https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

When a publisher of an app or website wishes to show ads, they add code from an SSP to their app or site. This code collects and shares granular information about the user and their device with ad exchanges to solicit bids for the ad slots. This information can include device identifiers and characteristics, precise location, and IP address data, as well as data about the app or website, and specifications about the ad slot. The DSP or advertiser then examines this information and decides whether they wish to bid on the impression in order to show an ad. The auction system is designed to enable targeting single individuals based on their mobile advertising ID, cookie ID, IP address, and other identifiers.

Beyond passive data harvesting, malicious parties can also exploit this infrastructure to target certain individuals based on user data included in ad auctions and then run malicious code on their devices. Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user. That code retrieves additional JavaScript code, which may, in turn, load further code, such as a browser exploit to install spyware. Since the code can contain identifiers for the user or their device, arbitrary JavaScript code can be sent precisely to a single users device.

We present technical evidence that the Israel-based company Discover-Tech, while purporting to be a legitimate advertising company, appears to be a front for large-scale ad espionage abuse, including the automatic delivery of mercenary spyware when ads are displayed to a target and the mass profiling and deanonymization of users.

tldr: firma z państwa położonego gdzie chce kupowała reklamy i umożliwiała komu trzeba mosadowi publikowanie reklam, które dokonywały kompromitacji cwela na specjalnie wyselekcjonowanych użytkownikach
ale pamiętajcie, bez reklam internet nie przeżyje

#programista15k #programowanie #kolchoz #korposwiat #pracbaza #praca #polska #pracait #januszex