Researchers say Discover-Tech used online ads to track users and help install spyware

New York, United States. Israeli digital advertising agency Discover-Tech used an extensive advertising network to monitor internet users and assist attempts to hack their devices, according to findings released Thursday by two research groups.

Advertising platforms linked to surveillance services

Separate reports by Citizen Lab, a Canadian cybersecurity watchdog, and Confiant, an advertising security company based in New York, said Discover-Tech provided services that enabled Israeli surveillance companies to access advertising platforms. Those companies included Candiru, a spyware producer blacklisted by the US government.

The platforms involved were operated by Google, Comcast, Russia’s Yandex and other companies, according to the reports.

The findings indicate that online advertising, already under scrutiny over privacy, can provide a route for widespread espionage operations.

Citizen Lab senior researcher Wolfie Cristl told Reuters that the current workings of online advertising posed a systemic security threat affecting governments, businesses, civil society and everyone else.

Tracking through websites and apps

Citizen Lab said Discover-Tech’s partnerships distributed its advertisements across over 120,000 websites and 75,000 apps. The ads frequently promoted everyday products, including phones and earpods.

According to the researchers, Discover-Tech could identify and follow people visiting websites or using apps carrying the malicious advertisements. In some cases, it also attempted to obtain smartphone users’ phone numbers. The researchers said an advertisement merely had to load on a website to enable the surveillance.

Both groups said some advertisements helped place Candiru spyware on users’ devices. However, Confiant said the advertisements it linked to Candiru represented only a very small share of Discover-Tech’s total advertising activity.

Confiant cofounder Jerome Dangu said Discover-Tech distributed a minimum of 10 million advertisements worldwide each day. He said data-sharing agreements known as cookie matching enabled the agency to follow people outside the areas reached by its own advertisements.

“Very likely hundreds of millions of people would have been touched by Discover-Tech,” Dangu said.

No response from the company

Discover-Tech, established in 2020, did not respond to messages submitted through its contact form. Its chief executive, Dekel Boni, also did not reply to emails or a message sent through LinkedIn.