Tracking cellphones – this is nothing we haven’t heard before. We all know that at any given time, someone can probably see our phones’ activities. Or at least someone is trying to. This normally results in two types of tech users. The first is the overly paranoid, “everyone is watching me and out to get me” people. The second group are the people who DO realize how much data actually leaves our devices- and they are apathetic. As if privacy is too much effort and doesn’t matter anymore. But you can join a third group. If you want to be a technology user, there’s not really an effective way to give zero data and be untraceable by normal means. If you use a free app on your phone, you are tracked. If you see an advertisement, you are tracked. You can try to remove your data by opting out of people search sights, but the data tends to find its way back in. The second you receive the discount for giving your phone number or email address to the cashier at the bookstore, you are tracked to some extent. Signature reduction will be the topic of a different article. Today we will try to make sense of the advertisements part of the equation. Let’s learn about digital billboards.
What is Collateral Telemetry Data?
Before we dive into how the advertising system works, we need to discuss something that may sound intimidating but isn’t – Collateral Telemetry Data. This is a broad term, but can cover things like the device’s screen orientation, operating system version, pixel density, hardware details, etc. This type of data can be transmitted in several ways.
The first is through something we’ll discuss later called Real Time Bidding (RTB) transactions. RTBs are the secret transactions that happen on your device when you see an ad for something in an app or on a web page.
Another way is for app developers to program the applications to extract this information back to their servers for later use in improvements of sales. Sometimes this data may even go to a third party developer through an included Software Development Kit (SDK). Developers can and do use this data for tweaking performance of apps, but they can also sell this data into the AdTech market.
Why is my screen orientation important to anyone? In a previous job where I worked on social media campaigns, we were tasked with increasing engagements with a specific page. We created curated content for our target audience that should have resulted in higher engagement based on our research. But this is where understanding how your target interacts with the medium comes into play. This was around the time when short form content like reels and Vine were getting popular. Many people that develop media that are trained in cinema or TV production tend to make high-quality videos, but in a widescreen format – 16:9 aspect ratio. Wide screen aspect ratios work well if the viewing device is held in landscape view. The problem is that a 16:9 aspect ratio video viewed by a target that doesn’t turn their phone sideways will display very small and compressed on the screen. In our tests, this typically resulted in the user skipping the content. In advertising and influence, you are constantly fighting for attention span. Because users began to like vertically shot aspect ratios due to the new reels and Vine media, our solution was to start creating videos at a 9:16 portrait aspect ratio. Engagement significantly increased.
The Secret War – Digital Billboards
“Call me Alabama!” – Alexander Shunnarah. No, there isn’t supposed to be a comma after “call me” according to his slogan. This has become quite the meme in Alabama, and is incredibly memorable. If you’ve ever driven anywhere near Alabama, then you know that he loves billboard space. Up and down the interstates, you see his face on too many of them. I would love to know what his billboard budget is. I would also like to know more about the world of physical billboards. I wonder if this world is as interesting as the world of their digital equivalents.
RTB, SSP, & DSP
Before talking about mobile devices, we will discuss generically how programmatic advertisements work. If you navigate to https://www.kevinandamanda.com/chess-squares/, you will see many examples of ads placed throughout the page. If you are fast enough or there are network latency issues, you might just catch one of these digital billboards while they are blank. This is equivalent to seeing a physical billboard with no advertisement.
It is just waiting on someone to purchase the space and show their ad creative. Here we see some of the billboards have already been filled. This specific one has not. What is the process for getting an advertisement to fill it? This is where Real Time Bidding (RTB) comes in.
The user’s device viewing the page that contains the blank ad space is technically the product that is up for bidding. We can see in the example above the page has numerous ad slots. By the time you scroll down, this bidding war is likely already won. The Alex Shunnarah of the internet has already populated your feed.
There are other parts to this infrastructure. This is drastically oversimplified, but this is the general flow of the transaction.
What do the transactions actually look like? What information can we get from them? If you are curious about the details of winning transactions, opening dev tools in Safari or other browsers, going to the console, and pasting “pbjs.getAllWinningBids()” should bring up a list of the current winners.
Here we can see that the bidder, “TTD”, which is the specific Demand Side Platform (DSP) won the bid for Subaru. Subaru and other companies registered with this DSP participated in the automated bidding process and Subaru won. We can also see the CPM for this ad. This is the “cost per mille”. All this means is that the company will pay roughly $2.68 for every thousand people that see the ad. We see other information like the specific id of the ad being used in the event that the company has multiple ads.
Ads and Ad Types
There are several different types of ads used for various purposes. Using https://canyoublockit.com/advanced-adblocker-test/web-banners/, we can see examples of different types of ads. WARNING: this website’s ads may or may not be malicious. This site is normally used to test your popup blocker, so use with caution.
Banner Ads
Native Banner Ads
Pop Under Ads
Some of these are pretty generic and are used for things like brand awareness, but Native Banner ads and pop under ads are deceptive in nature. Native ads are meant to appear as if they are part of the inventory of the page you are viewing, but when clicked they redirect to a different site. Pop under ads may open another window or tab entirely.
MAIDs & Mitigations
So how is this information useful? I imagine the number of people consuming media and sites from a traditional laptop has decreased since phones have gotten better. We have shifted more towards mobile apps on iPhone and Android. Due to privacy laws, the advertising industry isn’t “supposed” to target you directly – at least not by your name. iPhones and Android devices use mobile advertising IDs (MAIDs), long strings of numbers that represent you. This number is used by advertisers to deliver specific ads based on your interests. Advertisers may not know that “Wow, Jeff really loves Dragon Ball Z”. Instead they know that “MAID 6508eacf-ff51-4206-81d1-415e5b5a09c2 really loves Dragonball Z”. They are free to advertise to this representation of you in a targeted way that doesn’t violate your privacy. There are definitely ways to correlate it back to you, but the MAID is a best effort to keep your info private.
Android
Android’s MAID is called Android Advertising ID (AAID). Users in the US for the most part are automatically opted into tailored advertising through this system. Your device is assigned an AAID. You build up an identity under this AAID, but have the option in your settings to roll it to a new AAID. You also have the option to turn it off. You will still receive ads, but they won’t be as specific. This is because when applications request your AAID, it responds with either a made up number or all zeros. This setting is located at Settings -> Google -> All Services -> Ads. No specialized app required.
iPhone
iPhone’s MAID is called Identifier for Advertisers (IDFA). The iPhone is a little more difficult. You cannot just open settings to view your IDFA. You normally have to intercept the network traffic or download an app that will show it to you.
Ironically, this app for showing you the IDFA sells ad space. Here we can see the IDFA in the App. If you navigate to “Apple Advertising” in settings, you can disabled personalized ads.
Mobile Apps and MAIDS
So with all of this information we can begin to see how, if used maliciously, this system could be harmful. If still not convinced, there is one more aspect of this ecosystem that we have not discussed. We know that developers and advertisers use this data for improvements and targeted marketing, what do they do with the data after that? There is actually an entire adtech market for buying and selling these data sets. The data is rich. Much of it ties specific MAIDs to specific coordinates. If purchased and aggregated, it is possible to plot these devices and coordinates on a map to see patterns. Of course the barrier to all of this is money. This would be reserved to organizations with a decent bit of money. Not everyone off the street would have the budget to purchase these datasets. And they are volatile. The idea is to constantly consume these datasets to get an updated view of devices.
A few recommendations with regard to tech privacy:
- Turn off targeted advertising if this is something that concerns you. Do you really need it?
- iPhone has been observed through traffic analysis to be much more protective of privacy.
- Pay for apps. Most of the time, a free app sells advertising slots. Buying the app normally removes that functionality.
- Live in the woods with nothing but a dog and a hunting bow. You’ll probably still get a carrier pigeon with an ad or a home warranty warning…..
Author: Jeff Benson, Senior Security Researcher
