Israeli digital advertising agency Discover-Tech has been accused of spying on internet users through a vast network of ads, allowing it to track individuals and assist in hacking their devices, as reported by Citizen Lab and Confiant. Discover-Tech enabled access to various online advertising platforms for Candiru, a spyware firm blacklisted by the US, among other surveillance companies. The reports indicate that the online ad industry, long criticized for privacy issues, can also facilitate extensive spying operations.
Discover-Tech’s ads, frequently for everyday products, reached over 120,000 websites and 75,000 apps. Users visiting these sites or using the apps were tracked and identified, with attempts to extract phone numbers from some mobile users. Simply loading an ad on a webpage could initiate this spying process. Some ads were specifically utilized to install spyware from Candiru, although Candiru’s ads were a small part of Discover-Tech’s total ad volume.
Confiant’s cofounder noted that Discover-Tech was generating at least 10 million ads daily worldwide, utilizing data-sharing practices that allowed it to track individuals beyond the scope of its advertisements. This meant potentially hundreds of millions of people could have been impacted by its activities. Founded in 2020, Discover-Tech did not respond to requests for comment.
Reports indicated that a powerful form of Candiru spyware had been used in attacks on 45 Windows devices associated with the Qatari broadcaster Al Jazeera. Additionally, the malicious ads were reportedly displayed to users in sensitive networks, including military and international organizations like the Pentagon, International Atomic Energy Agency, and International Criminal Court, as well as various companies in the tech sector.
Citizen Lab found evidence of Discover-Tech’s ads affecting users at the United Nations, NATO, and several national governments. The advertising firm had, unknowingly, disclosed its authentication logs, revealing login information from users in Israel, Europe, and the Gulf.
In response to these allegations, Discover-Tech has faced significant consequences in the online advertising market. Google terminated its relationship with Discover-Tech, stating the company violated policies. Similarly, IAB Europe suspended Discover-Tech after an audit while Comcast’s ad tech subsidiary also removed the company from its platform. There is a growing concern about advertising-based surveillance being a national security threat, prompting military branches to disable ad tracking on some devices.
With information from Reuters
