Comment by Postosuchus
3 days ago
AdTech engineer here (some 13 years in the industry). A couple of notes:
- The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.
- To the point below that "ad providers should be held responsible." There is no such thing as "ad provider." The AdTech ecosystem is teeming with different niches and business models - see the famous LUMAscapes diagrams: https://lumapartners.com/lumascapes/ . The sheer volume of traffic makes it virtually impossible to vet even a fraction of it. Google has thrown a lot of compute power to pre-scan 3p creatives and even then bad actors can sneak through. Add to this a lot of sophistication on their side (from different landing pages based on the perception of the type of user to farming throw-away advertiser accounts aimed at running just one campaign like that to hijacking legit accounts through sophisticated technical and people engineering means). In the end, politicians full of indignation do what politicians always do - sue or fine Google and call it a victory, whereas the true bad actors just keep going.
Prior to online ads, that is ads that existed on TV, print media, etc, ads were properly vetted. Very few outright scams made it through.
So, it’s definitely possible, especially with human review and static ads. No code. It might not be possible at scale. To me, that’s just not an excuse. If you can’t do something safely at scale, then you shouldn’t. If that means generalized online ads can’t exist then… so be it.
Online ads are definitely still possible. For example, im sure Disney reviews and approves all ads that run on Disney plus. So just do that, and if you can’t do that for e.g. YouTube then dont.
Disney (CTV) doesn't take any open auction demand. All their programmatic demand is deals - meaning that they carefully plan those campaigns with highly reputable agencies and advertisers. There is zero chance for a contentious scammy crypto exchange ad (or even a moderately innocent crypto wallet one) to show on their properties.
Which you can absolutely do, when you are Disney (read, agencies fight to run a campaign with you). When you are, let's say, TechCrunch, the situation changes - you can still strike some deals but a lot of your demand is not the same grade.
I just don’t find business model arguments particularly convincing. If your business model can’t support itself, I don’t think that’s justification to go out and do whatever.
So? Your business relying on serving malware is not a valid excuse for serving malware.
Late night infomercials for get rich quick scams and spam fax machine ads were all over the place by the late '80s sadly.
Not in Australia at least. There were ads for flash in the pan fitness and weight loss devices and various other wastes of money, but outright scams and illegal devices would have their ads pulled real quick.
I think your answer gives us a clue about what went wrong and where.
The fact that internet advertising is run by the big US tech behemoths, makes them difficult to go after by countries that have previously had sane advertising standards. The lack of US regulation is the winning car in the race to the bottom.
Back in the day web sites that were ad-supported had their own departments that dealt with ad sales, so it's not like it can't be done.
One economic consequence is advertising gets expensive and limited to big players, like on TV. Make of that what you will.
Good. Advertising is already incredibly expensive for society. It's time to stop externalizing the costs.
No, it just means it costs more and you have to care a lot more about targeting.
You clearly misunderstand the sheer scale of online advertising (compared to linear TV ads, magazine ads etc). There is no chance you can vet every single creative and a landing page (one public number is 30B daily ads just served by Google alone in 2012 - which is probably closer in spirit to the Punic Wars than to 2026).
That's the first point. Now, who should be responsible for getting the ads? The website? That will absolutely kill the monetization model and it is simply unrealistic. Which means, that responsibility now should be pinned on someone else. Who would that be? My point being that no one there has an inherent lawful obligation to provide such vetting, which would be a) costly and b) only applicable to one player (out of many).
And then we get to bad actors. If I were a really motivated bad actor as early as in 2005, I was serving different creatives and different landing pages to different audiences - a perfectly well-behaved ones to Google's crawlers (again, Google does A LOT to fight malware), a questionable quality clicky ones to general audiences and maybe malware-ridden ones to specifically targeted audiences. And you would not be able to catch me in real time - only after the fact, once the campaign was run and someone looked at the evidence (assuming it was collected, which it isn't normally)
It was allowed to grow to its current "sheer scale" due to lack of regulation, be that internal or legislated.
Continued lack of regulation, throwing up ones hands and saying "well, it's too big now" will not allow it to be solved.
What has been 'normalised' in the online advertising industry sets my teeth on edge as someone with some amount of security and privacy awareness. Hence I go out of my way to block as much of it as possible, for myself and family and friends.
Even the FBI and NSA make public their recommendation to run ad blockers as a safety requirement for internet browsing. I would have thought this may be some kind of red flag to say that maybe you're doing something not quite as well as would be satisfactory.
If it is indeed impossible to vet all the traffic passing through your networks, then perhaps your networks' existence is itself the issue. Maybe it is indeed not possible to vet 30 billion ads, just like it's difficult for Facebook to moderate all 3 billion users.
Perhaps the actual problem then are these monolith platforms that have done such a good job "eating the world" that they can no longer properly function.
3 replies →
it has to be the website to start with; if the website is hosting malware, then it's the website's problem. Soon after that's implemented, the adtech companies will begin competing to solve the website's problem by promising clean, malware free ads, and will begin aggressively vetting ads. The monetization model will be preserved and the incentives will be properly aligned.
There is no universe in which 'gosh it's just too hard' is the correct answer.
That's a problem for adtech to figure out. Consumers shouldn't suffer.
I find myself a bit astonished whenever people have trouble with this idea.
We can just decide that if you can't afford a person to vet the ad, it's not allowed to run.
Yes. That will destroy the current online advertising industry. As tempting as it is to say "that's the point", that is in fact not the point. The point is, we are completely in our rights as a society to say through regulation that if you can't vet an ad with a human, you can't run it, and the capital structure can damned well do what it does best and accommodate that whether they like it or not. We absolutely can write laws that say that Google is to some extent directly liable for the ads they run. Nothing is stopping us, at least in principle.
Does that mean it will be a lot harder for the advertising industry? Yes. So be it. That is not a reason this can't happen. Is it expensive for them? Yes. I don't care that this means that they won't be able to run anywhere near as many ads.
It is not a stopper that it would be really hard for them. It should be harder than it is. It should not be profitable to build a vast surveillance apparatus to squeeze literal fractions of a penny at a time out of us. It should not be profitable to have this massive machine that can push such targeted malware at as.
We're not talking about some minor tweaks that they can toss a few AI tokens at. We're talking about regulation that would rewrite the entire social contract of advertising. A social contract that we have not really signed, either individually or collectively. We can do that. We can rewrite the contract. It's a permissible thing.
We don't have to have a massive surveillance state just to serve us ads. We don't have to have sports gambling advertising on television. We don't have to have billboards on our highways. We don't have to have extra-cheap mailing rates for ads. We don't have to have Roblox and other video game systems exploiting our children's psychologies with deceptive game currency practices and gambling mechanics. We don't have to have state-sponsored gambling running what everyone knows is a backdoor tax on the poor. None of these things are physically inevitable. None of these things are socially inevitable. There are reasons why these things do exist, which economists and game theorists and political theorists have various words for, but none of the reasons are because they are mandatory and we're just stuck with them forever because there are no other possible worlds.
> 30B daily ads just served by Google
I'm assuming that means ad impressions and not unique ads.
1 reply →
While I respect that you are posting constructively here you might also be the physical embodiment of the old joke that it is difficult for someone to accept a truth when their continued employment depends upon its falsehood.
The Web used to be a great place before surveillance capitalism and adtech took over. Some of us remember it. People participated because they wanted to. People contributed content because they enjoyed it. The incentive was a sense of community and contribution and shared knowledge - and usually there was no expectation of direct financial gain. Basic hosting was included in everyone's normal ISP plan. SEO wasn't a thing. Blogspam just to generate pages to host ads wasn't a thing. AI slop just to generate even more pages to host ads wasn't a thing. And there was still more genuine and worthwhile content out there than anyone could read in a lifetime.
If 95% of the modern Web disappeared tomorrow and all that was left was what people or organisations were still willing to contribute because they enjoyed it and/or it provided some direct benefit then the Web would probably be a much better place. I cite as exhibit A the fact that we're all here posting our thoughts on HN - itself a site that has always run without any of the intrusive advertising we're talking about - without any compensation or reward other than the enjoyment of the discussion and perhaps the chance to learn something new.
I see no reason to tolerate any sort of online advertising that conflicts with the above ideals. We should simply set rules that decide what is acceptable and drop legal nukes on any company - or indeed any entire business model or industry - that fails to comply. Low key advertising for YC's next round? I doubt a single contributor here minds the little banner that pops up at certain times of year. In-your-face auto-play videos that accidentally (or not - it doesn't matter) advertise something dangerous before your kid's favourite show plays? Sue everyone and punish the offending businesses without mercy. It's really not that complicated.
If you can't do something responsibly at scale then you don't do it at scale at all.
Direct deals are different than programmatic.
Yes, exactly, if programmatic deals aren’t possible to do safely then dont. There’s tons of stuff you can’t do safely programmatically, so we get people involved. Many such domains exist. The idea that advertising can’t be one of them is just the status-quo, not the only option.
1 reply →
https://en.wikipedia.org/wiki/HeadOn My strongest argument that ads were never properly vetted. https://en.wikipedia.org/wiki/Homeopathy There's whole sections of homeopathy in stores. So it's still occurring.
> There is no such thing as "ad provider."
If a website serves me malware, the website's owner should be liable to me. They may then be able to sue someone else, in turn. But I chose to interact with them and then they chose to outsource stuff to crooks.
This would be complicated to implement. But it's absolutely doable.
No, it's not. It completely upsets the economics of content management and makes it absolutely impractical for content owners to monetize through ads. No ad revenue would be worth such liability.
Then there are all kinds of fun scenarios - from drive-by malware to landing page malware to malware served after clicking an ad ON A LANDING PAGE. Who would assume responsibility for those?
Bottom line, this is not much different from "regular" crime. It happens. Governments employ police and various deterrents to reduce it. But it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness.
> It completely upsets the economics of content management
Exactly. It moves the economic incentives from "serve the ads from the highest bidder and turn a blind eye to the fact that that's a scammer/malware" to "drop an ad platform that can't or won't keep the scammers/malware out".
Or even better, refusing to use ad platforms that let the ads serve arbitrary code. There is no strict reason why an ad can't be an image (re-rendered by the platform) and a link. Slapping scripts all over the place just makes it easier to collect data (among other things to verify that all the companies involved in serving your ad aren't cheating you, because the ecosystem is full of scammers in all directions).
The deterrent here would be prosecuting the accomplices involved in, and directly getting paid for, the crime.
But it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness.
How can you exercise situational awareness against a zero-day attack?
There are several parties who have an opportunity to detect that problem before it causes serious damage to people visiting a website. The visitors themselves are not among them. Trying to make those visitors responsible for the consequences is nonsensical.
> completely upsets the economics of content management and makes it absolutely impractical for content owners to monetize through ads
Why? An insurance product wouldn't wipe out ad revenues.
> this is not much different from "regular" crime. It happens
Why do you think parking lots have signs that say they aren't responsible for goods stolen out of cars parked there? Because that liability, by default, exists. And if a parking lot is a robbery hotspot, and the owners don't bother putting up cameras or whatnot, they'll absolutely start facing lawsuits and investigations.
> it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness
Nobody argued as much. That doesn't mean we give negligent actors monetizing malware a free pass.
What, your ad provider would just need to indemnify you for the consequences of their own fuckups. This is pretty basic stuff.
As for the ad provider, it is trivial to not deliver criminal payloads if your business starts from the assumption that doing so is costly instead of something you can foist on society for your own benefit.
> No ad revenue would be worth such liability
And this would motivate fundamental change in the industry to be able to track down the bad actors.
KYC exists for various industries in order to track down the person responsible for bad actions. Implement KYC for the advertising chain, or something equivalent, to ensure there's a validly registered sue-able entity at the end of it.
> be mindful and exercise situational awareness
I'm not going to say victim blaming, but a good percentage of the population just aren't capable of this, especially with "the sheer scale" of advertising they're exposed to. It's exhausting to be on guard for the entirety of your life.
Might as well say: don't use the internet. That might actually be the best advice to come from all this.
So you're saying we're all fucked and there's nothing we can do?
3 replies →
This argument reminds me of when I dealt with telecommunication providers in a law enforcement context.
Their argument was often that the complexities and volume of data, messages, devices just made it impossible for them to help law enforcement even when justified. Almost as if they were apologetic -- they simply cannot help!
But I was in a room once with a very senior police official, prosecutor and several telco reps when the simple question was asked: why is it not impossible then also to do billing?
Every time the conversation moved away from this point, it was forced to return by the non telco members: they knew it would cost money for the telco to help. And any argument against that was simply foregoing that cost at the expense of the safety or well-being of the public, and was unacceptable.
You may feel (in my example) their are many arguments against state surveillance, but the core truth is that all of these ad providers could indeed have systems that at least attempt to prevent this kind of activity -- it would just reduce profits to do so.
Lastly on the zero click lack of detail: it's kind of irrelevant. The exploit might be complicated, but the vector is clear -- the ad network.
This was my main question as well. I read the report, but I'm still not clear on what the browser vulnerability is. This clearly seems like something browser vendors should be able to patch, correct?
The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited. The step-by-step info graphic in the article literally skips over how the infection actually occurs.
It seemed to be that they may not have disclosed everything they discovered, so as not to admit to their own "unauthorized access" to a computer. They stated they got credentials for the cnc server but using it would be unauth access - they implied they didn't.
But they did explain some of the infection nonetheless. A COM exploit on Windows for one.
Browsers are pretty well insulated from arbitrary code execution on the host machine, but I bet android has more vulnerabilities. It wasn't long ago that the webp zero day could pwn anyones device who just looked at an infected webp. (Also Israeli spyware, I believe). Similarily, if Windows apps have ad banners, there could be zero days there as well.
> The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.
It read to me like it was assumed to be using OS/browser/application-level exploits to get further access to target devices. I suspect the CitizenLab report is light on details in particular because they don't actually know them:
> In most cases, the user who sees the ad is not selected for targeting, and the server will not return any JavaScript to be executed.
> A large number of ads placed by Discover-Tech contain a script tag pointing back to what the company refers to as a “NOAS server” (also called a “getAd server”). This tag causes the ad, when rendered, to connect back to Discover-Tech, submit advertising identifiers for the user (either a cookie ID or a mobile ad ID), and automatically execute any JavaScript code returned. The NOAS server decides, apparently based on a combination of the source IP address and the advertising identifiers, whether the target is eligible to receive any JavaScript. If so, then code is returned. If not, a 0-byte response is returned. The NOAS server is a key part of Discover-Tech’s strategy, allowing Discover-Tech to avoid directly sharing malicious code, or even pointers to malicious code, with the companies who serve and display the ads.
I and many people believe that google intentionally chooses to keep harmful ads (deceptive, scamming, or leading to malware) this is because it's often very blatant and often survives being reported
Google is able to provide an AI-generated answer for every query, yet somehow can't use the same AI to check whether the sponsored result is an obvious scam.
Your appeal to authority as an "AdTech Engineer" works against you when support your own industry. You have a conflict of interest. Of course you will try to do damage control and PR.
I don't have any conflict of interest. I'm proud of my work and I think it is great. I personally dislike ads as much as the other guy, but I am pragmatic and I have enough sense to understand that this economics has flourished because it maximizes common good: content creators are incentivised to produce good content and get properly and sustainably rewarded, regular users don't get nickel and dimed every time they load some web page.
To paraphrase Churchill, it is a terrible model but others are worse.
Not seing your conflict of interest or not admitting to it doesn't meant you don't have one.
I was surprised by the opening statement too. These guys are the literal scourge of the modern web and he's proud he's been at it for 13 years? Not sure we're on the same page, lol.
Clearly not, but I'm surprised it's so common to write someone off for their industry, just because said industry is evil.
4 replies →
Or you can read what they said and see that it's neither. Not sure why credentials would have any bearing on the material of their comment.
They're pointing out the article lacks substance implied by its title, and essentially that it would be nice to see the actual bad actors being prosecuted instead of the middleman. Both positive things to hear for me? Who cares if they work for the industry.
(The former thing is positive because it saves me time reading the article for information that won't be there.)
> virtually impossible to vet even a fraction of it
It’s a choice, and on the other side of that choice is profit.
I also have a choice. I choose to filter out as many ads I can. That is my vetting process.
I think the simple argument here is that the ad ecosystem should be rebuilt on the default assumption being that ad creatives should be an image and a link with no support for arbitrary rich content.
It would break the long tail of the ad ecosystem, but a bunch of people think the tradeoff is fine.
Given how much of online advertising is now in walled gardens rather than display ads, I think this shows this is more doable than the people who are part of the open ecosystem want it to be.
Not sure why this guy is getting a lot of shit. I play at adops, but I haven't done much with it since we set everything up.
Ads drive the internet. Sorry, but it's true. And you, the technical people, have no real idea of the scale. I don't like ads, but was amused when I had to turn off all my blockers to get stuff done. Many people in the adops world dislike ads, but money.
The point he's making is simple: the ad networks are not responsible for the ad payload. And you might argue the point, but your arguments are worthless. Even finding the entity responsible for the payload will be difficult, and they're probably overseas. Are you going to sue them? No, you're not. Can you actually prove damages, even if you did decide to sue? Probably not.
The structure in the article sounds nefarious, but it's literally the adtech stack. The only thing the company must be doing that's abnormal is tracking all the users in one specific IP range and associating it was a company, likely with their emails. I never touched the targeting section of the stack, but I presume that's possible but not "normal."
>The sheer volume of traffic makes it virtually impossible to vet even a fraction of it
No, it doesn't. Your company is too much of a cheap fuck to do it and would rather offload that cost on society, no matter how bad the effects of it is.
>There is no such thing as "ad provider."
Only when it's to your advantage, because you're very happy to refer to yourself as an ad provider in every single marketing piece.
>AdTech engineer here (some 13 years in the industry)
You've made the world miserable for the past 13 years and have the gall to come over and pretend you're a poor innocent little thing who can't do nothing UwU there's just too much how could we be held responsible.
Also, society/law is willing to let them do it/get away with it, rather than holding them responsible.
Not to jump on you after everyone else did (although I agree with them), but they didn't give you a solution. The solution is unfortunately for everyone a robust KYC regime. Then the linkages stop being impossible to track and instead become merely burdensome.
> AdTech engineer here (some 13 years in the industry).
How do you even plan to explain it to your grand-children?
Obvious sarcasm aside, I compel you to ponder on this question next time you read "free" content on the web (a newspaper, a dedicated niche site or anything in between).
Former Adtech dev here - yeah, that justification worked for me for a while but when I was ordered to "just go look at this porn site and figure out what they're doing to open popunders despite the latest browser updates and then apply it to our adverts" too many times, I jumped ship.
But sure, "free content cos adverts", you keep believing that for as long as you can, I jumped ship after 13 years of it, which ironically appears to be how long you've been in the industry.
Let me just say though - adverts can still support free content without all the absolutely scummy things the adtech industry does. You don't have to track users across everything you can possibly track them across to still make money - my former company at one point was going to partner with Shazam to track people via transponders in bus-stop / train station billboards.
That's not "supporting the free Internet", that's "making some amoral shareholders richer".
Hopefully you'll figure out the difference with a few more years under your belt.
I want to pay a real and honest price for everything.
I send them a dollar or two in Monero, anonymously. That has me for a year, no?
https://www.therage.co
Most free works on the web is produced by users who receive absolutely zero ad money or any direct compensation whatsoever.
If anything, the ad industry helps kill honest contributions because they financially reward dishonest ones who are better at playing the SEO game or other such tactics than they are at giving visitors what they are actually looking for.
And at the end of the day, ad-supported content isn't free at all because we all pay for it in the end - and much more than what the website receives because there are entire industries inbetween that take their cut.
Honestly, if a bunch of adverts going away got rid of "free" content, would that be all that bad? Most of the quality free content does not have ads on it. Ad supported content, or at least those using traditional ad networks, tends to be bottom of the barrel.
After all, this website doesn't have (traditional) ads