the platforms, but it's rarely circumvented. like mobile games with those ads.
You should threat model, but if you want to maximally protect yourself, use Vanadium or Brave Browser and GrapheneOS and no privacy invasive apps.
https://www.privacyguides.org/en/basics/threat-modeling/
I’m a little confused how mobile ad targeting ends up as a DLL hijack?
mobile ads can deliver JS-based exploits
But how do the DLLs hack you
It reads to me that the DLL is something they found later while trying to determine what the attacker was doing after they were already in.
Sure, but it's a mobile ad, how is a DLL going to do anything
This was my first question as well. There’s a big gap between “ad network delivers JS” and a zero-click browser exploit. CitizenLab has done some great research including OSINT on the former, but there’s a conspicuous gap between it and the DLL ending up on the victim’s machine.
There are mentions of CVEs in that article with Chrome exploits.
Knew the country of origin before I read the article. Surprise!
Some countries are good with military hardware, and some are good with military software. e.g: Stuxnet.
Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle...
The CTO happens to have worked for Radware
https://radware.com/
https://www.innovid.com/about-us/news/mediaocean-completes-a...
I wonder how we're going to unwind this mess in the upcoming years. It seems as if there was a concerted effort to plan this all out before Trump got elected, and then everything fell into place. They obviously have a post Trump plan ready to go. I partially blame the left(really the moderates) in the U.S. For being so unbelievably complacent that it led us to this mess. I just wonder how we're going to unwind this. Nothing lasts forever, but the transition in between states always tends to be disrupting.
The timing just seems very peculiar. I wish investigative journalists would do further investigation into this topic.
Moderates in the US are funded by AIPAC as well.
So reading the article, it feels a bit confusing what zero click exploit they are talking about. It sounds like they are talking about CVE-2021-21166, but if they really are talking about an exploit from 5 years ago, i feel like their intro paragraph is rather misleading.
Awful lot of words here, but not much explanation of the actual capabilities of the "zero-click spyware". Tacking on the phrase "zero-click" suggests some kind of browser exploit, but it seems like this is just the same sort of thing as tracking cookies, third-party telemetry etc.
Keep reading:
https://citizenlab.ca/research/how-discover-tech-turned-targ...
Yes, in fact I skipped to that section. It describes targeting, and then a vague mention of ad impressions leading to "connections" to a C2 server (but the simple fact of contacting a domain doesn't establish C2; anyone can send an AJAX request anywhere). Then they describe a "fingerprint" of servers which appears to consist of... HTTP responses with several blank fields and a claim of running on Apache. Then they say that they found a compromised DLL, which they attribute to the ads based on the DLL hard-coding some domains related to the ad campaign.
But there is nothing explaining how the DLL becomes zero-click compromised by the ad.
> they attribute to the ads based on the DLL hard-coding some domains related to the ad campaign
No, their attribution is much more robust than this. Neglecting those details to oversimplify your explanation is intellectually dishonest.
> there is nothing explaining how the DLL becomes zero-click compromised [...]
They do, just a little later in that same section: "Both samples use a COM hijack for persistence [...]" through a malicious DLL.
https://attack.mitre.org/techniques/T1546/015/
No, they’re using those same techniques,
and they’re just as troublesome as they were before,
to the degree they’re provably being used to decide who to send malicious payloads to…
Zero-click simply highlights if the user needs to actively interact with an element to get a malicious payload - or not.
This did get me interested in the specifics of the payload, though:
“It maintains persistence via COM hijacking by overwriting a legitimate COM class registry key’s DLL path with a first-stage DLL dropped in C:\Windows\system32\IME\, and it stores encrypted second-stage payloads in the configuration directory. A signed third-party driver (physmem.sys) enables kernel-level memory access and API call proxying to avoid detection. To preserve system stability, DevilsTongue reinjects the original COM DLL during hijacking, disguising this action through shellcode manipulation of the LoadLibraryExW return value. All additional payloads are decrypted and executed only in memory, allowing the malware to steal credentials from LSASS and browsers, access Signal messages, and use browser cookies to impersonate victims on platforms like Facebook, Gmail, and VK. The malware’s use of scrubbed metadata, encryption, and unique hashes for each file further complicates detection and analysis.”
from https://www.recordedfuture.com/research/tracking-candirus-de...
thank you for providing that citation; the recorded future article does provide a better explanation of the exploit details that the original post
Targets could have been identified using pretty basic advertising and marketing techniques. Bid requests broadcast IP, device details, and ad IDs to every bidder. Intersecting topic audiences across a few months of Al Jazeera stories could narrow that audience to a few individuals. The ad ecosystem already does set-intersection de-anonymization to identify interests and profile customers.
https://404privacy.com/blog/how-israel-used-ad-auctions-to-d...
You have to go about 5 pages deep on any search, anywhere, before you find something positive about "israel"
they do have a really big and well stocked skin bank! Its positive as long as you don't start asking where it came from :P
Committing a genocide does typically reduce one's cachet.
Seems like a second-order effect to me, and this report is a good example
The article contains no information on which browsers are impacted, what exploit is being used, if it has been patched, etc? Does anyone know more about how this ad network is exploiting browsers to install spyware on the users machine?
Buried in the Citizenlab report are links to CVEs from Windows and Chrome that the report says were exploited. These CVE's date back to the early 20's and have been patched.
As I skimmed the CitizenLab report, it was particularly interesting to see the history of the company and how they may have been acquired specifically to use as a covert operation.
How paranoid should one be of, say for example, a wasm vulnerability exploited on zero day by a bad JS ad?
I am scared for my parents to get exposed to this kind of thing from bad ad network actors. Does anyone have some practical concrete recommendations they took? Like I don't think they can install ublock origin and whitelist sites on demand in Firefox they way I do.
The only practical thing right now is to make sure they don't have the money on device and have 2 fac for email and bank accounts. But every now and then there are phishing attamepts that they could fall prey to.
> I am scared for my parents to get exposed to this kind of thing
It's tough. One option is to hope/assume that exploits only compromise user accounts rather than the whole computer.
In that case you can blacklist the banking website from the day-to-day browser as a reminder to switch to the other account, and configure the other account's browser so that it can do little else.
Install uBlock Origin and don't whitelist any sites. The default filter lists break almost nothing, only once you start including the "annoyances" lists etc. do you start running into significant breakage.
Without an ad blocker, they will be exposed to such an amount of social engineering (ranging from dropshipping sites, to subscription scams, to scam shops that don't ship at all but steal your CC data, to fake sites for government services, to attempts to trick you into installing malware) that you can't expect them to resist it. If installing uBO seems hard, resisting this or cleaning up the consequences is harder.
The amount of "hey have you heard of this great new product I saw" <photo of a handwritten note of the content of a scam site> went down from weekly to near zero once I got a relative to use an ad blocking browser.
Of course, who else could it be.
I would be interested in knowing which devices were (or still are) vulnerable to these zero click exploits. And how those exploits (used to) work, specifically.
For as clever as some of the spy techniques are, they sure don't seem to be very good on opsec.
> We found two world-readable Apache Druid instances running on Discover-Tech’s website mtrtb[.]com. The druid.mtrtb[.]com endpoint contains bidding data for Discover-Tech’s MyDSP platform
uBlock Origin ftw
And wBlock on Safari.
It does not support Manifest-v2.
Plus a dns based blocker for other apps. Android has an option ready for that, iPhone it will be like VPN.
Actually you can load a configuration profile on iOS and force everything to a custom DNS. Works great for me on NextDNS
Then you can drastically reduce the mobile in browser block list which helps a lot with battery
Incredible that they don't clearly say what the exploit is and what OS/hardware/apps is/are vulnerable. Still, quite a lot of interesting info about the modern ad delivery networks sewer system...
The fact one of the spyware cos was named after the fish that swims up your dick hole is too funny
Taboola ads is zero click garbage which makes ones eyes bleed. This stuff is just a tad more sinister or a step further than that but along the same lines, more or less.
I doubt it's that easy to click on a link and install malware without the user knowing. Most browsers are highly secure and finding a zero day isn't that easy these days because both sides use A.I. to find vulnerabilities and to secure against them.
It’s not “easy”, it requires a complex infrastructure of exploit devs (who can sell their findings for millions in some cases) and the companies who package these exploits together with implants and sell them.
https://www.packetlabs.net/posts/demystifying-the-market-for...
"Most browsers are highly secure"... erm no
Do ad blockers protect against this?
> Reuters has reported that billions of dollars’ worth of Meta’s ad revenue comes from ads for scams, illegal gambling, pornography and other banned content. In the US, ICE and other government agencies have bought software that uses ad tech data to track people’s movements.
I don't know if an ad blocker protects against Discover-Tech’s Controlium but in general you'd be a fool to allow ads in your browser in at this point. The ad industry is pretty shady all round.
For years there was a strong segment of HN commenters who would come on and declare a moral imperative for not using ad blockers and looking at every ad you could in order to support a website.
One must wonder how many were genuine vs an influence op.
Or genuine people who ate an influence op before posting here.
The whole point of an influence op is to find a bunch of useful idiots to provide a large multiplicative factor.
And that's the problem with arguing that something is an influence op, because it is going to be mostly genuine people by the time it gets to you, even though you're not wrong.
On web, likely. If it's in app mobile then no. Run a DNS ad blocker.
Curious if GrapheneOS phones were also vulnerable to this.
Wild guess even if not in this particular case it's best to consider the possibility as non theoretical.
Earlier link:
https://news.ycombinator.com/item?id=50101813
Very strong reason for everyone to install ad-blockers on all of their devices.
The headline is "Online ads weaponised to deliver ‘zero-click’ spyware, researchers say"
Once again proving that ads are an unacceptable security threat. All those sites now deploying ad-blocker blockers should assume liability for whatever ad software they force their readers to run.
I wonder who they were facilitating the targeting for given the target countries.
Apps should be required to disclose every single ad network they use as part of their app store disclosures. I want a lot more transparency as to where the ads are coming from inside the app itself.
I've witnessed consumer apps throwing quite heinous malware/sketchware advertisements and watched the banners rotate between 4-5 different ad vendors to keep things hot and spicy.
The incentives are lopsided, there’s so much money to be made by selling access to you and your devices, and controlling you, than just taking your money.
Indeed, it seems there are some externalities that a 100% free market doesn’t protect against for which regulation is probably the best tool.
A regulation here that applies to all app stores is even business friendly as an appstore which wanted to do this already wouldn’t be punished by trying to do this on their own, for the reasons you mentioned.
Chance of sanctions?
Zero
NSO was sanctioned, so slightly higher than zero imo.
It doesn't make sense how this is even possible.
This is what ad networks are for, by the way
if anyone is well versed with this tech; can this be used to target regular people? how can an average joe protect themselves from this?
1) Of course, although you probably aren't worth a zero day.
2) Adblockers
Again Israel causing troubles.... :/
This isnt the first…
https://news.softpedia.com/news/The-Jester-Presents-Project-...
Back in 2012 The Jester claimed he used targeted spyware to target Mir Islam or Josh the God leader of UGNazi which according to him led to his arrest, though law enforcement never confirmed it.
Interestingly enough they have his laptop he used for a while in a museum.
https://www.spymuseum.org/exhibition-experiences/about-the-c...
Found his blog post about it:
https://th3j35t3r.wordpress.com/category/hacker-tracker/
All ads should have to appear in an <advertisement> node, and users should have the option of disabling javascript within an advertisement. Make it the fucking law.
The lesson from story: Install adblockers on all your devices
Given whom did this attack, I would not be surprised if it was used as intel for strikes on journalists.
There are reliable sources from inside the Israeli Intelligence apparatus that have stated on record that decisions were made to sacrifice 500+ innocent civilians to carry out a strike on one human target. I bet such a strike would be more likely if spyware indicated that one of the innocents was an "enemy" journalist.
tel aviv impressed
Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle... The CTO happens to have worked for Radware
https://radware.com/
https://www.innovid.com/about-us/news/mediaocean-completes-a...
Whenever I think of Israeli ad tech one company always springs to mind, which creates some of the worst garbage on the whole Internet.
https://www.taboola.com/
This crap is the worst of the worst.
"uBlock Origin has prevented the following page from loading:"
Absolutely terrible companies. Another one is https://fingerprint.com/ but iirc they don't do ad targetting.
Quite amusing that the Crusader states have exchanged horses, swords and shields for spinny chair, ads, and adblockers.
Wonder what the world's most boring ideological argument will bring us in the year 3027.
Citzen Lab isn't always the most reliable source: https://researchonline.lse.ac.uk/id/eprint/118492/
Classic; when you can't kill the message, kill the messenger. [0]
[0] https://en.wikipedia.org/wiki/Shooting_the_messenger
Nope. If the messenger has a history of being unreliable, it's valid to call him out. I'm glad you read a TikTok guide on fallacies, but this isn't one of them.
OK, then. Let's do the same with your profile, so in your About page I see this:
"About: Old programmer Tel Aviv, Israel"
Most of the information coming from Israel about Israel seems unreliable, too.
Bigot
I recommend _Culture in Nazi Germany_ by Michael H. Kater. [0]
No, I will never fund TikTok. This article must have struck a nerve with yourself identity. Speaks volumes about your void of humanity.
[0] https://yalebooks.yale.edu/book/9780300253375/culture-in-naz...
Title is: Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
In fact, just update the url and title to the report:
How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
https://citizenlab.ca/research/how-discover-tech-turned-targ...
I don't see any ads, so ...
> Related work by the research group Confiant also suggests that Discover-Tech’s ads have been shown to users of the networks of government entities in Europe and the US, as well as the UN, Nato, the international criminal court and the International Atomic Energy Agency.
Yet we don't sanction Israel nor hold them accountable in any way. Of course they're spying on members of the UN and ICC, of course. Israel is at war with the entire world right now, and my politicians continue to support them. Thankfully many people have woken up, but the situation is dire.
Israel keeps being dick earns reputation.
Based on responses from roughly 46,700 people assessing 129 countries, Israel ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
https://www.middleeastmonitor.com/20260513-israel-becomes-wo...
We don't sanction Israel because we are doing it too. Any country with the same capabilities are doing the same thing.
We sanction plenty of other countries where we do the same thing we're sanctioning them for.
That conflates the state with a business headquartered in it. It begs the question of what the sanctions would be for: is the argument that this firm is an arm of Israel, that Israel turns a blind eye to abusive businesses, or something else?
Yes, obviously the state and this company are the same thing. Why would a private company spy on the ICC and the UN? I’m sure there are plenty of 8200 people involved.
That would be the most likely explanation if we knew the ICC and UN were targets, which we do not:
That's from the study itself: https://citizenlab.ca/research/how-discover-tech-turned-targ...
In case my point was unclear: Discover-Tech served ads to many clients. As far as I could tell, it's the paper's authors who singled the ICC and UN out.
That might be why the authors, in that disclaimer:
• used "in and of itself" without a footnote
• downplayed "confirm targeting" by sticking "or infection with spyware" into the same sentence.
My Democratic Rep (who is a Zionist) voted with the Republican Party to financially sanction and impose visa restrictions on members of the International Criminal Court for issuing an arrest warrant for Netanyahu, so the ICC could hold Netanyahu for trial.
I will never vote for this particular (D) candidate again. Fortunately, the (L) candidate seems reasonable.
If indeed your representatives support Israel or the genocide in Gaza, I urge you to consider voting 3rd party. In two-party elections, candidates mostly just try to be a little better than their opponent. What forces them to do more isn’t a third party actually winning. It’s a real risk that enough fed-up voters will go third-party and cost them the election. This is basic game theory optimization.
Oh darn, maybe we should just ban the entire online advertising industry. Gosh, what value we'd lose if we couldn't have our personalized attention destroying glitter boxes.
My opinion on web infra patronage has shifted over time, I used to generally accept that for small websites to exist advertising was a necessary evil since they were too niche to have a real revenue source. Then I ran one and I realized that there's far more labor costs involved in maintaining a site than infra costs and that for niche hobbies and communities ten bucks can just find its way into a central pot every month to keep the lights on by those with a bit more to spare.
I am now of the opinion that web communities can survive in the same way arts and other liberal pursuits have always survived. People with a bit more to spare put more into the pot to create the community they want to exist in and "freeloaders" is an alien concept to the genuinely interested since that money is being spent to create a place where meeting can take place without a financial requirement.
>I am now of the opinion that web communities can survive in the same way arts and other liberal pursuits have always survived.
And the only 'users' of these websites will be rich people? Because the moment a paywall goes up on a website it becomes unusable for a large portion of the planet.
Were the hypothetical "paywalls everywhere" scenario to play out, sites would quickly consolidate their subscriptions. So a subscription to something like Engadget would get you access to a wide swath of sites, making the paywall a lot more palatable overall. This would be the inevitable outcome because it would be the most natural way for sites to compete with other sites.
It doesn't matter because simply having to pay any amount at all makes those sites inaccessible. Most of the world do not have credit cards.
But that aside, I think what we would see is a lot more Facebookification. A bunch of walled gardens that you pay a subscription for and then you get access to a whole slew of sites that FB buys up. Of course, they will make sure every site ends up toeing their line too.
Not at all, a few people pay to make it available as a service to others because they want it to exist. It's like this website - there are no (traditional) ads and most of us have paid nothing to use it. A small expenditure creates a good community for technical discussion that the hosts value existing and for being able to occasionally promote their ventures on.
It wouldn't work like that. Yes, there are some exceptions, but that wouldn't work for the vast majority of sites. The rest of them would end up being Facebook pages or Fandom wikis or similar.
I'm not certain how early you saw the internet - but a lot of people threw up websites hosted on consumer quality computers sitting in the corner of their room. Don't underestimate people.
Cool, cool… the “pot of money” model you’re proposing is possible right now, yet is used essentially nowhere outside of substack writers. That’s a very clear signal.
If you ban online advertising, every publisher you know and like will either exit the market or need to use a paywall (which are famously… popular and successful for niche publishers? No.)
You can call online advertising loathsome if you want (indeed a lot of it sucks - no argument!) but it pays for content that everyone consumes. (Unless you only use HN, which is 99% of the time a collection of links to other sites with ads or paywalls or both.)
Regulate online advertising - fine. But “banning” it (what would that even involve?) is not a serious suggestion.
I'm still of the opinion that the end of online advertising would be a significant net benefit to society, if for no other reason then the incentives to keep you interacting with a social network / website / app / media / etc. fade away.
> If you ban online advertising, every publisher you know and like will either exit the market or need to use a paywall (which are famously… popular and successful for niche publishers? No.)
OK.
Tons of webforums have donation links or premium memberships. People will pay for their name to be displayed in a different color and basically nothing else, and it's not super hard if you have a few hundred users to pay for servers this way.
It's a fine model so long as you don't need it to scale to one million active users.
Why would anyone trust any Israeli cybersecurity firm at this point? Any website or service knowingly utilizing their services is a huge risk. They're already deeply embedded in federal and local governments so there is a strong sense of doom.
A later submission has more comments: https://news.ycombinator.com/item?id=50103000 , 57 comments 1 hour ago
Seems like the title was too spicy / people couldn’t behave, post rank obliterated https://news.social-protocols.org/stats?id=50103000
Hope we follow guidelines under this link or “then nobody gets it!”
What can we expect from the most unpopular country in the world:
Based on responses from roughly 46,700 people assessing 129 countries, X ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
https://www.middleeastmonitor.com/20260513-israel-becomes-wo...
I'm of the belief that when that happens, it is state-sponsored bots messing with the voting. Sometimes when I make a comment on political matters, it gets waves of upvotes and downvotes.
Thanks - we'll merge them.
Imagine if Iran did this... Or China, or Russia. But hey, it's Israel - all laws, rules, norms and ethics is suddenly suspended - so everything is ok!
You can have peace or Israel, not both.
You may not have been following the news lately (or historically), but Arab countries have been bombing each other over the past 6 months without any involvement of Israel. Not to mention the historical in-killing in Syria and many other such conflicts in the Middle East that have nothing to do with Israel.
Wrong. Israel is the epicenter of all conflicts.
Probably happens with Russia, US, etc as well, but the "hasbara" campaigns through the years have the effect of making people assume the mossad is all powerful etc etc. You inspire fear on your enemies, but also your friends.
edit: and I have been hasbar'd now for simply stating the fact that making people fear you instead of love you has consequences. oh well.