Abstract:
Cybersecurity researchers have discovered that Discover-Tech, an Israeli advertising technology company, is suspected of using the Internet advertising system to target users of Starlink, a satellite Internet service owned by SpaceX, on a large scale, and may use this to obtain users' geographical location and other sensitive information. Six people familiar with the investigation said that the TrendAI team, owned by cybersecurity company Trend Micro, believes that Discover-Tech is an important bidder for ads exposed to Starlink users in many countries around the world, and that its activity patterns are significantly different from normal commercial advertising business.
Researchers analyzed digital advertising telemetry data collected by TrendAI and found that Discover-Tech ranked first in ad auctions targeting Starlink users in more than 100 countries and regions, including some that ban or restrict Starlink services. Advertising bidding is a common mechanism in the Internet advertising industry. Advertisers use real-time bidding to strive to display ads on websites or applications visited by users. However, the data generated during the bidding process may also expose the user's device, network environment and other information, providing opportunities to track users.
SpaceX has not responded to Reuters' request for comment. Discover-Tech and its CEO Decker Boney also did not respond to inquiries in the two weeks before the report was published.
TrendAI released a report on October 15th that Starlink users were subject to abnormal advertising targeting, but did not disclose the name of the company involved, instead calling the relevant entity "Shadow-Earth-79". The codename actually corresponds to Discover-Tech, six people familiar with the matter said. TrendAI did not directly explain why it did not publicly name the company, but said its attribution approach was designed to reduce the risk of misidentification and avoid using labels that could mislead defenders, distort risk judgments, or trigger inappropriate responses.
Researchers believe that the relevant advertising activities may not have the main purpose of promoting ordinary products, but use the advertising system to collect information that can identify and target Starlink users. Satellite internet terminals transmit data via satellites operated by SpaceX, rather than relying entirely on traditional locally regulated telecommunications networks, allowing them to bypass internet restrictions in some cases and provide communication channels for those in conflict zones. This also makes Starlink users targets with special intelligence value.
Starlink is particularly important in Ukraine. The Ukrainian military relies on the service to maintain frontline communications and uses it to coordinate drone strikes. In conflict areas, being able to determine the location of satellite Internet terminals may help relevant parties identify personnel activities, communication nodes and even military installations. Therefore, the technical and commercial activities surrounding Starlink user tracking have gradually attracted the attention of governments and cybersecurity researchers in recent years.
In May of this year, the Israeli media Haaretz and the intelligence industry website Intelligence Online reported separately that some Israeli companies were selling methods to customers to identify and track Starlink users. Haaretz pointed out at the time that utilizing digital advertising data could be an important part of the technology. The latest investigation further highlights the potential for ad bidding mechanisms to be used for intelligence-gathering activities that go beyond traditional commercial marketing.
In fact, Discover-Tech is already under investigation for allegedly exploiting advertising systems to conduct a broader surveillance campaign. On the same day that TrendAI released the relevant report, Canadian cybersecurity research organization Citizen Lab and New York advertising technology company Confiant respectively publicly identified Discover-Tech, saying that the company was suspected of abusing the digital advertising bidding mechanism and collecting Internet user data.
During the advertising transaction process, bidders may obtain information related to user equipment and network activities. If this data is continuously collected and correlated with information from other sources, it may be possible to gradually remove a user's anonymity, identify specific individuals, and track their activities across different websites and applications. In some cases, this information may also be used to filter targets and further deliver ads with surveillance or malicious code.
Citizen Lab and Confiant said Discover-Tech's ads appeared in dozens of sensitive online environments involving media organizations, government agencies and technology companies. After the investigation became public, Google, Comcast and other companies said they had removed Discover-Tech from their respective advertising platforms. At least one major U.S. technology company and an international organization have launched internal investigations to determine whether the company's ads have targeted its employees, people familiar with the matter said.
TrendAI’s investigation also found that Shadow-Earth-79 was the largest buyer in ad auctions in Syria, Libya, Yemen and South Sudan, and ranked second in Afghanistan. Some of these areas are subject to sanctions or are in the midst of armed conflicts, and normal Western commercial advertising needs are relatively limited. The researchers therefore believe that the entity's unusually high bidding share in these markets is difficult to fully explain by ordinary advertising business.
The report also noted that the entity won an unusually high proportion of ad auctions in countries including Hungary, Israel, Egypt, Azerbaijan and Venezuela. Researchers believe that these models are more like infrastructure for targeting and tracking rather than commercial advertising operations whose main purpose is to sell goods or services.
TrendAI researchers seriously considered naming Discover-Tech directly in the report, but ultimately backed away from that approach after company management raised legal risk concerns, according to six people familiar with the matter. Five of the sources said legal risks were an important factor in the decision not to disclose the attribution.
Reuters pointed out that the cybersecurity industry often faces complex trade-offs between technical evidence, legal liability and commercial interests when publicly identifying suspected espionage perpetrators. Research institutions may have enough evidence of unusual activities to cause alarm, but they may not be able to establish a sufficiently definite connection between each technical discovery and a specific company in public reports.
Earlier this year, US cybersecurity company Palo Alto Networks also caused controversy over its report on attribution of global cyber espionage activity. Reuters reported at the time that the company had removed explicit references to China from its report. Palo Alto Networks denied that its handling was related to China's purchasing restrictions and said that the relevant claims lacked basis.
This incident reflects that the digital advertising industry may face security risks that go beyond traditional privacy protection. The advertising system was originally used to deliver commercial information based on user interests and behaviors, but the data generated during the real-time bidding process may also be used to identify specific groups of people, infer geographical locations, and even provide target information for subsequent cyber attacks.
For Starlink users, the risk is of particular concern because satellite internet is often used in areas where traditional network infrastructure is limited, communications are censored, or where armed conflict exists. Users may think they are just browsing the web or using normal apps, but during the ad loading and bidding processes they are exposing information that can be collected by third parties.
However, the current public investigation results mainly point to abnormal advertising bidding behavior and its possible tracking purposes. It is not enough to prove that every auction of Discover-Tech has espionage purposes, nor can it be concluded that all Starlink users have been successfully targeted. Relevant accusations still need to be judged based on further technical evidence and investigation results.
As the connections between digital advertising, data analytics, and commercial spyware receive more attention, how to limit the leakage of sensitive data in ad bidding systems, strengthen advertising platforms’ scrutiny of bidders, and prevent legitimate advertising infrastructure from being used for surveillance and cyber attacks is becoming an urgent issue in the cybersecurity field.
Comments