Researchers at The Citizen Lab have for the first time released technical evidence of sophisticated mercenary spyware being distributed via online advertising.
A DNS sinkhole is a little program that sits in between your computer and the DNS server that provides your internet lookups. It looks at all of your DNS requests in an unencrypted format. If a DNS lookup from your browser, mobile app or any other internet connected machine matches an entry it has in its “blocklist” then it returns a value of 0.0.0.0 (or some other customizable value including NXDOMAIN). But if the DNS entry is not on the blocklist, then that request will be forwarded to Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9) or other DNS provider and get an accurate value for the DNS lookup.
Most of the time, the blocklists consist of adware domains such as Google Ad Services, Facebook Ads, Amazon Ads, etc. This has the effect of removing ads from devices that normally are unable to block ads such as ads inside mobile apps, ads in Roku, etc.
how is it related to the content of the article?
The article indicated that the malicious spyware was transmitted through viewable ads on the target’s mobile device. This is combated most effectively by using a DNS sinkhole.
I should note that the article does not mention if current blocklists would have thwarted this attack. However, it does say that the ads were transmitted, in some instances, via Google Ad services, which these blocklists do effectively target.
I’ve heard that before but I haven’t seen an ad in years. But I’m probably not the norm. Between userscripts, ad-removing frontends like invidious and choosing services like Lemmy over the competition, you can pretty safely remove ads from most platforms. Of course, Jellyfin helps 😂
Yeah, they’ve done this on this one particular site that I like to read, one old (hilarious) celebrity blogger who made a new home on [redacted]. [redacted] is pure shit. I dunno exactly what they’re doing but the ads they serve up are largely local rather than third party - and they’re served up so aggressively the site is all but unreadable on my phone. So ads are crazy in-your-face despite having adblock on the phone itself and a Pi-Hole! Just to keep reading the guy I like I had to set up a shortcut that loads it in reader view to bypass all the bullshit and fuck knows how long that will last before they somehow figure out how to block reader view.
Edit: I probably shouldn’t be giving them ideas, lol.
I saw the domain before you edited it lol. I went to the site and have zero ads on mobile, although I did have an empty placeholder in one spot where the ads would have been.
Make sure the following domains are blocked on your pihole:
If there is a specific url you’d like me to look at, feel free to message me.
Edit to add: even better than the individual domains, to add https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txt as a list and then just include the githack.com domain. Pihole supports adblock syntax, so you’ll be fine with this.
Looks like cdn-statically.io has not yet been added to any of the big block lists I use, but I found it in my DNS logs from today. Good catch! I didn’t find githack.com or revcontent but added them to block, and it looks like pub.network and html-load.cc are on the big blocklists and getting blocked. Thank for the tips.
A DNS sinkhole is a little program that sits in between your computer and the DNS server that provides your internet lookups. It looks at all of your DNS requests in an unencrypted format. If a DNS lookup from your browser, mobile app or any other internet connected machine matches an entry it has in its “blocklist” then it returns a value of
0.0.0.0(or some other customizable value includingNXDOMAIN). But if the DNS entry is not on the blocklist, then that request will be forwarded to Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9) or other DNS provider and get an accurate value for the DNS lookup.Most of the time, the blocklists consist of adware domains such as Google Ad Services, Facebook Ads, Amazon Ads, etc. This has the effect of removing ads from devices that normally are unable to block ads such as ads inside mobile apps, ads in Roku, etc.
The article indicated that the malicious spyware was transmitted through viewable ads on the target’s mobile device. This is combated most effectively by using a DNS sinkhole.
I should note that the article does not mention if current blocklists would have thwarted this attack. However, it does say that the ads were transmitted, in some instances, via Google Ad services, which these blocklists do effectively target.
This sounds like AdGuard Home is an example?
Tldr; pi-hole
Thank you, that kind of explanation exactly what i was hoping for!
Unfortunately a lot of the magnificent 7 of advertisers have caught on to this and will serve ads dynamically in many of their platforms.
I’ve heard that before but I haven’t seen an ad in years. But I’m probably not the norm. Between userscripts, ad-removing frontends like invidious and choosing services like Lemmy over the competition, you can pretty safely remove ads from most platforms. Of course, Jellyfin helps 😂
Yeah, they’ve done this on this one particular site that I like to read, one old (hilarious) celebrity blogger who made a new home on [redacted]. [redacted] is pure shit. I dunno exactly what they’re doing but the ads they serve up are largely local rather than third party - and they’re served up so aggressively the site is all but unreadable on my phone. So ads are crazy in-your-face despite having adblock on the phone itself and a Pi-Hole! Just to keep reading the guy I like I had to set up a shortcut that loads it in reader view to bypass all the bullshit and fuck knows how long that will last before they somehow figure out how to block reader view.
Edit: I probably shouldn’t be giving them ideas, lol.
I saw the domain before you edited it lol. I went to the site and have zero ads on mobile, although I did have an empty placeholder in one spot where the ads would have been.
Make sure the following domains are blocked on your pihole:
html-load.cc githack.com cdn.statically.io revcontent.com pub.networkThen, make sure you have these two lines as entries on your mobile adblocker:
/ad-shield/e/*$script,third-party /cdn-cgi/zaraz/*If there is a specific url you’d like me to look at, feel free to message me.
Edit to add: even better than the individual domains, to add
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txtas a list and then just include thegithack.comdomain. Pihole supports adblock syntax, so you’ll be fine with this.Edit: Do not click on tracker links below.
Looks like cdn-statically.io has not yet been added to any of the big block lists I use, but I found it in my DNS logs from today. Good catch! I didn’t find githack.com or revcontent but added them to block, and it looks like pub.network and html-load.cc are on the big blocklists and getting blocked. Thank for the tips.
I did this, and you’re right - no ads. 👍 Thanks a bunch, I’ve saved your comment so if I run into one of these again I may hit you up!
Thanks for taking the time to let me know it worked for you! I like helping people so this made my day!
Provide the URL to your AI chat and ask it to print out the article for you.
no