Episode 61 - Back on My B.S. - Last Episode?

Podcast Show Notes
1

Show Notes -

Website / Donations / Support - Support

BTC Lightning Donations - [email protected] / [email protected]

Thank You Patreons & Direct Supporters! - You Keep The Show Going!

Support Me On Patreon - https://www.patreon.com/closednetwork

Direct Donation Support - Closed Network Privacy Podcast

XMR Chat & Cryptocurrency Donations - Tip closednetwork | XMRChat

Patreon Supporters

$20 — Privacy Bad Ass

  • Michael Bates (longest-running supporter)
  • TK
  • Trying
  • David

$10 — Privacy Supporter

  • inferno_potato
  • MrMilkMustache
  • Dolores Y
  • V0

$5 — Privacy Advocate

  • Hutch
  • Cyath
  • Bryan Abshier

Website Direct Supporters

  • Craig D — Privacy Supporter

XMRchat Tips

  • Subversion Stopper —

“BASED backgroud music sir, nice.”

Thank You To Our Moderators:

Unintelligentseven - Follow on NOSTR primal.net/p/npub15rp9gyw346fmcxgdlgp2y9a2xua9ujdk9nzumflshkwjsc7wepwqnh354d

MaddestMax - Follow on NOSTR primal.net/p/npub133yzwsqfgvsuxd4clvkgupshzhjn52v837dlud6gjk4tu2c7grqq3sxavt

Join Our Community

Closed Network Forum - https://forum.closednetwork.io

Join Our Matrix Channels!
Main - https://matrix.to/#/#closedntwrk:matrix.org
Off Topic - https://matrix.to/#/#closednetworkofftopic:matrix.org

ARMADA NOSTR - https://armada.buzz/s/armada.closednetwork.io
SimpleX Group Chat - SimpleX Chat - Invitation

Follow Simon On The Socials

Mastodon - Simon :verified: (@[email protected]) - Closed Network Social
NOSTR - Public Address - npub186l3994gark0fhknh9zp27q38wv3uy042appcpx93cack5q2n03qte2lu2 - primal.net/simon
Twitter / X - @ClosedNtwrk

Instagram - Instagram

YouTube - https://www.youtube.com/@closednetwork
Email - [email protected]

TOPICS

*** Age Verification Update. ***

  • “America’s Chat Control Doesn’t Say ‘Scan.’ It Says ‘Sue.’”

Citizen Lab’s “AdFection” report on Discover-Tech (published October 15, 2026)

The story

  • Citizen Lab at the University of Toronto just published a report on an Israeli company called Discover-Tech. On paper it’s an ordinary advertising company.
  • Citizen Lab says it’s actually a delivery service for mercenary spyware. Its business is using normal online ads to find specific people and infect their phones and computers.
  • They call the technique “AdFection.” The report came out alongside a separate investigation by the ad-security firm Confiant.

How it works

  • Discover-Tech buys ad space through the same ad networks that show you shoe ads, including Google, Yandex, Liftoff/Vungle, Beeswax and Eskimi.
  • The ad contains a small piece of code that phones home. When it loads on your device, it sends back your advertising ID, cookie ID or IP address.
  • Discover-Tech’s server checks whether you’re on the target list. If you’re not, nothing happens. If you are, it sends back code that runs on its own and can load the spyware.
  • Citizen Lab says simply having the ad displayed can be enough. You don’t have to click anything.
  • Because the malicious part is only sent to targets, the ad networks never see anything suspicious. That’s how it slipped through.
  • Customers could target people by advertising ID, IP address, country, or even a specific app or website.

Who was hit

  • Citizen Lab confirmed at least 45 Al Jazeera devices were targeted in 2024 and 2025. It ties those attacks with high confidence to Candiru, an Israeli spyware vendor that now calls itself Integrity Labs.
  • Researchers found a Discover-Tech server left exposed online with about four billion ad-bidding records from March to June of this year.
  • Those ads reached networks belonging to governments, militaries, NATO, the UN, EU institutions, critical infrastructure and major media outlets.
  • The ads ran in over 75,000 apps and over 120,000 websites.
  • Important caveat: an ad reaching someone does not mean their device was infected. Citizen Lab is clear about that.

The other players

  • Besides Candiru, Citizen Lab links Discover-Tech to two other surveillance outfits, Bindecy and Intelos.
  • One shareholder was connected to the corporate network behind Intellexa, the group known for Predator spyware.
  • A separate actor, which Citizen Lab calls “Dark Cartographer,” used the same infrastructure to match advertising IDs to real phone numbers by abusing carrier flaws in more than 30 countries. A full report on that is still coming.

The fallout

  • Google cut Discover-Tech off from its ad exchange and removed it from its vendor list, and so did IAB Europe.
  • Beeswax and Eskimi blocked it, and Liftoff/Vungle paused its access pending review.
  • Intelos, Bindecy and Microsoft’s Xandr didn’t respond to Citizen Lab.

Our Take

  • This is the clearest case yet that the ad-tech surveillance system and the spyware industry are the same pipe. The data used to sell you things is the same data used to find and hack you.
  • Your advertising ID is a tracking beacon. On iPhone, keep “Allow Apps to Request to Track” turned off. On Android, delete your advertising ID in settings. GrapheneOS doesn’t use Google’s advertising ID system at all.
  • Block ads at the network level with DNS filtering such as NextDNS, a Pi-hole or a VPN with ad-blocking, so ad code never loads in the first place.
  • If you’re a journalist, activist or work in government, use Lockdown Mode on iPhone. It’s built for exactly this kind of attack.
  • The bigger point: every ad you see is the result of an auction where your device’s details are broadcast to dozens of companies you’ve never heard of. Most just want to sell you something. This report shows what happens when one of them doesn’t.

Candiru, the spyware vendor

  • Candiru was founded in Tel Aviv in 2014 and sells hacking tools to governments.
  • It’s famous for changing its corporate name, four times in six years by Citizen Lab’s count, including registering as “Saito Tech.” The name Candiru comes from a parasitic Amazon fish.
  • Its spyware is reported to cost tens of millions of dollars per contract, priced by how many devices and countries a customer wants to target.
  • In 2021, Citizen Lab and Microsoft exposed its spyware, which Microsoft calls “DevilsTongue.” It was found on at least 100 victims, including activists, journalists and dissidents, and Microsoft had to patch Windows zero-days it was exploiting.
  • In November 2021, the US government put Candiru on its Entity List, a trade blacklist, alongside NSO Group, the makers of Pegasus.
  • In 2022, Candiru was caught using a Chrome zero-day against journalists in Lebanon, and Citizen Lab tied it to spying on Catalan independence figures in Spain.
  • In 2025, it was reportedly sold to an investment firm called Integrity Partners, and its staff and assets were moved into a new entity that isn’t on the US blacklist. Citizen Lab now refers to it as Candiru/Integrity Labs.
  • The takeaway: sanctions slowed Candiru down but didn’t stop it. It got a new corporate name and a new way to reach victims, which is now ordinary ads.

Sources:

GrapheneOS Update - Clipboard Privacy

GrapheneOS added a fantastic new feature to prevent foreground apps from reading your clipboard. I thought the best way to show the benefits of this new feature was to show you how it could be abused.

GrapheneOS adding RCS

We’re well into the process of converting the Messaging app included in GrapheneOS into a modern app. We’ll be making a new release later today with a completely overhauled user interface written in Android Compose. We’ve made a massive amount of other improvements and bug fixes beyond that too.

In the longer term, we plan to add support for RCS including support for the standard end-to-end encryption (E2EE) via Messaging Layer Security (MLS). Currently, RCS including E2EE is available on GrapheneOS via Google Messages. We want to avoid the need to use Google Messages for RCS eventually.

RCS on Android is currently implemented with code across the OS, Google Messages and Google Play services. Our plan is to start by making an equivalent to the portion in Google Messages. It would initially require sandboxed Google Play for RCS activation, etc. but we plan to implement that too…

RCS isn’t an open platform in practice. It isn’t even as open as SMS/MMS. It heavily depends on proprietary Google and carrier infrastructure in practice. We can start by replicating Google’s approach and then we can work on only using carrier services for carriers where it’s actually supported.

We’re also going to be overhauling or fully replacing the rest of the AOSP apps in the near future. AOSP Gallery is incredibly outdated and is being entirely replaced. AOSP Keyboard may be similar. We recently hired a bunch of new people and will be hiring more so our progress will be accelerating.

In the past, our focus was nearly entirely on the base OS rather than bundled apps with alternatives available. We’ve heavily ramped up the resources we’re investing into the bundled apps. We’ll also be scaling up our work on the base OS too. More donations will enable us to hire even more people.

Motorola Signature 27 confirmed to support GrapheneOS

It’s confirmed: The mysterious Motorola phone getting support for the privacy-focused GrapheneOS will be the Motorola Signature 27 that was announced earlier this week.

https://9to5google.com/2026/09/24/motorola-signature-27-confirmed-to-support-grapheneos/

Self hosting Is becoming normalized!

We Forgot What Tech Enthusiasm Was About: ft. GamersNexus

AI Labs Are Planning for the “Day After”

  • Axios is reporting that the people running the biggest AI companies, OpenAI and Anthropic among them, are quietly planning for the “day after” a major AI-driven attack.
  • They don’t think it’s a question of if. Their working assumption is that something catastrophic happens within the next six to twelve months.
  • The scenario they’re worried about most is an AI-powered cyberattack on critical infrastructure: water, power, or the internet going down for a lot of people at once.

What they’re doing about it

  • They’re running red-team drills and disaster simulations, which is standard for tech companies, utilities and the Pentagon.
  • What’s different is the tone. These executives are treating it as inevitable.
  • They’re also lobbying Congress for guardrails, but even they admit Washington probably won’t act until after something breaks.

Why it matters

  • When the people building the technology are the ones sounding the alarm, it’s worth paying attention.
  • The reporter says AI tools have already been used against critical infrastructure, by rogue agents or by hackers using them.
  • As open-source models get more powerful and anyone can use them, the risk goes up.

The politics

  • Congress tends to move fast only in a crisis. Hill staffers pointed to COVID and the 2008 financial crisis as examples.
  • This isn’t a clean left-versus-right issue. It mostly gets stuck in the details of how to regulate.
  • The expectation on the Hill is that once something catastrophic actually happens, Congress and the White House won’t have a choice.

The Closed Network take

  • Most of us think about privacy as protecting our data. This story is about the systems we depend on simply going dark.
  • So the practical question is how resilient you are: offline copies of important documents, local backups, a way to communicate if the internet is down, and not relying on one cloud provider for everything.
  • Be skeptical of the word “inevitable.” It can be honest risk talk, and it can also be a way for these companies to shape the rules they’ll be regulated by.
  • Open-source AI cuts both ways. It’s a risk in the wrong hands, and it’s also how privacy-minded people run AI locally without sending their data to a big company.
  • Watch what gets passed in a panic. Laws written after a crisis tend to come bundled with more monitoring and ID requirements, the same pattern we’ve covered with age verification and Chat Control.