Slashdot Mirror

← Back to Stories (view on slashdot.org)

For Under $1,000, Mobile Ads Can Track Your Location (mashable.com)

Posted by EditorDavid on from the I'll-be-seeing-you dept.

"Researchers were able to use GPS data from an ad network to track a user to their actual location, and trace movements through town," writes phantomfive. Mashable reports: The idea is straightforward: Associate a series of ads with a specific individual as well as predetermined GPS coordinates. When those ads are served to a smartphone app, you know where that individual has been... It's a surprisingly simple technique, and the researchers say you can pull it off for "$1,000 or less." The relatively low cost means that digitally tracking a target in this manner isn't just for corporations, governments, or criminal enterprises. Rather, the stalker next door can have a go at it as well... Refusing to click on the popups isn't enough, as the person being surveilled doesn't need to do so for this to work -- simply being served the advertisements is all it takes.
It's "an industry-wide issue," according to the researchers, while Mashable labels it "digital surveillance, made available to any and all with money on hand, brought to the masses by your friendly neighborhood Silicon Valley disrupters."

52 comments

  1. HTML5 GEO Function can be abused? *GASP* by Anonymous Coward · · Score: 1

    Seriously everybody said this would happen if it was made available and sure enough it has been.

    1. Re:HTML5 GEO Function can be abused? *GASP* by Z00L00K · · Score: 2

      And did someone pay attention to what happens to the URL of the linked article when you open it?

      --
      If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
    2. Re:HTML5 GEO Function can be abused? *GASP* by Anonymous Coward · · Score: 0

      The ability to target by geo has been around for several years. The problem is that Android doesn't ask. (iOS does, and desktop browsers do)

      Try it. Go to a private tab/window and type in a name of any business, eg "Pizza", you will get "Google.com wants to know your location", even if you say no, the little map it comes up with, already knows.

      It's not getting this information from HTML, it's getting it from the GeoIP database. If you want to kill this functionality, you absolutely must use a VPN, even on your mobile devices.

    3. Re:HTML5 GEO Function can be abused? *GASP* by wyHunter · · Score: 1

      And 'privacy and civil liberties experts are concerned!' ooohhh, I feel so much better.

  2. How associate ad with someone? by Anonymous Coward · · Score: 0

    Associate a series of ads with a specific individual ... Refusing to click on the popups isn't enough ... simply being served the advertisements is all it takes.

    If I don't click on an ad, then how do they associate the associate the ad with me?

    1. Re: How associate ad with someone? by Anonymous Coward · · Score: 0

      Ip address of phone downloading the unviewed ad.
      Or nearest fell tower.
      Browser fingerprinting and cookies do the rest.

      Do you have myspy.tracking.lig.user1235678904.jpg in your cache? Ignore
      If yes, hit detected.
      Server a different ad to every geo ip/tower, season with big data analysis to taste.

    2. Re: How associate ad with someone? by lucm · · Score: 2

      Ip address of phone downloading the unviewed ad.
      Or nearest fell tower.
      Browser fingerprinting and cookies do the rest.

      The ip address, browser fingerprinting or cookies don't give the actual user location. As for the nearest "fell" tower, you don't get that information from ads.

      There's the HTML 5 api but it will pop in your face telling you that XYZ is asking for your location.

      So as it's indicated in the summary, the only context where this "hack" could work would be in native apps when the user has given permissions to get his location. If someone allows ad-supported apps to track them, they deserve to be stalked.

      --
      lucm, indeed.
    3. Re:How associate ad with someone? by jarkus4 · · Score: 1

      from whitepaper (Mobile Advertising ID):
      -"sniff network traffic of target devices to obtain the MAID, which is often sent to ad-exchanges
      unencrypted"
      - "attacker can also obtain the MAID if the target clicks on any of the attacker’s earlier ads"
      - "exfiltrated via JavaScript in ads in some major ad-libraries"

    4. Re: How associate ad with someone? by Trax3001BBS · · Score: 1

      I use a hosts file began with a seed file from http://someonewhocares.org/hos... it takes a bit of work. With an Android one can't use a host file without being rooted.

      What I do is watch the traffic on my router (Asus AC66U), then use robtex.com to verify for a block. Yet this only works for local networking on Android. I find using airplane mode when playing a game effective - I'm old school and my security now days appears paranoid to many.

    5. Re: How associate ad with someone? by Trax3001BBS · · Score: 1

      I find using airplane mode when playing a game effective - I'm old school and my security now days appears paranoid to many.

      Of course after a program I go to the apps settings and force stop it or it will continue to run in the background.

    6. Re:How associate ad with someone? by pnutjam · · Score: 1

      I wonder how easily adapted this would be to, for example, identify everyone attending a strip club, or maybe collect data from everyone in an area known for prostitution or drug use.
      In the past, people have received letters indicating their car was seen in an area known for prostitution, this could be an interesting tool.

      --
      Cheap storage VM.
    7. Re: How associate ad with someone? by Anonymous Coward · · Score: 0

      Wrong. Please note that the solution for desktops and portable devices are different.

      WiFi and Cellular have base-station ID's. You can triangulate the location of someone down to 100 feet if you get three pings. Since WiFi has a maximum distance of around 100 feet as well (or 1000ft if outdoors) you can narrow the scope down to each triangulated location.

      For desktops, plugged in laptops and mobile devices that are tethered, it's using the GeoIP database. The GeoIP database is precise down to a postal code.

      So without being Law Enforcement, you can ask google or any other ad publisher you want to target someone in X postal code, Y City, with device Z. That will narrow things down as far as you want them to. For example, if I know my target doesn't publish their user agent string, I will target that. If I know their user agent string is FireFocks/69 (PutDickJokeHere) then that is what I'll have google target.

      Most targets are not smart enough to use a VPN, and Android fragmentation only helps a stalker. If every Android device was simply "HTML/5.1 (Android/8)" that would narrow things down to just users running that version of the OS and not the dozen some odd user agent labels. Simply installing adblock also makes you even more targetable because you will be the IP that visits the site but doesn't trigger the ads.

      Trust me. Site publishers know this. Any time you change your browsers default behavior, from turning off old versions of SSL prematurely, to disabling flash and javascript, your make your browser fingerprint larger.

      The only way to avoid being tracked online is to either never install any extensions and only browse using the default browser, and then delete those cookies every 24 hours, or by using a VPN and thus attributing your tracking data to a remote IP that the targeting parameters hasn't considered.

  3. And advertisers wonder... by Whatsmynickname · · Score: 5, Insightful

    ...why adblocking is so popular?

    1. Re:And advertisers wonder... by hcs_$reboot · · Score: 1

      Geo location is not the main reason people use ad blockers (not sure most people would even care about that).

      --
      Slashdot, fix the reply notifications... You won't get away with it...
    2. Re:And advertisers wonder... by Anonymous Coward · · Score: 0

      No. They understand nothing of the sort.

    3. Re:And advertisers wonder... by Z00L00K · · Score: 2

      But it's an added bonus.

      $1000 for locating a certain individual seems expensive if you follow what's in the article.

      I suspect that the cost of a single tracking is less than $1. It's the use of a tracking ad that costs $1000, but then you can target more than one individual, more likely 1000 individuals several times.

      --
      If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
    4. Re:And advertisers wonder... by Anonymous Coward · · Score: 0

      You mean, besides being anti-boy, useless, offensive and completely unappealling to me?
      Better products, lower prices and not a female-bot imitation that buys, votes, bleeeds on cue... blah... while economic numbers go down the sewer chasing a higher standard of living guarranteed to women (welfare money by looking at what advertisers are trying to appeal to).... suicide to suggest *everyone* deserves the same playing field...
      I'd say we really need some laws to protect competitive practices, but every dollar you earn, two more come back to hurt you.

      My vote is to nuke 'em all.

    5. Re:And advertisers wonder... by Anonymous Coward · · Score: 0

      ...from orbit.

    6. Re:And advertisers wonder... by Anonymous Coward · · Score: 0

      maybe 'every dollar you generate' rather then every dollar you 'earn'

  4. Nothing To... Hmm... by mentil · · Score: 2

    Apps given access to your GPS can pass that data on to advertisers. Evil Stuff (tm) can then be done with that data. I would say "nothing to see here" but I'm surprised that ads can be customized to only be shown to devices with a specific ID at a specific GPS location. The chances someone will sniff your MAID, and know the ad networks of the apps you leave running that have location access, seems really low though. I imagine the more reputable (i.e. common) ad networks will/already prohibit such specific targeting.

    --
    Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
    1. Re:Nothing To... Hmm... by jarkus4 · · Score: 2

      From the whitepaper:
      "Cookies/MAID. Every DSP allows targeting users based on cookies
      or mobile advertising ID (MAID). Either of these could be obtained
      by an ADINT attacker if the user ever clicks on their ad.
      They can also be obtained from sniffing network traffic. Finally,
      active ad content (see below) can be used to potentially acquire
      either identifier."
      Also Facebook allows targeting by email with minimum of 20 addresses.
      "(...) these minimums can be
      circumvented; we conducted a preliminary experiment and found
      uploading 19 entirely spurious email addresses (not even connected
      to fake Facebook accounts) allowed us to target ads at a test user"

    2. Re:Nothing To... Hmm... by phantomfive · · Score: 4, Insightful

      I imagine the more reputable (i.e. common) ad networks will/already prohibit such specific targeting.

      No. I've worked in ad-tech, and I can tell you the answer is no. There is absolutely no motivation for ad companies to even think about this problem beyond a token effort.

      Ad companies have every motivation, indeed they have people paying them to give them as much information about a person as possible. This isn't even a new thing: decades ago you could buy mailing lists with names, addresses, gender, and income.

      --
      "First they came for the slanderers and i said nothing."
    3. Re:Nothing To... Hmm... by Anonymous Coward · · Score: 0

      No. I've worked in ad-tech, and I can tell you the answer is no. There is absolutely no motivation for ad companies to even think about this problem beyond a token effort.

      Ad companies have every motivation, indeed they have people paying them to give them as much information about a person as possible. This isn't even a new thing: decades ago you could buy mailing lists with names, addresses, gender, and income.

      People paying...? Why use the word people? Does people also included the group of people you spied, stalked, annoyed, extorted, misled, trampled on their privacy and wasting billions of people their time to satisfy the sole one motivation (again the word every? pfff...) that an ad company has, make money.

      NO... so could you be more specific. Beginning with excluding 99.9% of the people who you exploit. From your definition of people...

      And to play it down with, "but... it always been this way..." no, not on this massive scale.

      Kuddos for downplaying the problem, i give you that...

  5. You realize... by Anonymous Coward · · Score: 0

    Adblocking doesn't do you any good against this kind of attack, unless you do it at the OS level, since any app that will serve you ads or displays ads can also be used for this. If you have an iOS device, forget about it. If you have an Android-based device, on the other hand, also forget about it.

    I'm sure they've already figured out to make apps that COULD serve you ads but don't, instead selling your location by REQUESTING ads over the network, but then not displaying them so you have no idea it's happening, just to glean your location for the purpose of selling it.

    As for me, I think I'm going back to a dumb-phone, or at the very least, switching to airplane mode whenever I'm not actively using the internet.

    1. Re:You realize... by lucm · · Score: 3, Informative

      As for me, I think I'm going back to a dumb-phone, or at the very least, switching to airplane mode whenever I'm not actively using the internet.

      If you look at the F-Droid repo, you'll find plenty of open-source apps that can help you control this kind of thing. For instance: https://f-droid.org/en/package...

      --
      lucm, indeed.
    2. Re:You realize... by esonik · · Score: 3, Interesting

      A lot of data leaks can be prevented by using a browser instead of apps. There are browsers that are made for users, not advertisers: https://www.mozilla.org/en-US/...
      Apps are basically trojan horses on your device. The purpose of the majority of apps is to collect data about their users. So, instead of the amazon app, use their mobile web page (it's actually good). Instead of Facebook app, use their web page (or better don't use fb at all), etc.

      When selecting a browser, try not to choose from a company whose main business is advertising. http://www.investopedia.com/ar...

      Practical tips:
      Some browser addons I consider a basic necessity:
      1) ad blocker (obviously)
      2) tracker blocker, like Ghostery (FF now comes with its own built-in tracker blocker)
      3) NoScript

      For messaging I recommend https://threema.ch/
      Yes, you pay 3 CHF, but only once.

      It has become difficult to find apps that don't sell your data. Since everybody wants apps for free the app developers have to resort to other revenue channels and selling your data is a fairly obvious one. https://www.go2mobi.com/sell-u...

  6. Ad-blockers can't prevent 'em from tracking you by Anonymous Coward · · Score: 2

    Believe it or not, they can track you _even_ if you have ad-blocker installed

    The ad does not have to appear fully on screen , (or be successfully downloaded in full)

    All it needs is to have the GEO function invoked (with the help of your smartphone's embedded GPS feature) to send back your _current_ location before the ad-blocker wakes up, and block it

  7. Tracking is totally the problem with ads by evanh · · Score: 4, Insightful

    Tracking in general is certainly the reason for me. Binning the actual ads is incidental except for the whole personalised aspect of ads. This is the tracking part in action of course.

    What's wrong with simply making the ads subject related rather than that who is looking? What the user is looked for/at at that moment should be more than enough to make a targeted ad without it being personalised.

    1. Re:Tracking is totally the problem with ads by drew_kime · · Score: 1

      What the user is looked for/at at that moment should be more than enough to make a targeted ad without it being personalised.

      Targeted, but not effective. I recently searched for new bike pedals. For the last three weeks I keep seeing ads for pedals, and shoes, and gloves, and ... Hey wait, I do need some new gloves. That price looks pretty good.

      They do it because it works.

      --
      Nope, no sig
  8. Apps already take part in huge tracking system by Kopp · · Score: 1

    French startup Teemo (formerly Databerries) already provides accurate tracking to ad companies, by teaming up with a few app distributors (mostly newspaper / news sites apps, so to sum it up, useless apps that provide the same content as their website, with the added benefit of being tracked). Apps send location data every 3 minutes, and thoses are related to IFDA for Apple phone (don't know about android) They pretend it take them only a few minutes for their team to locate you with only your phone number, or your address, work address, They also claim it's quite easy for them to track french president Macron as he is a fan of one of the apps, and always followed by many other smartphones. Well, I guess turning off localisation data and refusing access to this info to apps that don't need it (everything but gps/maps app, imho) would ruin that system. Also, not using stupid apps.

  9. That stalker... by thegarbz · · Score: 1

    And just how is this supposed stalker supposed to target the individual phone ID? In the advertising world the individual's ID is the goose that lays the golden eggs for the advertiser service provider. You would need to carefully profile the target and then hope no one else fitting the profile is in the location that you're targeting since Google et al, would never hand over or let you target the ID itself.

    At which point, why not just stalk the traditional way. Cost is not the issue here, it just seems like a ludicrously stupid way of tracking someone.

    1. Re:That stalker... by Gavagai80 · · Score: 1

      Stalking is certainly more easily and thoroughly done the traditional way regardless. This might be useful for a professional burglar, though -- build a profile of what hours a certain device is actively browsing the web from a certain house, and plan a break-in accordingly.

      --
      This space intentionally left blank
    2. Re:That stalker... by Antique+Geekmeister · · Score: 1

      The cell phone services, mapping services, and various vendor profiling tools already have identifiable information of your phone number, your cell phone SIM ID and your MAC address. See https://ssd.eff.org/en/module/... for some sense off the variety of tracking information already shared by portable devices.

  10. Re:And i wonder... by sheramil · · Score: 1

    Why would an advertiser spend $1000 to learn that i never leave my bedroom?

  11. Location = ID by Anonymous Coward · · Score: 0

    "You would need to carefully profile the target and then hope no one else fitting the profile"
    Who else lives at 22 fake street and works at Bobs diner?

    Also we found out only last week that Verizon or ATnT will sell you that specific data complete with billing records and location data only last week. Chairman Pai, has some major answering to do. When exactly did he give them permission for this, and how many politicians have been tracked by this? How many judges. Do they sell location traces to Putin? Does he do co-analysis on that data to see who they're meeting/when/where?

  12. The ideal "Age of Google" by Qbertino · · Score: 1

    Everyone can watch everyone.

    These days we are closer to this than we are to ultimate privacy.

    --
    We suffer more in our imagination than in reality. - Seneca
    1. Re:The ideal "Age of Google" by drinkypoo · · Score: 2

      Everyone can watch everyone.
      These days we are closer to this than we are to ultimate privacy.

      We are no more meaningfully closer to one than the other. You cannot watch what the wealthy do, because they can hide behind a big wall of money. But they get to watch what you do, because they can literally afford to pay someone to bug your house.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    2. Re:The ideal "Age of Google" by Anonymous Coward · · Score: 0

      https://en.wikipedia.org/wiki/The_Circle_(Eggers_novel)

      The book was interesting, and the film was frustratingly shallow and shite. Mostly the nature of the medium available, sadly.
      The ugly public participation in our hero's death off the bridge was underplayed by far too much.
      This is the true face of public surveillance.... public harassment... public condemnation... summary execution.

      But yes, it was all about our current "social" networks. This is NOT the future, This is already our past, and it's only going to grow. The cats are out of their bags. Personal video drones are rife. The footage is pumped live to who cares where, so long as I can bear witness to my membership of my post-modern consumerist sub-tribe. Your feeble attempts to claim "privacy rights" are moot, however much I might sympathise or empathise.

      http://www.martinshervington.com/what-are-google-circles/

      As Scott McNealy has said for years, "You have no privacy. Get over it."

      To which I might add: you never really had much in the first place anyway, fool. You just didn't know you were being watched before.

  13. Re:And i wonder... by Mashiki · · Score: 2

    So they can market adult diapers and ensure to you of course.

    --
    Om, nomnomnom...
  14. Waste of money by Anonymous Coward · · Score: 0

    I use mock location services. Anyway it seems wasteful to spend so much effort making a product that is only available to a small amount of people in a specific area.

  15. Specific location? by 14erCleaner · · Score: 1

    "Tracking" isn't very useful, if you have to predefine the GPS coordinates. I suppose a divorce lawyer could use this to see when a cheating spouse was visiting a particular house, but in general, $1000 per location would get kind of pricy for general surveillance.

    --
    Have you read my blog lately?
    1. Re:Specific location? by Actually,+I+do+RTFA · · Score: 1

      It's not $1000 per location. It's $1000 in total.

      --
      Your ad here. Ask me how!
  16. They can't do it if what ads talk to is blocked by Anonymous Coward · · Score: 0

    See subject: Via APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/

    Ads/script/malware rob speed/security/privacy/bandwidth.

    Hosts add speed (via hardcodes/adblocks), security (vs. bad sites/malware/poisoned dns), reliability (vs. dns down), & anonymity (vs. dns requestlogs/trackers).

    Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus + less security bugs/complexity & faster vs. addons/routers/remote dns!

    Avoids DNSChangers in routers/IP settings & dns redirect (99.999% of ISP DNS != patched vs. it) + DNS tracking & lighten DNS load & resolve faster from local RAM!

    * Via what u NATIVELY have in a FASTER kernelmode IP stack!

    APK

    P.S. - Safe https://www.virustotal.com/en/file/e01211ca36aa02e923f20adee0a3c4f5d5187dc65bdf1c997b3da3c2b0745425/analysis/1433430542/ (self checking code vs. infection of program built-in it)

  17. False: Hosts work before that... apk by Anonymous Coward · · Score: 0

    See subject: Hosts block whatever any ad served by host-domain name talks to (most are like malware too) & from with LONG before browser addons work in slower usermode (hosts block in kernelmode level far faster too) & for less CPU/RAM & other forms of I/O as well yet DOING FAR MORE than mere adblocking also e.g. -> https://yro.slashdot.org/comments.pl?sid=11258545&cid=55412945/

    APK

    P.S.=> AND minus all the security issues addons incur along w/ being easily exploited https://news.slashdot.org/comments.pl?sid=11166303&cid=55266729/ or being detected & blocked by native in-browser methods (that browsers dump as to what addons you use).... apk

  18. Re: They can't do it if what ads talk to is blocke by Anonymous Coward · · Score: 0

    That page points to a Windows executable. How do I use it on my smarphone -- you know, the thing the article is about?

  19. E.G. - Rooted Droid & ADB pull command... apk by Anonymous Coward · · Score: 0

    See subject: Run the program on a Windows system & save the file when done. Then, w/ a rooted droid, use Android Debugging Bridge's PULL command to import to your smartphone.

    * W/ Apple iPhone's you need what their devs & staff have though in a "GodMode" phone to do so... this IS a 'downside' of iPhones imo (you have almost NO CONTROL of it as a "std. consumer").

    APK

    P.S.=> There ya go... apk

  20. Available, wholesale, for much less by Anonymous Coward · · Score: 0

    doubeclick.net has been selling this service behind the scenes for at least 15 years. The p0wn enough of the secondary web bugs and "assisted advertising" marketplace that they're an effective monopoly, and need no special activation for most tracking. They do it through web bugs, and if hardpressed through "location servers" that report and track your MAC address.

  21. Re:And i wonder... by Anonymous Coward · · Score: 0

    Why would an advertiser spend $1000 to learn that i never leave my bedroom?

    So they can predict when the fapping is done and you need to order some pizza, or so they can tell you when it's time to buy a new tub of lube to aid in said fapping, and also to know that since you seem to prefer teenage asians you might be in the mood for some Chinese, or that maybe you're just pathetic enough to be ready to buy that child sex doll.

    Loser or not, you still need stuff people want to sell you and get money from you.

  22. Value of ads by Anonymous Coward · · Score: 0

    I find it sad how people defend ads, even how people think ads can be useful. There certainly was a time when this was true, but at the same time there also were ads for face bleach and cancer cures. According to my experience, online ads of today consist mostly of tge following:
    Clothes at 20% off. Shitty MMOs. Sex dungeon simulators (available on Google Play). Shitty Sex dungeon MMOs. Yoghurt that tastes shit and contains some bacteria. Overpriced computer stuff. "News" articles. Baby stuff. Products you bought yesterday. Shitty overbudgeted movies. Shitty overmarketed games. Dubious "charities" that look real enough to fool old people. Get rich quick-schemes. This woman earns $6400 a day from her home in [your ghetto-ip location]! Hotties looking for a date. Shitty perfume. Your local hamburger joint. Overmarketed pop music. Netflix "replacements". Business Solutions For Solution Business Businesses. Bitcoin clones. Pages filled with green ticks and "order now" buttons every other paragraph.
    In conclusion: I am blocking all ads on my computer and i am better off for it. As a result of this blocking, net value of large corporate fuckheads is sadly unchanged, but the amount of frustration (accidental clicks) and lament in the world is slightly lower.

    1. Re: Value of ads by Anonymous Coward · · Score: 0

      Not to forget the infamous "Download Now!" ad on pages where you are looking for the real download button at the bottom of the page. This ad is alone a good reason to block all ads.