IdeaWell

Project ideas from Hacker News discussions.

AdFection: Targeted ads turned into a pipeline for zero-click mercenary spyware

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

1. Ad‑blocking as the first line of defense
- “uBlock Origin ftw” – kleiba2
- “And wBlock on Safari.” – rwaksmunski
- “Plus a dns based blocker for other apps. Android has an option ready for that, iPhone it will be like VPN.” – tamimio
- “Actually you can load a configuration profile on iOS and force everything to a custom DNS. Works great for me on NextDNS” – Melatonic

2. How the Discover‑Tech zero‑click ad spyware works
- “It came in through the front door. Discover‑Tech ran its own ad‑buying platform … The ads looked harmless … Only chosen targets got the payload … The handoff was built to defeat inspection … It worked. At least 45 devices at Al Jazeera were targeted … The scale was huge.” – chunkyslink (summarizing Citizen Lab & Confiant reports)
- “The ads looked harmless. Plain banners for games, AliExpress deals and an IP‑lookup site. Hidden inside each one was a small script that quietly phoned home when the ad loaded.” – chunkyslink

3. Israeli ad‑tech / spyware ecosystem and the Unit 8200 talent pipeline
- “Israel has been known to have some sneaky spyware in the past with Pegasus.” – pelagicAustral
- “Go to LinkedIn, and check how many ex Unit 8200 … work for the Apple iOS dev team…” – Betelbuddy
- “Tons of SV companies really … it’s quite disturbing how obvious the compromise vectors are but big companies and startups alike seem to just allow it …” – usumgallu
- “Specifically Unit 8200 … you could systematically screen every young adult … and divert them into one single security special ops org …” – AlanYx

4. Political debate over Israel’s actions (criticism vs. accusations of antisemitism)
- “Ethnically cleansing Palestine is reason enough to hate Israel. As an American I’ll add that I hate their influence on my country via bribes and blackmail…” – newspaper1
- “Israel is an illegitimate state practicing crimes against humanity.” – slowin
- Discussion of whether criticism of Israel is labelled antisemitism (multiple threads, e.g., buellerbueller vs. DeadFred).

5. View of online advertising as inherently malicious / need for regulation
- “The FBI has previously recommended running adblockers as a method to prevent malware … Ads are basically never delivered as static assets … solution is to block the code altogether; to block ads.” – preg_match
- “this is why adblock is completely necessary, not just for your eyes, but for security.” – chii
- “Ads are getting insane … they’re trying to fill every bit of space you can look with ads … They’re not going to stop even when there’s an ad no matter where you look.” – ModernMech

6. Mobile‑specific mitigations (DNS, custom DNS profiles, hardened browsers/OS)
- “Plus a dns based blocker for other apps. Android has an option ready for that, iPhone it will be like VPN.” – tamimio
- “Actually you can load a configuration profile on iOS and force everything to a custom DNS. Works great for me on NextDNS.” – Melatonic
- “It seems to be app‑based. So DNS blocking could work; it’s easily circumvented by the platforms, but it’s rarely circumvented. like mobile games with those ads.” – Cider9986
- “If you want to maximally protect yourself, use Vanadium or Brave Browser and GrapheneOS.” – Cider9986 (also echoed by others)

🚀 Project Ideas

AdJSandbox

Summary

  • A lightweight browser extension that isolates ad iframes in a strict sandbox, disabling JavaScript and blocking network calls to known malicious ad‑tech endpoints.
  • Provides zero‑click protection by neutralizing the script‑delivery mechanism highlighted in the Citizen Lab/Confiant reports.

Details

Key Value
Target Audience Privacy‑conscious web users, journalists, activists
Core Feature Sandboxed ad rendering with JS disabled and CSP enforcement
Tech Stack Manifest V3 extension, Service Workers, Content Security Policy APIs
Difficulty Medium
Monetization Hobby
#### Notes
- HN users repeatedly asked for ways to stop malicious JS in ads (e.g., “ad blocker protects?”, “Turns out Google killing Android privacy was useless…”, “Run a DNS ad blocker”). This extension directly addresses the JS injection vector.
- Could be discussed as a complementary layer to uBlock Origin, offering a higher assurance sandbox for ad frames.

MobileAdShield

Summary

  • A VPN‑based DNS‑blocking service for iOS and Android that installs a configuration profile (iOS) or VPN app (Android) and uses continuously updated threat‑intel blocklists to stop ads from known spyware‑serving domains.
  • Reduces in‑browser blocklist size, improving battery life as noted by HN commenters.

Details

Key Value
Target Audience Mobile users concerned about zero‑click spyware, especially on iOS where ad‑blocker options are limited
Core Feature System‑wide DNS filtering with per‑app exemptions and real‑time malicious‑domain feed
Tech Stack WireGuard/VPN SDK, DNS‑over‑HTTPS, blocklist ingestion pipeline (Go/Node), Firebase/Apple Push for updates
Difficulty Medium
Monetization Revenue‑ready: Subscription $2.99/mo
#### Notes
- Comments highlighted the usefulness of DNS‑based blockers on Android and the ability to load a config profile on iOS (Melatonic). This product makes that easy and adds threat intel.
- HN readers valued battery savings from shrinking mobile in‑browser block lists; this approach delivers that benefit system‑wide.

AdThreatFeed

Summary

  • An open‑source threat‑intelligence feed that aggregates indicators of compromise (IOCs) from reports like Citizen Lab, Confiant, and malware‑tracking blogs, providing daily‑updated blocklists, YARA rules, and hash sets for uBlock Origin, Pi‑hole, NextDNS, and enterprise DNS filters.
  • Enables communities to stay ahead of emerging malicious ad campaigns without manual research.

Details

Key Value
Target Audience Ad‑blocklist maintainers, security ops teams, privacy‑focused ISPs
Core Feature Curated IOC feed (domains, IPs, URL patterns, file hashes) with metadata and TLP tags
Tech Stack Python backend, PostgreSQL, GitHub‑based distribution, CI/CD for daily updates
Difficulty Low
Monetization Hobby
#### Notes
- HN users cited the Citizen Lab and Confiant reports as sources of actionable intel (“Here is a better article …”). A structured feed would let them turn those reports into immediate protection.
- The feed could be integrated into existing blocklist projects, sparking discussion on HN about collaborative threat sharing.

AdNetworkScanner

Summary

  • A SaaS tool for ad networks, publishers, and ad‑tech vendors that scans uploaded ad creatives (HTML/JS, images, flash) for prohibited behaviors such as dynamic code execution, eval‑like patterns, or external calls to known malicious domains.
  • Generates a compliance report and suggests CSP/sandbox fixes to prevent zero‑click payload delivery.

Details

Key Value
Target Audience Ad‑network operators, publishers seeking brand safety, compliance officers
Core Feature Static and dynamic analysis of ad assets with a policy engine (e.g., disallow new Function, eval, XMLHttpRequest to untrusted hosts)
Tech Stack Docker‑based sandbox (Firefox headless), Node.js policy engine, React dashboard, AWS/GCP
Difficulty High
Monetization Revenue‑ready: Tiered pricing per scanned impressions
#### Notes
- Multiple commenters noted that ads “can literally push whatever they want” and that there is “no content disarm between companies making ads and the publishers”. This scanner directly addresses that gap.
- Would likely generate HN debate about responsibility of ad tech vs. publishers, mirroring discussions on ad‑blocking ethics.

ZeroClickDetector

Summary

  • An endpoint detection agent (Windows/macOS) that monitors browser‑spawned processes for suspicious DLL hijack or rundll32 activity characteristic of zero‑click exploits delivered via malicious ads, using ETW/Sysmon and heuristic scoring.
  • Alerts the user and can quarantine the offending process in real time.

Details

Key Value
Target Audience Power users, journalists, enterprise security teams
Core Feature Real‑time detection of DLL side‑loading and unusual child processes from browser contexts
Tech Stack C++ agent, ETW/Sysmon consumption, Rust‑based heuristics, optional Electron UI for alerts
Difficulty High
Monetization Hobby
#### Notes
- HN discussion highlighted the DLL hijack mechanism (“Both samples use a COM hijack for persistence…”) and the difficulty of spotting such attacks. This tool gives visibility into that post‑exploitation stage.
- Could be paired with ad‑blocking layers for defense‑in‑depth, a topic of interest to the security‑savvy HN audience.

AdBlockBatterySaver

Summary

  • A minimalist ad‑blocking browser extension that combines lightweight element hiding with a local DNS‑proxy (hosts‑file style) to drastically reduce the size of in‑memory filter lists, thereby lowering CPU and battery usage on mobile devices while still blocking known malicious ad domains.
  • Aimed at users who want protection without the battery drain of large filter sets.

Details

Key Value
Target Audience Mobile web users on Android/iOS who use browsers like Firefox/Focus or Samsung Internet
Core Feature Hybrid filtering: small host‑file based domain block + selective cosmetic filters
Tech Stack WebExtension, local DNS proxy via native host file manipulation (requires root/administrator or VPN fallback), Rust core for performance
Difficulty Medium
Monetization Hobby
#### Notes
- HN commenters noted that “you can drastically reduce the mobile in‑browser block list which helps a lot with battery” (Melatonic). This product operationalizes that idea.
- Provides a practical trade‑off that would resonate with users frustrated by both security and battery concerns, likely sparking discussion on optimal blocking strategies.

Read Later