Researchers: Israeli company used electronic ads to spy on users

Two research groups reported on Thursday that the Israeli digital advertising agency “Discover-Tech” spied on internet users through a vast network of online ads used to track specific targets and help breach their devices.

The two reports show how the online advertising sector, which has long raised privacy concerns, can also serve as a channel for executing large-scale espionage campaigns.

Wolfie Christl, a researcher at Citizen Lab, told Reuters, “The way online advertising works today represents a systematic security threat,” adding that this applies to “governments, the private sector, civil society, and everyone alike.”

Citizen Lab stated that Discover-Tech’s online ads, which often promoted ordinary products such as smartphones and earbuds, reached more than 120,000 websites and 75,000 apps through various partnerships.

Researchers said that users who visited websites or used apps containing malicious ads could be identified and tracked by Discover-Tech, which sometimes also attempted to extract phone numbers from some smartphone users. The ads required only to be loaded on a website for the spying to occur.

Both research groups noted that some ads were used to help implant Candiru spyware on users’ devices, although Covariant said that the ads linked to Candiru represented only a small fraction of Discover-Tech’s total ad volume.

Jerome Dangoor, co-founder of Covariant, said that Discover-Tech served at least 10 million ads daily worldwide, and that data-sharing arrangements known as “cookie matching” allowed it to track individuals even outside the reach of its own ads.