A mass surveillance system for national security based on advertising/RTB data | Hacker News Reader

A mass surveillance system for national security based on advertising/RTB data

twitter.com

65 pointswchr21 comments

Worth highlighting

> Btw. Patternz does not only offer monitoring based on advertising data, but also targeted attacks by sending "targeted messages, ads or trojans directly through the AdTech stack".

If you need more reason to use ad-block, though I doubt it will be effective prevention if it's operating at the DOM level

I'm glad I'm using Qubes OS, so that only my disposable VM would be compromized in such attack.

Question to adtech folks, from the author of the linked thread.

Nuviad, the DSP that appears to be linked to the surveillance/spytech system Patternz, claims to analyze '700k ad opportunities every second' (https://twitter.com/WolfieChristl/status/1724805640974168341).

How could they do so? I mean, this company is far from a tier-1 DSP. Could they pretend to be a bidder and listen to such a high volume of bid requests without actually bidding/winning most of them? Is the number just exaggerated? Are there other ways of how they could get access to such a high volume of bid requests? In 2018, Nuviad acquired a viewability vendor (realvu.com). Could this perhaps be a major source?

They could perhaps bid but intentionally not win much. I think the harder part would be to represent themselves as a legitimate buyer, with some level of spend, which probably wouldn't be too difficult either, but it's a question of value I suppose: if they have customers with deep pockets, no big deal. The platform I work on aggregates about 3-4M qps so getting 700K qps is certainly feasible.

I suspect this type of thing is more common than people realize but I have no evidence to support the suspicion.

Thanks, appreciated!

There is now some publicly available evidence about 5-10 'Western' actors operating DSPs (or partnering with DSPs) for natsec or 'cybersecurity' purposes. Still no evidence about actors from other regions, but...

A quick google on RTB:

> Bidstream data, short for bidstream location data, is any data connected to a publisher’s bid request. This includes data on the website or app, the ad format, as well as the visitor’s device type and their IP address.

>This information is passed to the advertiser in order to allow them to decide whether to bid for the ad unit via real-time bidding (RTB).

I had no idea this data was getting shared with so many people before the ads were even shown. All the more reason to ad block / dns ad block.

Do adblocks actually lie or spoof to the extent that adblocking isn't literally just making it all invisible despite the fact its still going on?

I'm suspecting there are server-side scripts on many sites which relay data to the RTB system? So blocking ads won't prevent this data from being transmitted then?

https://digiday.com/marketing/wtf-is-server-side-conversion-...

https://sanjeev-pandey.medium.com/ad-tracking-in-server-side...

This jives with my intuition and it leads me to the point where I believe we need to stop with all this "imposed honesty". Software needs to start lying and quit being so fortright with that and those who have zero entitlement to it or who can be simply be bypassed. Isn't that the whole logical finale of the whole web integrity/TPM crap? Making everything even more like China?

I agree: browsers need to start lying. We as a society should bite the bullet and start lying by honey potting as often as possible. If every web site also ran a WordPress login Honeypot, an ssh Honeypot like endlessh, and everyone answered every spam phone call, those activities would cease to be profitable. I bet a 25% answer and waste spammer time rate would eliminate phone scams in a few months.

Does anyone else notice how going on the internet is literally like being traffic stopped at every goddamn stop?! You spend more time being forced to "identify" or "be profiled" and you almost spend as much time being stopped and scolded and forced to comply than whatever you were even looking for in the first place

Edit: license and registration == ip address (whats the deal with MAC addys?) browser fingerprint (gonna need to take your prints pre-charge)

Edit: there was an article a while back about how the commercial hellishness of thr internet (which this is all a big part of) is driving folks to less advertisey/closed walls like HN, private groups (Discord, Matrix), etc. I don't see why everyone can't do something similar to HN and cut the rest of the bullshit but I feel like yCombinator "gets" way more requisite or accrued value by offering this forun than it actually costs or hurts them

There's a variant called "header bidding" that got a bit of positive PR during an antitrust investigation of Google last year, e.g.:

https://www.theregister.com/2022/03/11/cma_ec_blue_jedi/

"The innovation of header bidding "promised to bypass Google's stranglehold on the exchange market," as detailed in a complaint filed in the US in a New York district court last year."

But note that it's just a way to blast your personal info across even more ad networks!

Privacy and "free and open market" are opposing forces here - the most private way to implement personalised ads is that all bids and targeting info is kept by a single ad exchange who matches and serves ads without sending personal info back to the advertisers. (Though not really because it's still strictly better to just block all personalized ads, of course.)

They also explain that the smartphone became a 'de-facto tracking bracelet'

... that people buy themselves!

https://nitter.net/WolfieChristl/status/1724403996738171157

https://mastodon.social/@wchr/111410591996456032

I've said on HN news before,and will say it again.

Duckduckgo browser's "App Tracking Protection" feature on Android is a real eye opener.

A similar Intercept article was posted on HN a while back, and got limited discussion: https://news.ycombinator.com/item?id=31127965

As much as HN hates advertising, so many seem ignorant of how much of the ecosystem works. I guess lots of people simply work for companies involved in these schemes, so they simply turn a blind eye or feign ignorance.

Adtech is no joke. Most of what non-adtech technical folk understand about it is just a few centimeters of the tip of an iceberg.

I simply left the adtech industry entirely after having to make the decision to level-up my career by taking an offer from one of the largest DSPs and after years of seeing my work used nefariously.

I didn't see mentions of MMPs like Appsflyer or Adjust?

Author of the linked thread here. Interesting remark. Measurement is always underdiscussed, including in my research. Any idea about how RTB data (or data similar to it) could flow to a spytech firm via MMPs?

Hey, sorry I don't easily see replies unless I click threads. Anyways, feel free to let me know if you want to discuss more off hn.

My thought with the original Twitter link above was that most of that is fake data, which for actual surveillance wouldn't help much. MMP data is way more likely to be the real deal. MMPs provide this data to most ad networks and MMPs via postbacks of ALL installs (not just the ones related to the ads shown).

Reply on news.ycombinator.com