November 7, 2017

Surveillance Via Cell Phone

Targeted advertising can be used to turn phone apps into tracking devices.

The precise targeting of advertising is at the heart of the largest technology companies today. It may also be turning your phone into a potential tracking device. For about $1000, pretty much anyone, from a jealous partner to a person casing your home, can follow your movements and can gain entry to your personal information, if you help them by opening up the right app on your phone.

Researchers at the University of Washington were interested in whether individuals could, by purchasing ads, gain access to other people's private information. They found that the answer is yes, with a little help from the target.

A burglar could use advertising-based intelligence to make sure that you're not home. Paparazzi could track celebrities.

The team would not say which apps they tested, but buying ads for popular apps like TextMe and iFunny would be likely choices. You don't even have to click on the ad — you just have to have the app that it's directed to open on your phone. As long as the ad connects with your app and you stay in the same place for about four minutes, the sender can get your location.

Locations were accurate to about eight meters, a little over 26 feet.

“ …[W]e find that an individual can use the targeted advertising system to conduct physical and digital surveillance on targets that use smartphone apps with ads,” the authors write. The ads in question are hyperlocal, directed to one single person's phone, lowering their cost. And there are many companies selling these ads, enough to fit most anyone's budget.

Many different types of information are available using this technique that the authors call ADINT (advertising-based intelligence), including:

  • How many people are in a location
  • Locations a person visits (even only once)
  • When a person is in a particular location
  • What apps a person has installed
  • When and how long apps are used by a person
  • For example, a burglar could use advertising-based intelligence to make sure that you're not home. Paparazzi could track celebrities; or a lover could check up on sexual infidelity. Governments could use it to collect information on demonstrators.

    How It Works

    The first step is finding the target phone's mobile advertising ID (MAID). This is a pseudorandom identifier to uniquely identify a particular device for advertising and works much the way Tracking Cookies are used in browsers.

    The researchers had the target open the app about once a minute, simulating what might happen during a text conversation.

    What the authors tested most thoroughly was their ability to track someone on their daily commute to work. The trip started from home and continued on to a coffee shop and bus stop. This was followed by a bus ride and a walk to the office.

    The team, from the Paul G. Allen School of Computer Science & Engineering at the University of Washington, was able to track the target everywhere along this commute except for the bus ride and walking route. That's home, coffee shop, bus stop and office.

    The process isn't magic. It requires some help from the person who is the target. They have to open the appropriate app at each location (or keep it open) for the method to work. More specifically, an ad needs to connect with the app at each location, an issue that rarely poses a problem if the app is open.

    In the commute just described, the researchers had the target open the app about once a minute, simulating what might happen during a text conversation.

    How Can I Protect Myself?

    There aren't many ways you can defend against this type of attack. Disabling location tracking within individual app settings could help, the researchers say, but advertisers still may be capable of finding location data in other ways. Changing your mobile advertising ID is a good idea, at least until the person or persons who are after your information find the new ID.

    The authors recommend that people concerned about these risks consider resetting their mobile advertising ID, but they think that the most effective solutions involve restrictions placed on or by the advertisers.

    The paper was published at WPES 2017, the 16th Association for Computer Machinery (ACM) Workshop on Privacy in the Electronic Society.

    The authors have also written a series of FAQs which explain the study and its findings in simpler terms. The FAQ includes links that will show you how to shut off your phone's mobile advertising ID (MAID) and location access to apps, both for iPhones and Android phones.

    NOTE: We regret that we cannot answer personal medical questions.
    © 2016 interMDnet Corporation.