Pegasus: How a Spy in Your Pocket Threatens the End of Privacy, Dignity, and Democracy by Lauret Richard
Israel has a lot of enemies that going against them. Which is why they have incentive to be good at this - to attack back. Corporate attempts are just ways to make money.
I'm going to stay out of the political issue of what any actor should do.
Why do you think that is?
A lot of the immediate neighbors attacked Israel at its birth, and further away countries just seem to hate Israel due to religion/ethnicity/populism (?), countries like Pakistan, Malaysia, etc.
Like immagine if the rhetoric of Turkey was constantly talking about expanding to Greece and how the land of Greece is historically the Turks. Obviously that would make any Greek uneasy.
That easy huh
The reason is that Israel is a genocidal country.
If Mossad is willing to give you a hundred million to make your startup a spyware company, you're obviously going to agree.
But something tells me that the way you framed your question, is not about the companies and more about you and how you view Israel.
> The same reason why many great tech companies originate from Israel. That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
You never specified what the reason for that is. Their society doesn't seem more tech-oriented than comparable countries. Their universities are OK, but not the best in the world. So what in their society caused this?
wait - what's the reason, though? i don't understand what you're trying to say.
> That's why Nvidia is the largest private employer in Israel. Why Apple's CTO is from Israel.
you cite two american companies with presence in Israel to defend your claim that "many great tech companies originate from Israel".
> is not about the companies and more about you and how you view Israel
your entire response is predicated on your view of Israel but you haven't explained what your view actually is or what it's based on.
Games are an underrated vector for similar campaigns.
Edit: for the doubters, malware-via-game has already been happening https://www.malwarebytes.com/blog/news/2025/07/steam-games-a...
Only Jewish pedophiles & criminals. Israel will not let in random non-Jewish criminals to flee prosecution, only those who are provably Jewish are granted citizenship and non-extradition.
I guess that your concerns are not aligned with reality, or the benefits far outweigh whatever it is you think may happen.
(Talking as an Israeli working in cybersecurity)
It's possible for this to be true, and that they spy on said companies on behalf of the government of Israel. It makes it easier to do so.
* https://citizenlab.ca/research/how-discover-tech-turned-targ...
Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Totally not useless. It costs a lot more to pay a spyware firm then to have an employee send an email / ask a judge (like that's even necessary).
I feel quite confident of my messages privacy on my Pixel with GrapheneOS given most people I message are on iPhones which are second in security to Pixels running GrapheneOS. Not to mention my threat model doesn't include mercenary spyware, as most people's doesn't.
From being hacked by others. Google was just trying to protect their property, which is the ability to spy on their users' every move. Google themselves really don't need to "hack" their users for that, they already have all the access and all the data they could ever want. And they also have the ability to brick their users' devices at a moment's notice the same as Apple does.
If you're talking about the sideloading restrictions those were intended to stop social engineering and scams, not from getting hacked via 0days.
>Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.
Source? play services is privileged but not that privileged.
In fact, following the OP's link to https://citizenlab.ca/research/how-discover-tech-turned-targ..., "the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries" so it's not just apps but ordinary websites you visit in your android chrome browser.
No info on if a recent version patches this?
It also mentions a "Windows DLL" - so they're somehow infecting Windows desktop too?
It is no different that Israel's location tracking of StarLink terminals worldwide: https://www.newarab.com/news/israel-tech-firms-can-locate-an...
This is the same issue that the US government has with Chinese networking companies, it is too easy for the Chinese government to pressure these Chinese networking companies to put in back doors in the interests of national security. The US likely knows this because it pressures its own companies in similar ways.
I think the only technical solution available to individuals is to boycott non-verifiably e2ee services and corporate operating systems (especially including android).
If the world moved that way overnight, I wonder where digital spy budgets would go. Into traditional techniques, cracking encryption, banning encryption, or a more educated guess?
just to confirm your info... https://buenosairesherald.com/society/argentine-teenager-pla...
If you put out a fire how many are you allowed to set while people applaud selectively?
I don’t think they’re striking a good balance between how invasive they are compared to the real results they deliver.
Can we get an alien invasion already please, god
Absolute morons.
Article on the CitizenLab website: https://citizenlab.ca/research/how-discover-tech-turned-targ...
It’s to do with hiding malware/spyware in an image which ends up in your cache on device. I can’t go much further into details but all this takes is for you to visit a site that serves it via ad network.
Israel has been known to have some sneaky spyware in the past with Pegasus.
Then the ad network delivers a targeted ad that exploits a vulnerability (eg a broken JPEG decoder that, when sent a bad image, allows to run arbitrary code on your machine), and from there you have access to the computer
- It came in through the front door. Discover-Tech ran its own ad-buying platform and was listed as a "certified" vendor by Google and IAB Europe for six years. Nothing was hacked to get in. It bid in ad auctions like any other buyer.
- The ads looked harmless. Plain banners for games, AliExpress deals and an IP-lookup site. Hidden inside each one was a small script that quietly phoned home when the ad loaded.
- Everyone who saw an ad was profiled. The script collected device details, IP addresses and, on many sites, the publisher's own cookies, sometimes including logged-in session tokens. Cookie-syncing with other ad networks built a huge identity graph.
- Only chosen targets got the payload. A gatekeeper server checked each device's ad ID and IP. Most people got nothing back. A selected target got code that handed them off to spyware maker Candiru, and the code was served only once, which made it very hard for researchers to capture.
- The handoff was built to defeat inspection. Encrypted channels, rotating hosting, anti-bot checks and even a fake "Copyright Google" comment to fool human reviewers.
- It worked. At least 45 devices at Al Jazeera were targeted, and spyware was recovered from an infected machine. Its ads also appeared on networks belonging to NATO, the UN, the European Parliament, the ICC and various defence ministries.
- The scale was huge. Billions of bids and ads in nearly 200,000 apps and websites, including Duolingo, Viber, Yahoo Mail, dating apps and period trackers, yet almost no sign of real advertisers or revenue.
Citizen Lab: https://citizenlab.ca/research/how-discover-tech-turned-targ...
Confiant: https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zer...
Citizen Lab also has a shorter executive summary: https://citizenlab.ca/research/exposing-adfection-executive-...
Edit:
the TFA answers: "Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user." Its wild! I thought the ads are sanitized, go through a CDR of sorts, and whatever javascript is permitted is authored by ad networks, not the buyers. Sheesh. Thats just RCE.
RTB (real-time bidding) does not incentivise publishers to care about what ads are actually being shown to individual users, so long as CPM is maximised.
It’s a low-hanging fruit that has high value, particularly for less savvy internet users. Scams have always been the biggest threat. I’d say the majority of internet ads are scams, and the platforms often don’t make it clear what is or is not an ad.
But, we always knew the risk of malware was there. In the modern age, ads are basically never delivered as static assets. They’re delivered as small applications, with code. So, we’re relying on our sandboxing mechanics to work perfectly, and predictably they don’t. The solution is to block the code altogether; to block ads.
The ad-tech network probably does make it easier, because any page that includes their ad network could deliver the malicious ad.
Streaming services used to be bad enough with ads in the shows, now they put an ad on the screen when you pause it. Peacock just started putting ads in the login screen.
If we don't stop this, pretty soon they're going to have ads in the stars as satellite constellations arrange themselves to sell you Twitter subscriptions. They're not going to stop even when there's an ad no matter where you look.
I'm reminded of the ending of the 2008 film Hancock in which Hancock defaced the moon with a corporate logo. But it was okay because it was "for a good cause".
In fact, just update the url and title to the report:
How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
https://citizenlab.ca/research/how-discover-tech-turned-targ...
Wild guess even if not in this particular case it's best to consider the possibility as non theoretical.
https://www.packetlabs.net/posts/demystifying-the-market-for...
I don't know if an ad blocker protects against Discover-Tech’s Controlium but in general you'd be a fool to allow ads in your browser in at this point. The ad industry is pretty shady all round.
One must wonder how many were genuine vs an influence op.
This crap is the worst of the worst.
Dang's official position by the way https://news.ycombinator.com/item?id=48100358 let's see how this thread goes.
Yet we don't sanction Israel nor hold them accountable in any way. Of course they're spying on members of the UN and ICC, of course. Israel is at war with the entire world right now, and my politicians continue to support them. Thankfully many people have woken up, but the situation is dire.
Based on responses from roughly 46,700 people assessing 129 countries, Israel ranked as the most negatively perceived country worldwide, ahead of North Korea, Afghanistan, and Iran. The most positively viewed were Switzerland, Canada, Japan, Sweden, and Italy.
https://www.middleeastmonitor.com/20260513-israel-becomes-wo...
I will never vote for this particular (D) candidate again. Fortunately, the (L) candidate seems reasonable.
If indeed your representatives support Israel or the genocide in Gaza, I urge you to consider voting 3rd party. In two-party elections, candidates mostly just try to be a little better than their opponent. What forces them to do more isn’t a third party actually winning. It’s a real risk that enough fed-up voters will go third-party and cost them the election. This is basic game theory optimization.
Israel is at war with Hamas, Iran and its proxies and allies.
edit: and I have been hasbar'd now for simply stating the fact that making people fear you instead of love you has consequences. oh well.