Ha. Here's the direct source: https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

“You’ve read your last free article.”

Do they know how ominous that sounds? It reads like they got mad at my freeloading and sent out a hitman.

Tells me that too. Then I copy the url into my readeck instance and it pulls the article for me and gives me a better reading experience.

Wow they gave you a time to come back, they have just said I have surpassed my 5 free articles for years now, I think it is because I am using a “DNS sink hole”/adblocker I do not care enough to turn my pihole off just to try and read it.

I have gotten a static IP, and clear my cache regularly since my last attempt to read a wired article so it is not that they are using anything to see that I have tried them before.

I love Unbound bro. Gives a neat list of the noisest domains which I can quickly add to my list if I don't need that site 😌

Absolutely. Remember to enable a cron job in the OpnSense - System > Settings > cron to update the Blocklists. Otherwise you are likely out of date.

Just moved to an OPNsense network. Setting up unbound was so nice and simple. Much preferred over pihole.

I switched to pihole. Just found it.. easier.

What is a DNS sinkhole

A DNS sinkhole is a little program that sits in between your computer and the DNS server that provides your internet lookups. It looks at all of your DNS requests in an unencrypted format. If a DNS lookup from your browser, mobile app or any other internet connected machine matches an entry it has in its "blocklist" then it returns a value of 0.0.0.0 (or some other customizable value including NXDOMAIN). But if the DNS entry is not on the blocklist, then that request will be forwarded to Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9) or other DNS provider and get an accurate value for the DNS lookup.

Most of the time, the blocklists consist of adware domains such as Google Ad Services, Facebook Ads, Amazon Ads, etc. This has the effect of removing ads from devices that normally are unable to block ads such as ads inside mobile apps, ads in Roku, etc.

how is it related to the content of the article?

The article indicated that the malicious spyware was transmitted through viewable ads on the target's mobile device. This is combated most effectively by using a DNS sinkhole.

I should note that the article does not mention if current blocklists would have thwarted this attack. However, it does say that the ads were transmitted, in some instances, via Google Ad services, which these blocklists do effectively target.

Yes, from what I understand. They are using ad services from the big ad companies, and because capitalism sucks they are completely fine with selling the spots.

if you do not have a system to VPN into your home I would suggest get a firewall (preferably one you can install openWRT of opnSense on) and VPN into your LAN when away from home.

Well yes but no with html5 a lot of JavaScript functions are now possible with html alone so a number of stuff like click or core jacking or even SQL injections into local databases are now possible with html5 even with JavaScript disabled

This should be the top comment tbh

The problem with tarpitting is that apps will try to download the ads before showing you the content, and you will be more annoyed than before

DNS blockers work so why would I need your solution? I dont care if the sites try to reconnect cause the connection wont work nonetheless

Most consumer routers don't offer this functionality out of the box, likely because manufacturers don't consider it essential for most users. There's no major technical reason it couldn't be built in though. You can already set up DNS sinkholing with OPNsense or pfSense if you don't mind running and managing your own router.

Routers are usually hardware level optimized for throughput, filtering is inherently computationally expensive compared to routing (not crazy expensive just more than usually fits an FPGA), especially if you have to keep up multi-gigabit throughput

You could totally do it at the router, it would just become a more expensive piece of hardware and most people choose to cheap out

A Raspberry Pi 3b is adequate to run PiHole to do the job, or implementing AdGuard DNS.

However, these require a little skill and knowledge to implement.

Consumer routers aren’t built to do the job.

The german router "FritzBox" recently did implement this.
A very rudimentary version of it but still.

In what way(s)?

This is the way