Investigating User Profiling and Privacy Leaks in Mobile Ad Networks

Mobile advertising networks seek to reach their audience by displaying targeted in-app ads to users. This requires user profiling, which is done by collecting information through ad and analytics libraries embedded in apps. The profile information may include demographic data, such as age and gender, as well as behavioral data, such as recent app use. A profile is linked to a device with a unique identifier – Android uses the advertising ID for this purpose. Because targeted ads reflect a user’s profile, ads leaking to a third party could reveal privacy sensitive information about the user. Our objectives are to 1) analyze how different ad networks (AdMob, Flurry, InMobi, and Millennial Media) target users and 2) investigate the extent to which an attacker is able to request and receive ads targeted at a specific user. Before the introduction of the Android advertising ID, privacy leaks allowed an attacker to infer user profiles created by analytics services by spoofing identifiers, such as the Android ID [1]. Unlike the Android ID, the advertising ID can be reset by the user. It is therefore more difficult for an attacker to track a user, but the extent to which attackers are able to exploit the advertising ID is currently unknown. We explore whether user profiling and ad targeting pose privacy risks in the current Android environment. BODYUser-based targeting in mobile ads is scarce & we explore if attackers can tracka user by spoofing the user’s identifiers in ad requests. REFERENCES[1] T. Chen, I. Ullah, M. A. Kaafar, and R. Boreli. Information leakage through mobile analyticsservices. In Proceedings of the 15th Workshop on Mobile Computing Systems and Applications,HotMobile ’14, 2014. Volume 4 of Tiny Transactions on Computer ScienceThis content is released under the Creative Commons Attribution-NonCommercial ShareAlike License. Permission tomake digital or hard copies of all or part of this work is granted without fee provided that copies are not made ordistributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page.CC BY-NC-SA 3.0: http://creativecommons.org/licenses/by-nc-sa/3.0/.