14 ms·
It Takes Just $1k to Track Someone's Location with Mobile Ads
- dsfyu404ed 9y agoNot surprising but deserving of more mainstream attention nonetheless.
- brokentone 9y agoThe article / study only seemed to consider specific ad buys though very particular conditions -- particular app / ad network and waiting till targets showed up in a geofence. It seems that an even simpler method would be basic retargeting. You can buy traffic individually, either by watching the requests back to your origin and locating IPs, or any location data coming back from basic DMP's it would seem this could be done.
- abalone 9y agoNo, IP geolocation is vastly less precise than this attack. This has a resolution of 25ft.
- nobodyorother 9y agoIs this an inevitable consequence of our society, or is there a way to actually do marketing ethically? What negative feedback loops actually apply strongly and over the long term to this behavior and creating these sorts of systems? This is a pretty horrifying society we've built.
- dublinben 9y agoNon-targeted and non-interactive marketing can be done ethically (if you grant that any marketing can be ethical). Perhaps we are all just waking up to the true nature of marketing, and seeing its unbridled ugliness for the first time.
- goialoq 9y agoFor the first time? https://genius.com/Bill-hicks-on-advertisers-and-marketing-annotated https://genius.com/Bill-hicks-on-advertisers-and-marketing-a... https://www.youtube.com/watch?v=Tvp97SMZc6M https://www.youtube.com/watch?v=Tvp97SMZc6M
- maxsavin 9y agoThe problem is that platforms enable this kind of behavior. Once it's the open, someone will take advantage of it, and then others would only put themselves at a disadvantage by not doing it too. The real question is, how did our infrastructure become so exploitable? That's not to say there aren't companies that don't play this kind of game. But on a spectrum of care and don't care, most are in the middle.
- slg 9y ago>Once it's the open, someone will take advantage of it, and then others would only put themselves at a disadvantage by not doing it too. The answer to that problem in every other industry is regulation, either self imposed or more commonly through government intervention. But folks in the tech community, rightly or wrongly, don't take too kindly to the idea of regulating the Internet.
- goialoq 9y agoLife, uh, finds a way. https://en.wikipedia.org/wiki/Regulatory_capture https://en.wikipedia.org/wiki/Regulatory_capture
- Tyrek 9y agoThat doesn't mean that we should avoid all regulation - government action is sometimes the only way forward when dealing with certain situations, especially given the industry's reluctance to self-regulate. Regulatory capture is a concern, but it's something that we should be actively trying to fight, as opposed to avoiding regulation entirely.
- eru 9y agoYes. It just suggests that regulation is _hard_ to get right, and what might on the face of it look like a good idea might not be. The people with the money and lawyers and accounts often find away around regulations.
- 9y ago
- user5994461 9y agoIt's a consequence of northern America. Did you know that other countries don't allow ISP to do that.
- djrogers 9y agoThis has nothing to do with your ISP - it’s phone apps that are sending location information to advertisers.
- dx034 9y agoIf they can. IP tracking doesn't work well in cities and you don't need to give Facebook (and others) location access. The only apps that need it are navigation and ridesharing and they only need it while you use the app.
- 482794793792894 9y agoAd-blocker for Android: https://f-droid.org/app/org.jak_linux.dns66 https://f-droid.org/app/org.jak_linux.dns66
- Multicomp 9y agoI second this, it blocks a surprising amount of ads without fuss or system resource usage.
- usemustard 9y agoDNS66 is great. The list of ad servers included in DNS66 by default don't include many mobile advertising services though(e.g adjust.com, ironsource).
- matt_wulfeck 9y agoAds are not the main privacy issue any longer, since there’s client-side protection against them. Now the issue is your ISP getting into the marketing/data-monger business, since they have the keys to your privacy kingdom and are becoming increasingly desperate for profits. https://www.google.com/amp/s/www.forbes.com/sites/thomasbrewster/2017/03/30/fcc-privacy-rules-how-isps-will-actually-sell-your-data/amp/ https://www.google.com/amp/s/www.forbes.com/sites/thomasbrew...
- javajosh 9y agoYeah, it's too bad that knowing the physical position of your customers is a technical requirement for the wireless ISP industry. That said, knowing their identity is not a technical requirement. I wonder if it's feasible to construct an ISP that still must know where all it's customers are, but can't distinguish between them.
- kakarot 9y agoNetworking and behavioral analysis will probably render such obfuscation useless for most subjects.
- JoshMnem 9y agoI don't think that there is much client-side protection against ads on mobile devices (outside of Firefox's browsers), at least on Android.
- TACIXAT 9y agoFirefox Focus is solving such a pain point for me. Browsing the web on mobile feels like 2002 desktop with all the flashing, scrolling, pop overs. It's a nightmare. The companies that rely on ads for revenue took the thing that made adblockers so commonplace and did it on mobile.
- gcb0 9y ago"anything on a unrooted mobile feels like 2002 desktop with all the flashing, scrolling, pop overs. It's a nightmare." fixed it for you.
- hedora 9y agoHas anyone set up an always on phone VPN + host-based blocking? That would help a lot with this. Also, has anyone carefully looked into the recent changes apple made to mobile ad identifiers/etc in ios 11?
- genieyclo 9y agohttps://github.com/trailofbits/algo https://github.com/trailofbits/algo
- hedora 9y agoIt says it doesn’t try to help with anonymity. Is there some unadvertised ad blocker hiding in there?
- genieyclo 9y agoYes, algo ships with an option to setup Privoxy and dnsmasq for just this: https://github.com/trailofbits/algo/issues/14 https://github.com/trailofbits/algo/issues/14 If you look at the commits, it regularly downloads and concats a large number of host files that track ad/analytics/malware hosts.
- TACIXAT 9y agoThe reason it does not help with anonymity is that you own the server that it is running on. It is moving who you trust with your traffic. Do you trust your ISP or do you trust Digital Ocean / Amazon / other hosting service it supports? Any VPN isn't going to provide you anonymity, as you are connecting to it from your IP (if someone is monitoring on the VPN side, they know who you are) and logging into services associated with your identity. However, from the readme: >Blocks ads with a local DNS resolver (optional)
- jstanley 9y agoIt's surprisingly easy to set up an always-on phone VPN. Get a VPS, install OpenVPN on it, install "OpenVPN for Android" on your phone, and click through the settings. DigitalOcean have a good writeup of the VPS side of things: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04 https://www.digitalocean.com/community/tutorials/how-to-set-...
- setra 9y agoHow are they targeting location at such a high resolution? IP targeting is usually only accurate at the whole city level. In this they show tracking across a bus path. That would require GPS. What am I missing?
- mooman219 9y ago> One test subject's commute across Seattle that the researchers tracked with ads in the app Talkatone. The dotted lines show the subject's real path, while the red dots show where the ads were delivered to the subject's phone to reveal his or her workplace, bus stop, home and local coffee shop. (The subject's actual home location has been somewhat obscured for privacy.) It's not tracking across a bus path; that's their actual path. The red dots are the tracked locations.
- setra 9y agoLook at the red dots it places down. Two of the dots are within 1/8th of a mile. All of the dots are within 4 miles. 1/8th of a mile resolution is extreme and not IP level.
- abalone 9y agoThis is explained in the article. Apps use high-precision geolocation when requesting location-targeted ads, and you can target ads to specific locations, so if you blanket an area in ads you can indirectly track movement through the grid. > They then used that DSP to place a geographic grid of location-targeted ad buys around a three-mile square section
- deleted 9y ago[deleted]
- bagacrap 9y agoAd networks allow advertisers to target based on fine-grained location which is presumably matched against the location reported by the phone's location services. That is, an app with GPS privileges displays a Geo targeted ad, then that display is reported to the advertiser. So yes, this is using GPS after a fashion.
- bagacrap 9y agoThe part that surprises me is the unique identifier for the ad recipient (MAID) being reported to the advertiser. What is the legitimate business purpose of this and is it really a common feature of all ad platforms?
- abalone 9y agoThis is addressed in detail in the article. > the researchers suggest a variety of ways to obtain that MAID, including placing an "active-content" ad that uses javascript to pull the MAID from a phone at a certain location... MAIDs can also be intercepted by someone on the same Wi-Fi network as the target phone. > "It’s not a particularly high bar to entry for a very, very highly targeted attack," says Adam Lee... A domestic abuser could, for instance, obtain a spouse's MAID... or a co-worker could do the same in the office... Or an ad buyer could use active-content ads to gather the MAIDs of the people at a specific location, like a protest, or users of a potentially sensitive app like gay-dating apps or religious apps...
- dx034 9y agoYou talk about illegitimate purposes, not legitimate. I guess they're intended to show ads multiple time for a user. Ads often only work if you've seen them often enough. A coke ad once will not change your behaviour but seeing it three times a day over a week could.
- soared 9y agoVery interesting article, but there is an easy fix unlike the article claims. Many platforms (like facebook) won't allow you to use a data pool if there is less than 1000 users. I wasn't aware you could target specific device ids just by knowing a single id, but that seems like an obvious flaw in the system. If dsp/exchanges just required 1k or 500 users be in a retargeting pool (or list of device ids) then this problem would be solved. As for knowing how many users use a specific app in a location, that is an extremely fuzzy number and I doubt the accuracy of it. Almost no exchanges show you how many auctions you lost, so just finding out how many uniques you served to is flawed and much smaller than the real number. > "This is so easy and it's industry-wide," says Tadayoshi Kohno Maybe across the spying/intelligence industry, but advertisers don't care about individuals at all. This is an interesting experiment, but most platforms don't enable this type of tracking and no advertiser would ever need/want to do it.
- wtvanhest 9y ago> Maybe across the spying/intelligence industry, but advertisers don't care about individuals at all. This is an interesting experiment, but most platforms don't enable this type of tracking and no advertiser would ever need/want to do it. I disagree. If a company selling an extremely expensive implementation of something could serve ads directly to only the decision makers in that type of product, it would be a very valuable target and absolutely worth pushing ads to a single individual.
- soared 9y agoTrue except these are display ads and cost $1000, which would be 10x more effective if spent on another channel. I suppose 0.0001% of advertisers might use this.
- dmitriid 9y agoThink political campaigns, global product pushes etc. If you can bulk push near-individual custom ads tailored to highly specific target groups, you potentially gain much more than just blanket advertisement
- jaryd 9y agoHere's a link to the actual research paper that the article summarizes: https://adint.cs.washington.edu/ADINT.pdf https://adint.cs.washington.edu/ADINT.pdf
- djrogers 9y agoThis is just one reason I don't grant random apps access to my location. Unless there's an obvious reason an app needs to know where I am, or a non-obvious reason is explained before I'm prompted (for example my bank recently added the ability to use my phone location to help detect credit card fraud), then you don't get my location.
- tspike 9y agoKeep in mind providing access to photos does the same via geotagging.
- guelo 9y agoEven if you don't grant location permission an app can still get location using geoIP at about a city-level.
- djrogers 9y agoWhich has nothing to do with the article....
- dx034 9y agoThat can work in some rural areas but good luck in cities like London. I just tested, all publicly available geolocation databases give me no granularity except London for my vodafone IP. My home broadband is a bit more accurate but it's still an area of ~200-300k people.
- lucb1e 9y agoThat missing comma in the title made me think it was $10 000 instead of $1 000. I was unhappily surprised when reading the article. Could we edit that back in?
- philipn 9y agoIt's worth noting that this technique only works if the target user is using a mobile app (not web) that's been granted persistent location sharing permissions. The app also has to support one of the ad networks allowing the targeting they used in the paper. They tested this with the Talkaphone app, which requires (not requests) persistent location sharing. I'm not sure, but iOS's anti-ad tracking function(s) may have an effect as well (https://support.apple.com/en-us/HT202074 https://support.apple.com/en-us/HT202074)
- dx034 9y agoExactly, deactivating location sharing for apps that don't need it will help a lot. Wifis can still be located but tracking over mobile network won't really work. At least in London, IP geolocation of phone networks results in a large radius, too large for anything but long-distance travel. And then you can (and should) obviously still use a VPN. The ad network can know it's a vpn and not necessarily present it as a location but they won't be able to guess you're real one.
- anigbrowl 9y agoHow well would this work with ads targeted through popular platforms like FB and Twitter, I wonder?