An Israeli advertising technology company allegedly targeted users of SpaceX's Starlink satellite internet service through ordinary online ads in a likely effort to spy on them, according to six people familiar with the research, Reuters reported on Tuesday. Researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, concluded that the company, Discover-Tech, was one of the biggest sources of digital ads shown to Starlink users, and that the ads were likely being used to geolocate or otherwise surveil them.
Source: Reuters via SRN News
The researchers drew on advertising data in TrendAI's own telemetry. They found Discover-Tech had become one of the world's leading bidders for ads aimed at Starlink users and was the No. 1 bidder on Starlink traffic in more than 100 countries — including several where Starlink itself is banned or restricted. Reporting based on the TrendAI data put the figure at 105 countries, with the firm taking 12.9% of winning bids on observed Starlink traffic against 2.6% across all web traffic, and leading ad buying in Syria, Libya, Yemen and South Sudan — countries where knowing who is using a satellite terminal, and where, can carry military significance.
TrendAI published its findings on October 15 in a report titled 'Invasive Ads: The Unconventional Cyber Surveillance Attack Surface', but it did not name Discover-Tech. It called the party responsible 'an ad-tech entity' and gave it the codename 'Shadow-Earth-79'. The six sources told Reuters that Shadow-Earth-79 is TrendAI's codename for Discover-Tech, and five of them said TrendAI researchers had discussed naming the company but dropped the idea after executives raised legal concerns. In a statement, TrendAI said its attribution approach was aimed at reducing the risk of mistakes and avoiding 'hype-driven labels' or 'unstable actor names'.
Source: TechCentral (Reuters)
On the same day as TrendAI's report, the University of Toronto's Citizen Lab and ad-tech firm Confiant identified Discover-Tech by name, alleging it had misused the advertising-bidding process. In online ad auctions, information about users can flow back to bidders; Citizen Lab and Confiant said such data could be combined with other information to identify users, track them online and, in some cases, target them with surveillance software. Discover-Tech was already under scrutiny over earlier allegations that it spied on internet users, The Business Standard reported.
Source: The Business Standard (Reuters)
What is solid
- TrendAI published an October 15 report describing heavy ad targeting of Starlink users by an entity it codenamed 'Shadow-Earth-79'
- Citizen Lab and Confiant named Discover-Tech in their own October 15 findings on misuse of ad bidding
- Discover-Tech, its chief executive and SpaceX did not respond to Reuters' requests for comment over two weeks
What is only claimed
- The identification of Shadow-Earth-79 as Discover-Tech rests on six unnamed people familiar with the research, speaking to Reuters
- That the ad buying was intended for surveillance or geolocation is the researchers' assessment, reported by Reuters — it has not been proven in court or confirmed by the companies involved
Starlink terminals are used by civilians, journalists, aid workers and militaries — including in Ukraine and across conflict zones in the Middle East and Africa — which is why researchers say a method that can locate terminal users through something as ordinary as an advertisement is a serious security concern. No government has announced any action over the findings, and neither SpaceX nor Discover-Tech has commented publicly.