Slashdot Mirror
For Under $1,000, Mobile Ads Can Track Your Location (mashable.com)
"Researchers were able to use GPS data from an ad network to track a user to their actual location, and trace movements through town," writes phantomfive. Mashable reports:
The idea is straightforward: Associate a series of ads with a specific individual as well as predetermined GPS coordinates. When those ads are served to a smartphone app, you know where that individual has been... It's a surprisingly simple technique, and the researchers say you can pull it off for "$1,000 or less." The relatively low cost means that digitally tracking a target in this manner isn't just for corporations, governments, or criminal enterprises. Rather, the stalker next door can have a go at it as well... Refusing to click on the popups isn't enough, as the person being surveilled doesn't need to do so for this to work -- simply being served the advertisements is all it takes.
It's "an industry-wide issue," according to the researchers, while Mashable labels it "digital surveillance, made available to any and all with money on hand, brought to the masses by your friendly neighborhood Silicon Valley disrupters."
It's "an industry-wide issue," according to the researchers, while Mashable labels it "digital surveillance, made available to any and all with money on hand, brought to the masses by your friendly neighborhood Silicon Valley disrupters."
Seriously everybody said this would happen if it was made available and sure enough it has been.
...why adblocking is so popular?
Apps given access to your GPS can pass that data on to advertisers. Evil Stuff (tm) can then be done with that data. I would say "nothing to see here" but I'm surprised that ads can be customized to only be shown to devices with a specific ID at a specific GPS location. The chances someone will sniff your MAID, and know the ad networks of the apps you leave running that have location access, seems really low though. I imagine the more reputable (i.e. common) ad networks will/already prohibit such specific targeting.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
Believe it or not, they can track you _even_ if you have ad-blocker installed
The ad does not have to appear fully on screen , (or be successfully downloaded in full)
All it needs is to have the GEO function invoked (with the help of your smartphone's embedded GPS feature) to send back your _current_ location before the ad-blocker wakes up, and block it
Ip address of phone downloading the unviewed ad.
Or nearest fell tower.
Browser fingerprinting and cookies do the rest.
The ip address, browser fingerprinting or cookies don't give the actual user location. As for the nearest "fell" tower, you don't get that information from ads.
There's the HTML 5 api but it will pop in your face telling you that XYZ is asking for your location.
So as it's indicated in the summary, the only context where this "hack" could work would be in native apps when the user has given permissions to get his location. If someone allows ad-supported apps to track them, they deserve to be stalked.
lucm, indeed.
As for me, I think I'm going back to a dumb-phone, or at the very least, switching to airplane mode whenever I'm not actively using the internet.
If you look at the F-Droid repo, you'll find plenty of open-source apps that can help you control this kind of thing. For instance: https://f-droid.org/en/package...
lucm, indeed.
from whitepaper (Mobile Advertising ID):
-"sniff network traffic of target devices to obtain the MAID, which is often sent to ad-exchanges
unencrypted"
- "attacker can also obtain the MAID if the target clicks on any of the attacker’s earlier ads"
- "exfiltrated via JavaScript in ads in some major ad-libraries"
Tracking in general is certainly the reason for me. Binning the actual ads is incidental except for the whole personalised aspect of ads. This is the tracking part in action of course.
What's wrong with simply making the ads subject related rather than that who is looking? What the user is looked for/at at that moment should be more than enough to make a targeted ad without it being personalised.
French startup Teemo (formerly Databerries) already provides accurate tracking to ad companies, by teaming up with a few app distributors (mostly newspaper / news sites apps, so to sum it up, useless apps that provide the same content as their website, with the added benefit of being tracked). Apps send location data every 3 minutes, and thoses are related to IFDA for Apple phone (don't know about android) They pretend it take them only a few minutes for their team to locate you with only your phone number, or your address, work address, They also claim it's quite easy for them to track french president Macron as he is a fan of one of the apps, and always followed by many other smartphones. Well, I guess turning off localisation data and refusing access to this info to apps that don't need it (everything but gps/maps app, imho) would ruin that system. Also, not using stupid apps.
And just how is this supposed stalker supposed to target the individual phone ID? In the advertising world the individual's ID is the goose that lays the golden eggs for the advertiser service provider. You would need to carefully profile the target and then hope no one else fitting the profile is in the location that you're targeting since Google et al, would never hand over or let you target the ID itself.
At which point, why not just stalk the traditional way. Cost is not the issue here, it just seems like a ludicrously stupid way of tracking someone.
Why would an advertiser spend $1000 to learn that i never leave my bedroom?
Everyone can watch everyone.
These days we are closer to this than we are to ultimate privacy.
We suffer more in our imagination than in reality. - Seneca
So they can market adult diapers and ensure to you of course.
Om, nomnomnom...
A lot of data leaks can be prevented by using a browser instead of apps. There are browsers that are made for users, not advertisers: https://www.mozilla.org/en-US/...
Apps are basically trojan horses on your device. The purpose of the majority of apps is to collect data about their users. So, instead of the amazon app, use their mobile web page (it's actually good). Instead of Facebook app, use their web page (or better don't use fb at all), etc.
When selecting a browser, try not to choose from a company whose main business is advertising. http://www.investopedia.com/ar...
Practical tips:
Some browser addons I consider a basic necessity:
1) ad blocker (obviously)
2) tracker blocker, like Ghostery (FF now comes with its own built-in tracker blocker)
3) NoScript
For messaging I recommend https://threema.ch/
Yes, you pay 3 CHF, but only once.
It has become difficult to find apps that don't sell your data. Since everybody wants apps for free the app developers have to resort to other revenue channels and selling your data is a fairly obvious one. https://www.go2mobi.com/sell-u...
"Tracking" isn't very useful, if you have to predefine the GPS coordinates. I suppose a divorce lawyer could use this to see when a cheating spouse was visiting a particular house, but in general, $1000 per location would get kind of pricy for general surveillance.
Have you read my blog lately?
I use a hosts file began with a seed file from http://someonewhocares.org/hos... it takes a bit of work. With an Android one can't use a host file without being rooted.
What I do is watch the traffic on my router (Asus AC66U), then use robtex.com to verify for a block. Yet this only works for local networking on Android. I find using airplane mode when playing a game effective - I'm old school and my security now days appears paranoid to many.
I find using airplane mode when playing a game effective - I'm old school and my security now days appears paranoid to many.
Of course after a program I go to the apps settings and force stop it or it will continue to run in the background.
I wonder how easily adapted this would be to, for example, identify everyone attending a strip club, or maybe collect data from everyone in an area known for prostitution or drug use.
In the past, people have received letters indicating their car was seen in an area known for prostitution, this could be an interesting tool.
Cheap storage VM.