An Israeli advertising company, Discover-Tech, is facing allegations of tracking SpaceX’s Starlink satellite internet users through online advertisements. According to a report by Reuters on October 27, six individuals with knowledge of the research indicated that TrendAI researchers connected the firm to an unusual volume of advertising activity targeting Starlink users.
Concerns Over Privacy and Security
The findings have sparked worries about how standard advertising systems might expose individuals in sensitive areas. While the allegations involve the misuse of advertising data, there is no evidence of a breach in Starlink’s satellite or network systems. The presence of Starlink in conflict zones heightens the risk for users whose locations could be compromised.
TrendAI, part of Trend Micro, released its findings on October 15 under the project name SHADOW-EARTH-79. The public report did not name Discover-Tech, but Reuters’ sources linked the codename to the Israeli company. Legal concerns reportedly influenced the decision to withhold the company’s identity.
The Mechanics of Online Ad Tracking
The suspected tracking activities hinge on real-time bidding, a process where automated auctions determine ad placements on websites and apps. During these auctions, bidders may access device information such as IP addresses, network identifiers, advertising IDs, and occasionally, location data.
Researchers analyzed traffic tied to Starlink’s network identifier, AS14593. By combining network details with persistent ad identifiers, operators could potentially connect browsing activities and create user profiles without requiring ad interactions.
TrendAI’s research showed SHADOW-EARTH-79 as the top bidder for observed Starlink ad traffic in 105 countries. The company captured 12.9% of Starlink ad impressions compared to a 2.6% share in overall traffic, indicating a strong focus on satellite internet users.
Implications and Recommendations
The study highlighted that these statistics reflect TrendAI’s sample data, not the entire advertising market. Data was sourced from a single advertising platform, and country estimates based on IP addresses come with uncertainties, especially in regions like Myanmar and Sudan.
TrendAI discovered that the operation ranked first among ad buyers in nations such as Syria, Libya, Yemen, and South Sudan. The patterns and reconstructed software features suggested a tracking infrastructure rather than standard commercial advertising.
Investigations by Citizen Lab and Confiant identified Discover-Tech on October 15. Previous reports noted that receiving a Discover-Tech ad does not necessarily mean a device was infected. Google, Comcast, and other companies reportedly removed Discover-Tech from their platforms following these investigations.
TrendAI advises limiting advertising traffic on sensitive devices, restricting permissions, disabling ad personalization, and minimizing reliance on ad-supported apps. Simply hiding ads might not prevent tracking requests; more robust controls are needed to protect sensitive data from reaching advertising systems.
As AI accelerates the pace and reduces the cost of cyberattacks, the question remains: are current defenses equipped to respond swiftly?
