User targeting capabilities provided by mobile advertisers can also be abused to track users with an accuracy of 8 meters and for a budget of $1,000 or less.
These are some of the conclusions of a comprehensive study of the mobile advertising landscape carried out by a team of three researchers from the Security & Privacy Lab at the University of Washington.
Mobile advertising networks can be abused for user surveillance
Researchers discovered that mobile networks provide user targeting capabilities so accurate and finely tuned that a threat actor could abuse these tools to track down individuals fitting a certain pattern or to spy on known targets.
For example, an attacker could register for one of these services and set up to deliver ads only to a certain geographical area, such as the coordinates of a house in his local neighborhood.
Because the attacker bought ads, this also means he gets usage reports on how and when the ads were delivered for his recent purchase, in this case, the local house.
These reports don't only show when ads are clicked, but they also show when they're displayed, and in the case of mobile ads, on what apps and websites.
An attacker can use this technique to infer details about his target, such as the time of day when he's at home, his religious beliefs, sexual habits, medical conditions, or more. This data is not directly available through the report, but if the user often receives ads while visiting the website of a cancer clinic or inside an LGBT dating app, then the data speaks for itself in most cases.
