Researchers Accuse Israeli Firm of Using Online Ads for Espionage
Two research groups said on Thursday that Israeli digital advertising agency Discover-Tech had spied on internet users through an extensive online advertising network used to track specific targets and help compromise their devices.
Separate reports by Citizen Lab, a Canadian cybersecurity research and monitoring group, and Confiant, a New York-based advertising security company, said Discover-Tech’s services had given Candiru, an Israeli spyware company blacklisted by the US government, and other Israeli surveillance firms access to advertising platforms operated by Google, Comcast, Russia’s Yandex and others.
According to Reuters, the reports demonstrate how the online advertising industry, which has long raised privacy concerns, can also provide a channel for large-scale espionage campaigns.
“The way online advertising works today poses a systemic security threat,” Citizen Lab researcher Wolfie Christl told the agency, adding that this applied to “states, the private sector, civil society and everyone alike”.
Citizen Lab said Discover-Tech’s online advertisements, which frequently promoted ordinary products such as phones and earphones, had reached more than 120,000 websites and 75,000 apps through its various partnerships.
The researchers said Discover-Tech could identify and track users who visited websites or used apps containing malicious advertisements. In some cases, it also attempted to obtain smartphone users’ phone numbers. An advertisement only needed to load on a website for the surveillance to take place.
Both research groups said some advertisements were used to help install Candiru spyware on users’ devices. However, Confiant said the advertisements it linked to Candiru represented only a tiny fraction of Discover-Tech’s overall advertising volume.
Malicious Ads Appeared Across Hundreds of Sensitive Networks
Confiant co-founder Jérôme Dangu said Discover-Tech was serving at least ten million advertisements a day worldwide. Data-sharing arrangements known as “cookie matching” also enabled it to track people beyond the reach of its own advertisements.
“Hundreds of millions of people were likely affected by Discover-Tech’s activity,” Dangu added.
The US Commerce Department blacklisted Candiru in 2021, accusing it of supplying spyware used to maliciously target government officials, journalists, activists and academics.
Dangu said malicious advertisements had been shown to users on “hundreds of networks in sensitive categories”, including those of the US Department of War, the Pentagon, the International Atomic Energy Agency and the International Criminal Court. Some areas, such as the Palestinian territories, were particularly saturated with the Israeli company’s advertisements.
“If you visit almost any website in Palestine, any website, you will find a Discover-Tech ad. That gives it almost complete visibility into an entire country’s digital activities,” he said.
Citizen Lab said it had similar evidence showing that malicious advertisements had been served to people working at the United Nations, NATO, the European Commission and more than a dozen other governments.
Networks where the advertisements appeared also included those of semiconductor companies such as Nvidia, SanDisk, Broadcom and Micron, as well as several unnamed media organisations in Mexico, Israel and Europe.
In addition to identifying Candiru and several other surveillance technology suppliers, Citizen Lab said it had obtained some details about the likely locations of users of Discover-Tech’s services. The company had inadvertently exposed its authentication logs online, revealing logins from IP addresses in Israel, Europe and the region.
Action Against Discover-Tech
Discover-Tech has now been excluded from parts of the online advertising market. In a statement, Google said it had cooperated with the Citizen Lab and Confiant investigation and banned Discover-Tech from its advertising platforms “for systematically violating our policies”.
IAB Europe, the European association for the digital marketing and advertising ecosystem, said in an email that Discover-Tech had been suspended from its Global Vendor List the previous week after an audit uncovered policy violations.
Comcast said in a statement that its advertising technology subsidiary Beeswax had removed Discover-Tech from its platform “following recent activity”.
Advertising-based surveillance is increasingly viewed as a national security threat. Earlier this year, the US Department of War said it had received reports that US military personnel deployed in war zones had been targeted using geolocation data collected by advertising technology companies and data brokers.
Since then, branches of the US military have disabled advertising tracking on some devices.
