Spyware via Ads: Is AdTech the Problem, or the Actors?

HostThe voices in this episode are synthetic, and the script was written by a language model. The positions are real, and they come from the thread.

HostOn Hacker News, a recent Citizen Lab report sparked a heated discussion across more than five hundred comments. The report, titled 'Exposing AdFection,' argues that the online advertising ecosystem, particularly with the involvement of Israeli tech firms like Discover-Tech, has become a pipeline for zero-click mercenary spyware, used to infect devices at Al Jazeera. It's a claim that really got people talking about cybersecurity and privacy.

HostThe thread quickly split into several camps. Many commenters focused on Israel's role, seeing its cyber-industrial complex as a unique and dangerous threat. Others argued the entire ad tech ecosystem is fundamentally broken, regardless of who exploits it. We also heard from those who felt the system's sheer complexity makes easy fixes impossible, and a smaller group who pointed out that cyber espionage is a common practice among all major global powers. The discussion often veered into intense geopolitical debates, sometimes overshadowing the technical details.

Israel unique threatIt's clear that Israeli tech firms, especially in cybersecurity, aren't just independent entities. They're often beholden to the Israeli government, and you can't really trust them. We're seeing a pattern here with companies like NSO Group, Candiru, and now Discover-Tech, all Israeli, pointing to extreme abuse through technology.

Global espionage normBut isn't it true that all normal countries spy on their enemies and friends? They all use cyber-espionage. Russia, China, and America each have notable offensive cyberwarfare capabilities, and North Korea's practically a nuclear-armed cybercrime ring. Israel isn't unique in this regard.

Israel unique threatIt's not just about general spying, though. Israel benefits from special protection from the US, allowing it to get away with stuff that would be an international scandal for other countries. Look at the USS Liberty incident, or how the Israeli government refuses to extradite its citizens accused of crimes abroad. That provides a level of legal immunity that just fosters cybercrime.

Global espionage normI think Israel's skill in cyber warfare can be attributed to factors like compulsory military service, like Unit 8200, which funnels bright individuals into technical roles. It's also got a strong emphasis on entrepreneurship. It's a compounding effect of specialization, like the Netherlands' chip industry or Hollywood's filmmaking. It's not necessarily a unique malice.

Israel unique threatBut Unit 8200 systematically trains young tech talent in cybercrime, creating a direct pipeline for this mercenary spyware industry. And it's not just defense; their cyber capabilities are used offensively, even spying on allies. Netanyahu himself publicly stated Israel can penetrate any device and use its contents for blackmail or discredit. That's a level of acknowledged capability and intent that's truly alarming.

HostSo, while some see Israel's actions as part of a broader global espionage landscape, others argue there's a unique, state-backed element at play. But what about the ad tech ecosystem itself? Is it inherently designed for this kind of abuse?

Adtech root evilAbsolutely. The online advertising industry, especially real-time bidding, collects vast amounts of granular data and enables individual-level targeting. It's ripe for surveillance and exploitation. The ability for so many third parties to run arbitrary code through ads creates a massive attack surface. It's a systemic failure.

Adtech too complexI understand the concern, but the sheer volume of traffic makes it virtually impossible to vet even a fraction of it. Bad actors are incredibly sophisticated; they're using different landing pages, throw-away accounts, and even hijacked legitimate accounts to evade detection. The report itself is highly sensationalist in the 'zero-click' aspect, it's vague on the actual mechanism.

Adtech root evilIf you can't do something safely at scale, then you shouldn't. If that means generalized online ads can't exist, then so be it. The economic incentives in ad tech prioritize profit over user safety, offloading the cost of security onto society. Targeted advertising should be made illegal to remove these perverse incentives entirely.

Adtech too complexBut holding websites liable for malware served through ads would completely upset the economics of content management. No ad revenue would be worth such liability, making monetization through ads impractical and unsustainable. This isn't just an ad problem; supply chain attacks and exploits are broader cybersecurity concerns. The current model, despite its flaws, maximizes common good by incentivizing content creators.

Adtech root evilThat's just not good enough. Online ads are essentially small applications with code, relying on sandboxing mechanics that predictably fail. They're an unacceptable security threat. Websites and ad providers should be held liable for serving malware; they're effectively partnering with businesses that inflict harm on users. Disney Plus, for example, shows it's possible to vet ads carefully, even if it's at a smaller scale.

HostIt's worth noting that the 'AdTech engineer' who offered that insider perspective was met with significant hostility in the thread, with some accusing them of a conflict of interest. It seems there's little patience for defending the current ad tech model. But beyond the main arguments, there were a few other points that didn't gain much traction.

HostFor instance, the idea that class-action lawsuits would be an effective solution for ad tech liability was widely dismissed as ineffective for systemic change. And a specific claim about Israel's cyber prowess being due to 'Ashkenazi and general Jewish culture values education more than anyone' was a controversial and minority view.

HostUltimately, while the discussion was deeply divided on the geopolitical aspects and the fundamental nature of ad tech, there was broad agreement on one thing: ad blockers are a necessary and effective defense for individuals against malicious ads, tracking, and the security threats posed by the online advertising ecosystem. The thread never quite resolved whether the problem lies with specific bad actors or the entire system that enables them.

HostSloppod out.

HostSloppod is sponsored by Taskpile.app.

The same, as plain text