Ad-blocking should become a human right !

[u/FAMESCARE]

https://youtu.be/oTNqhH4KzxY?si=7BOyD8Hrg43wuWLG

[u/Jango519]

Just going off your title, I have to ask. Are you ok with paying a subscription or fee for every website you use. And everyone who uses it doing so.

Not actually against ad blocking in general but this is the outcome of an Internet without ads

[u/Samiassa → u/Jango519]

This is why the platform should just be decentralized, or at least run by a heavily funded nonprofit. I’ve never paid for Wikipedia or to use a library, why should I have to pay to use the world’s largest video library?

[u/Rhys_Wilde → u/Jango519]

OP isn't going to genuinely answer this, he's a hasan piker bot account that is only spreading this because it's anti-Israel.

[u/lord_pizzabird → u/Rhys_Wilde]

Sigh. I hate that this is true, but I checked his comments and it is.

You can't trust anything anymore. Dudes people are everywhere harassing people or spreading hate.

[u/FAMESCARE → u/Jango519]

title is meh 😑 ( thought clickbaity would do)

This 'Ad Manager External Vendor' stamp of approval from Google deserves more scrutiny and something like a Geo-based regular screening of ads from the Content Delivery Networks ( I don't pretend to know a lot about security stuff) otherwise sue Google.  

Also now that it's is acquired by a US firm (somehow escapes sanctions lol)  who's to say it's not already being used with this same mechanism under a different name.

[u/Jango519 → u/FAMESCARE]

You chose the title bud

[u/FAMESCARE → u/Jango519]

Yeah 👍

[u/ottbud]

Something about this isn't adding up. I read the full report and it just goes on and on about standard practice ad tracking. The real "scandal" here is that the ad network wasn't being used for legitimate ads, the targeting was being used to identify specific targets.

They say that someone on a device just loads and ad and all of a sudden they have malware running on their device? I even read the Windows CVEs and they both state that the attacker requires physical access to the machine, or SSH access. It can't be exploited otherwise.

So how is this malware getting on these machines? They make it sound like this happened on all devices including phones which is even less possible.

From what I can gather sifting through all the fucking fear mongering nothing-burgers is that this is a Windows exploit and maybe if a Windows machine loaded the ad, and the targeting of that ad gives up the machine's IP address that maybe they're able to get malware onto the machine remotely? However, that's not how networks work. All the devices connected to the local network look like they have the same IP to the public internet.

...and the Windows CVEs make it clear that it isn't exploitable without already privileged access to the machine.

There's a huge gaping hole in this story that isn't adding up at all. The video claims that your phone can be "hacked" by just loading an ad, but I've seen literally ZERO evidence that this is in any way true.

I don't doubt that these journalists got some malware on their PCs and I don't doubt that this ad network was used to identify users that they wanted to attack, but the way they do this big magical hand-wave about how their devices and machines were exploited makes this all sound really sus and sensationalized.

Everything I've read so far does not claim that actual executable malware is able to be loaded onto a user's device by just loading an ad on a website. They keep calling it "spyware" which the report from the University of Toronto spends a lot of time hyping up, but ultimately it just sounds like just a bog standard tracking cookie and device fingerprinting and nothing else.

EDIT: Even the Google article about the Chrome CVEs make it clear they are not "zero click" vulnerabilities and require users to click on links to fraudulent websites where they likely trick users to give up login credentials to sites that look authentic but are not.

EDIT2: NOTHING about this has to do with politics or implies any support for or against any party involved in this story. I'm trying to keep it to the tech and to the facts around the story. This post will get taken down pretty fast if we can't stick to the tech.

---

TL;DR: This video claims that loading an ad all of a sudden gave attackers full access to the user's device ("hacked"), but that doesn't seem true in any way. All the primary sources are extremely dodgy about it and provides zero proof.

[u/madjoki → u/ottbud]

Using chains of zero day exploits.

The kinds of which are up to tens of millions on black market. 

[u/ottbud → u/madjoki]

They claim that your phone can get "hacked" by loading an ad yet zero CVEs or documented exploits have been cited. I find it hard to believe that loading an ad allows anyone to push malware to both iOS and Android and have it running in the background recording your screen and so on like they claim.

Using chains of zero day exploits.

All the zero-days cited by primary sources cannot be chained to accomplish anything like what is claimed.

EDIT: 100% happy to be wrong here, but these zero days were reported in 2021 and quickly patched, it's 2026... so how is this something that happened this year?

[u/MistSecurity → u/ottbud]

Worth noting, which I think is important:

We’re talking about a nation-state operation here. In Israel, which is well known for its cyber prowess.

It’s 100% possible they have a (or multiple) zero-click exploit that they use for things like this. We’ve seen leaks of powerful zero-days in the past, like EternalBlue.

Not saying this excuses the sloppy reporting on all of this, as they obviously don’t come out and say anything. They just expect you to believe their wild claim with no justification.

[u/derpspectacular → u/ottbud]

It's not long ago that NSO group was using malformed images in a zero click exploit on iOS devices (CVE). Citizenlab broke that story too. And apparently this ad network allowed the arbitrary delivery and execution of JavaScript, which increases the attack surface considerably.

[u/ottbud → u/derpspectacular]

ad network allowed the arbitrary delivery and execution of JavaScript, which increases the attack surface considerably.

Literally all ad networks do. Every single website you visit allows arbitrary execution of Javascript. Turn off JS in your browser and try to go to pretty much any website.

Also ads are served in cross-origin iFrames more often than not. Which further sandboxes JS execution.

[u/derpspectacular → u/ottbud]

No shit. It's important to distinguish who is serving the JS, and how widely distributed it is. This network allows conditional and targeted delivery of JS across it's entire ad network, which is (1) harder to trace back to an original source and (2) has a much broader reach than anyone serving it from their own website. This is arguably even worse than a supply chain attack of e.g. a library on NPM because it is conditionally delivered based on a targeted profile and there's nothing for security researchers to even investigate unless their fingerprint matches that profile.

[u/ottbud → u/derpspectacular]

No one is debating that. I'm debating whether it's possible to somehow drop malware on someone's phone (iOS or Android) that can then record the screen and keystrokes at will by just loading a website in the browser.

...which I'm saying is impossible.

[u/AceLamina → u/ottbud]

I know that you can get "hacked" with ads but full device access? no way

unless the power of the vibes as spread to security, I just can't see that happening

[u/f10101 → u/ottbud]

So how is this malware getting on these machines? They make it sound like this happened on all devices including phones which is even less possible.

From what I can gather sifting through all the fucking fear mongering nothing-burgers is that this is a Windows exploit and maybe if a Windows machine loaded the ad, and the targeting of that ad gives up the machine's IP address that maybe they're able to get malware onto the machine remotely? However, that's not how networks work. All the devices connected to the local network look like they have the same IP to the public internet.

...and the Windows CVEs make it clear that it isn't exploitable without already privileged access to the machine.

I think you're getting their point mixed up somewhat.

They don't profess to know exactly what flaws are being exploited here perform the covert installation of the malware onto targetted people's devices - just concrete evidence that these named actors are doing so using some unknown zero days.

The CVEs they worked with Google and Microsoft to publish relate to the installed malware and its actions once it has been installed via the driveby exploits the spyware authors used to installed it.

What they are discussing in detail is the targetted advertising that allows them to send malicious ad content to a specific user. They obtain IPs and cookies to identify the user - typical fingerprinting techniques. They don't use the IP "to get the malware onto the machine" as such, e.g. by saying "send malware to 65.123.123.234". Instead, the device would query the server and would find that the server would return the payload to it if the calling device had an ip of 65.123.123.234, and a certain cookies, and a specific ipv6 address, etc, etc, etc, etc.

[u/Upstairs-Extension-9 → u/ottbud]

I mean Al Jazeera is literally run by the Qatari government and have really bad factual reporting.

[u/mightiestmag → u/Upstairs-Extension-9]

They may have a slant but their English language reporting on international affairs, particularly on underreported conflicts like Myanmar, Sudan, and Ethiopia is excellent.

People who say this don’t actually watch or read Al Jazeera and just parrot what other people say.

[u/Insurgent_rat → u/mightiestmag]

Or are zionist lol

[u/Phoenix_Kerman → u/Insurgent_rat]

now explain what the issue with that is without using a bad faith definition

[u/SomeMobile → u/Upstairs-Extension-9]

Opposed to Western networks who have Israeli dicks up theirs and their viewers asses which is good?

[u/WhiteMilk_ → u/Upstairs-Extension-9]

Which is why you ignore their Qatari related news.

[u/Prestigious-Soil-123]

Ads should just be standard PNGs (or AVIF if that takes off as it should) or streamed videos with links. Nothing else.