网络安全研究人员发现，一家以色列广告科技公司 Discover-Tech 疑似利用互联网广告系统，大规模锁定 SpaceX 旗下卫星互联网服务 Starlink 的用户，可能借此获取用户地理位置及其他敏感信息。熟悉调查情况的六名人士透露，网络安全公司趋势科技旗下的 TrendAI 团队认为，Discover-Tech 是全球多个国家 Starlink 用户所接触广告的重要竞价方，其活动模式与正常商业广告业务存在明显差异。
研究人员分析了 TrendAI 收集的数字广告遥测数据，发现 Discover-Tech 在超过100个国家和地区针对 Starlink 用户的广告竞价中排名第一，其中包括部分禁止或限制 Starlink 服务的国家。广告竞价是互联网广告行业的常见机制，广告商通过实时竞价，争取在用户访问的网站或应用程序中展示广告。然而，竞价过程中产生的数据也可能暴露用户的设备、网络环境及其他信息，为追踪用户提供机会。
SpaceX 尚未回应路透社的置评请求。Discover-Tech 及其首席执行官德克尔·博尼也未在报道发布前两周内回应相关询问。
TrendAI 于10月15日发布了一份有关 Starlink 用户遭到异常广告定向的报告，但没有公开涉事公司的名称，而是将相关实体称为“Shadow-Earth-79”。六名知情人士表示，这一代号实际上对应 Discover-Tech。TrendAI 没有直接解释为何不公开点名该公司，而是表示，其归因方法旨在减少错误识别的风险，避免使用可能误导防御人员、扭曲风险判断或引发不恰当应对措施的标签。
研究人员认为，相关广告活动可能并非以推广普通商品为主要目的，而是利用广告系统收集能够识别和定位 Starlink 用户的信息。卫星互联网终端通过 SpaceX 运营的卫星传输数据，而非完全依赖当地受到监管的传统电信网络，因此能够在某些情况下绕过互联网限制，并为冲突地区的人员提供通信渠道。这也使 Starlink 用户成为具有特殊情报价值的目标。
Starlink 在乌克兰尤其重要。乌克兰军方依靠该服务维持前线通信，并将其用于协调无人机打击行动。在冲突地区，能够确定卫星互联网终端的位置，可能帮助有关方面识别人员活动、通信节点甚至军事设施。因此，围绕 Starlink 用户开展追踪的技术和商业活动，近年来逐渐引起政府及网络安全研究人员的关注。
今年5月，以色列媒体《国土报》和情报行业网站 Intelligence Online 曾分别报道称，一些以色列企业正在向客户推销识别和追踪 Starlink 用户的方法。《国土报》当时指出，利用数字广告数据可能是相关技术的重要组成部分。最新调查进一步凸显了广告竞价机制可能被用于超出传统商业营销范围的情报收集活动。
事实上，Discover-Tech 已经因涉嫌利用广告系统实施更广泛的监控活动而受到调查。TrendAI 发布相关报告的同一天，加拿大网络安全研究机构 Citizen Lab 与纽约广告技术公司 Confiant 分别公开指认 Discover-Tech，称该公司涉嫌滥用数字广告竞价机制，收集互联网用户数据。
在广告交易过程中，竞价方可能获得与用户设备和网络活动有关的信息。如果持续收集这些数据，并将其与其他来源的信息进行关联，就可能逐渐消除用户的匿名性，识别特定个人，并追踪其在不同网站和应用程序中的活动。在某些情况下，这些信息还可能被用于筛选目标，进一步投放具备监控或恶意代码的广告。
Citizen Lab 和 Confiant 表示，Discover-Tech 的广告曾出现在数十个敏感网络环境中，涉及媒体机构、政府部门和科技企业。调查公布后，Google、康卡斯特及其他公司表示，已将 Discover-Tech 从各自的广告平台中移除。另有知情人士称，至少一家大型美国科技公司和一个国际组织已启动内部调查，以确认该公司的广告是否曾针对其员工。
TrendAI 的调查还发现，Shadow-Earth-79 在叙利亚、利比亚、也门和南苏丹是广告竞价中的最大买家，在阿富汗则排名第二。这些地区部分受到制裁或正处于武装冲突之中，正常的西方商业广告需求相对有限。研究人员因此认为，该实体在这些市场取得的竞价份额异常突出，很难完全用普通广告业务解释。
报告还指出，该实体在匈牙利、以色列、埃及、阿塞拜疆和委内瑞拉等国家赢得了异常高比例的广告竞价。研究人员认为，这些模式更像是用于定向和追踪的基础设施，而非以销售商品或服务为主要目的的商业广告运营。
据六名知情人士透露，TrendAI 研究人员曾认真考虑在报告中直接点名 Discover-Tech，但在公司管理层提出法律风险顾虑后，最终放弃了这一做法。其中五名消息人士称，法律风险是决定不公开归因的重要因素之一。
路透社指出，网络安全行业在公开指认疑似间谍活动实施者时，往往面临技术证据、法律责任与商业利益之间的复杂权衡。研究机构可能掌握足以引起警惕的异常活动证据，却未必能够在公开报告中将每一项技术发现与具体公司建立足够确定的联系。
今年早些时候，美国网络安全公司 Palo Alto Networks 也曾因报告对全球网络间谍活动的归因问题引发争议。路透社当时报道称，该公司在报告中删除了明确指向中国的表述。Palo Alto Networks 则否认其处理方式与中国的采购限制有关，并称相关说法缺乏依据。
此次事件反映出，数字广告行业可能面临超出传统隐私保护范畴的安全风险。广告系统原本用于根据用户兴趣和行为投放商业信息，但实时竞价过程中产生的数据，也可能被用于识别特定人群、推断地理位置，甚至为后续网络攻击提供目标信息。
对于 Starlink 用户而言，风险尤其值得关注，因为卫星互联网经常被用于传统网络基础设施受限、通信受到审查或存在武装冲突的地区。用户可能以为自己只是浏览网页或使用普通应用程序，却在广告加载和竞价过程中暴露了能够被第三方收集的信息。
不过，目前公开的调查结果主要指向异常广告竞价行为及其可能的追踪用途，尚不足以证明 Discover-Tech 的每一次竞价都具有间谍目的，也不能据此认定所有 Starlink 用户都遭到成功定位。相关指控仍需结合进一步的技术证据和调查结果判断。
随着数字广告、数据分析和商业间谍软件之间的联系受到更多关注，如何限制广告竞价系统泄露敏感数据、加强广告平台对竞价方的审查，并防止合法广告基础设施被用于监控和网络攻击，正在成为网络安全领域亟待解决的问题。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Cybersecurity researchers have found that an Israeli advertising technology company, Discover-Tech, suspected to use the Internet advertising system to target users of SpaceX ' s satellite Internet service Starlink on a large scale, may be able to access users ' geographical location and other sensitive information. Six individuals familiar with the survey revealed that the Trend AI team, under the umbrella of Cybersecurity Trends Technology, considered Discovery-Tech to be an important bidder for advertising for Starlink users in many countries around the world, with a marked difference between their mode of activity and normal commercial advertising.
Researchers analysed the digital advertising telemetry data collected by Trend AI and found that Discover-Tech ranked first in advertising bids for Starlink users in over 100 countries and territories, including countries that partially prohibited or limited Starlink services. Advertising bids are a common mechanism in the Internet advertising industry, where advertisers seek to present advertisements on websites or applications accessed by users through real-time bids. However, the data generated during the bidding process may also expose the equipment, the network environment and other information of the user and provide an opportunity to track the user.
SpaceX has not yet responded to Reuters's request for evaluation. Discover-Tech and his chief executive officer, Decker Boni, also failed to respond to queries within two weeks of reporting on publish.
Transd AI, on 15 October, publish, in a report about the unusual advertising targeting of Starlink users, did not disclose the name of the company involved, but referred to the entity as “Shadow-Earth-79”. Six informed persons indicated that the code actually corresponded to Discover-Tech. Trend AI did not explain directly why it did not publicly name the company, but stated that its attribution method was designed to reduce the risk of misidentification and to avoid the use of labels that could mislead defence personnel, distort risk judgements or trigger inappropriate responses.
Researchers believe that related advertising activities may not be primarily aimed at promoting common commodities, but rather at using the advertising system to collect information that can identify and locate Starlink users. Satellite Internet terminals transmit data through satellites operated by SpaceX, rather than relying entirely on locally regulated traditional telecommunications networks, thus being able to circumvent Internet restrictions in some cases and to provide communication channels for people in conflict areas. This has also made Starlink users a target of special intelligence value.
Starlink is particularly important in Ukraine. The Ukrainian military relies on this service to maintain front-line communications and to coordinate drone strikes. In conflict areas, the location of satellite Internet terminals could help identify human activities, communication nodes and even military facilities. As a result, the technical and commercial activities surrounding Starlink users have gradually attracted the attention of government and cybersecurity researchers in recent years.
In May this year, the Israeli media Ha’aretz and the intelligence industry website Intelligence Online respectively reported that a number of Israeli businesses were promoting the identification and tracking of Starlink users to their clients. Ha’aretz stated at that time that the use of digital advertising data could be an important component of the relevant technology. The latest survey further highlighted the potential use of advertising bid mechanisms for intelligence-gathering activities beyond traditional commercial marketing.
In fact, Discover-Tech has been investigated on suspicion of using the advertising system to carry out broader surveillance activities. On the same day, as reported by Trend AI publish, the Canadian Cybersecurity Research Agency, Citizen Lab, and the New York Advertising Technology Corporation, Commercial, respectively, publicly identified Discover-Tech as suspected of abusing the digital advertising bid mechanism to collect Internet user data.
In the course of advertising transactions, information relating to user equipment and network activities can be obtained at a competitive price. If these data are collected on an ongoing basis and linked to information from other sources, it may gradually eliminate the anonymity of users, identify particular individuals and track their activities on different websites and applications. In some cases, this information may also be used to screen targets for further advertisements with surveillance or malicious codes.
According to Citizen Lab and Commercial, Discover-Tech has been advertised in dozens of sensitive web settings involving media outlets, government departments and technology enterprises. After the survey was published, Google, Concaster and others indicated that Discover-Tech had been removed from their respective advertising platforms. According to other sources, at least one major American science and technology company and one international organization had initiated an internal investigation to confirm whether the company ' s advertising had targeted its employees.
Trend AI also found that Shadow-Earth-79 was the largest buyer of advertising bids in Syria, Libya, Yemen and South Sudan and ranked second in Afghanistan. These areas are partially sanctioned or in the midst of armed conflict, with a relatively limited demand for normal Western commercial advertising. The researchers therefore believe that the competitive share of the entity in these markets is unusually high and that it is difficult to explain it entirely with the normal advertising business.
It was also noted that the entity had won an exceptionally high proportion of advertising bids in Hungary, Israel, Egypt, Azerbaijan and Venezuela. Researchers believe that these models are more of an infrastructure for targeting and tracking than a commercial advertising operation with the main purpose of selling goods or services.
According to six informed sources, Trend AI researchers had seriously considered directly naming Discover-Tech in the report, but eventually abandoned the practice after legal risk concerns were raised by company management. Five of the sources claimed that legal risk was one of the important factors in the decision not to publicly attribute guilt.
Reuters noted that the cyber-security industry often faced a complex trade-off between technical evidence, legal liability and commercial interests when identifying suspected spies publicly. Research institutions may have sufficient evidence of unusual activity to attract vigilance, but they may not be able to establish a sufficiently established link between each technical discovery and the particular company in a public report.
Earlier this year, Palo Alto Networks, a United States cyber security company, also contested the attribution of global cyber espionage. Reuters reported at that time that the company had deleted from its report a statement that clearly pointed to China. Palo Alto Networks, on the other hand, denied that its treatment was related to China ' s procurement restrictions and stated that it was ill-founded.
The incident revealed that the digital advertising industry may be exposed to security risks beyond traditional privacy protection. Advertising systems were used to place commercial information based on user interests and behaviour, but data generated during real-time bidding may also be used to identify specific populations, extrapolate geographical locations and even provide targeted information for subsequent cyberattacks.
For Starlink users, the risks are of particular concern, as satellite Internet is often used in areas where traditional network infrastructure is limited, communications are censored or armed conflict exists. Users may think that they are simply browsing through web pages or using common applications, but expose information that can be collected by third parties during advertising loading and bidding.
However, the current public findings, which point mainly to abnormal advertising competitions and their possible tracing purposes, are not sufficient to demonstrate that each of Discover-Tech ' s bids has a spy purpose and that all Starlink users have been successfully located. The allegations still need to be judged in conjunction with further technical evidence and findings.
With increased attention to the links between digital advertising, data analysis and commercial espionage software, how to limit the disclosure of sensitive data in advertising bid systems, enhance scrutiny of bidders on advertising platforms and prevent the use of legal advertising infrastructure for surveillance and cyberattacks is becoming a pressing issue in the area of cybersecurity.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.