Hey, look over there! Security risk!

Anybody looking for a cartoon to draw?

A family is gathered around a mousehole labeled “Programmatic web ads” constructing an elaborate trap. Meanwhile, two human-sized cockroaches labeled “Meta” and “Google” are sitting at the family’s dining table eating their dinner. One cockroach says, “How’s your pest control program coming?”

Cory Doctorow wrote about the Citizen Lab investigation of Discover-Tech, in Israeli ad-tech company was a delivery system for “mercenary spyware”.

He accurately puts some of the blame on Google and Meta for choosing to interoperate with this “demand side platform.” If anyone had actually looked at the ads they would have seen that something isn’t right. But actual ad review depends on human moderators, who tend to level up at labor organizing pretty quick, and Big Tech always puts union-busting ahead of user security.

Which means security problems keep coming up.

Taryn Plumb covers the story for CSO. No click required: How the ad industry became a pipeline for mercenary spyware. Frank Dickson of Dickson Research advises, among other things,

Push a vetted ad-blocking extension to managed browsers through policy rather than leaving it to users to install it.

Block ad and tracking domains at the DNS or secure web gateway layer; this reaches in-app ads on managed phones.

Disable advertising identifiers on corporate mobile devices through mobile device management (MDM) and restrict ad-supported consumer apps on devices holding sensitive data.

Yes, this is a publication for mainstream “corporate security decision-makers.” Online ads are a subset of online security risks now. (Maybe more security decision-makers and marketing decision-makers should sit together at lunch at more companies, just saying.)

Anyway, the Discover-Tech story is bad, but, as a wise man once said, It’s even worse than it appears. That was one relatively small company operating in “open web” advertising, the kind of real-time auction that a research organization like Citizen Lab can watch from the browser side.

Internally, though, Meta and Google have their own versions of “Discover-Tech,” constantly refreshed by machine learning, still running. Putting users at risk is just how those companies work.

Meta doesn’t just make 10% of ad revenue from scams. The scammers act as shill bidders to drive up the ad rates for the legit advertisers.

And Google’s ad-based search ad system is most lucrative when more bidders content for “hot” keywords like brand names—which means that Google’s ad ML “learns” to match scammers, trademark infringers, and malware distributors with victims.

By now, the people complaining about Meta and Google data practices are not just the usual privacy nerds. The Big Tech crime wave is mainstream now. The Kitboga Show is a popular YouTube channel that does comedy bits like putting scammers on the phone with AI-generated victims who keep running into computer difficulties. Some of the worst stuff covered on there comes straight out of the Google search ads. Watch (487) Dumb AI Security Flaw Ruins Scam Call Center - YouTube (skip to 14:09 if you’re impatient.) please check cleaning up YouTube before clicking through to YouTube if you haven’t already. Or use your own independent client.

Google’s trademark policy is designed to facilitate scams.

• No restrictions on using some other company’s trademark unless the trademark holder reports the individual ad or account. A bank or SaaS company can’t just say, nobody’s allowed to use this trademark in an ad but us and our authorized service providers. They have to report each infringer one at a time. (And scammers can get new ad accounts hella fast.)
• And Google’s ML “learns” to match the infringing ad with likely victims, not with the trademark holder. You can’t report an ad you don’t see. The owner of a software trademark never sees the malware fake of their product.

Google doesn’t just make trademark holders play Whac-A-Mole with scammers. Google has built an impossible version of the game, where the malware and scam “moles” pop up far away, where the “whacker” can’t see or reach them.

So the connection between Big Tech and scams continues to become part of the culture. If a popular YouTube channel isn’t normie enough for you, how about Chase Bank? Facebook and Instagram scams are just as well-known now, and Chase warns,

Scammers create ads on social media offering merchandise at great prices and set up bogus websites that all look exactly like genuine retailers.

Discover-Tech was a real story, and a real risk. But all the worse stuff continues. Meta and Google run a bunch of “Discover-Tech”s internally, every day.

More later.

Bonus links

AI Questions Put Massachusetts Sportsbooks Under Review on ReadWrite. The Massachusetts Gaming Commission has asked all seven licensed mobile sportsbook operators to explain how they use artificial intelligence and machine learning, giving them until November 3 to respond….The commission asks whether operators use AI, machine learning, algorithms, automated decision-making or similar tools for marketing, promotions or customer engagement. (About time. More on this issue: Do you have a license for that robot bookie?)

Character.ai’s Bankruptcy Documents Show the Economics of AI Don’t Work by Jason Koebler. (Would have been nice, but character.ai was a risky Google project spun out as a separate legal entity that “pays Google for cloud services.” This is Google’s hazardous experiment containment system working as designed.)

Mozilla introduces Firefox Enterprise Across Europe, governments are investing in the security and resilience of critical IT infrastructure, reducing strategic dependencies and putting technological autonomy higher on national agendas. (Mozilla vs. Mozilla continues. At the same time they’re trying to position as a Eurostack play, they’re pushing dangerous consolidation of advertising measurement with a few companies in the USA.)