What Mobile Ads Know About Mobile Users By Sooel Son (Google), Daehyeok Kim (KAIST), and Vitaly Shmatikov (Cornell Tech) Presented by Rebecca Lee

Introduction Mobile Apps rely on advertising for most of their income Apps use advertising libraries (AdSDKs) to deliver ads 41% of Apps in the Google Play Store uses at least one mobile advertising library AdSDKs fetch ads from its servers and displays it to users Redirection, obfuscation, and proliferation of ads makes it difficult to check they are safe This study focuses on the idea of malicious advertisers Introduction

Background Focused on 4 popular Android AdSDKs AdMob MoPub AirPush AdMarvel External storage in a modern Android device is shared Some apps cache files with very predictable names Easier for malicious advertisers to have their ads displayed Each Creative (Ad) displayed on a mobile device is called an Advertising Impression Background

The Threat AdSDKs need access to geolocation and external storage Permission requested by the app is for AdSDK or app? Users cannot determine Critical for AdSDK to reduce latency, thus need cached files From Android 4.4, permission is needed to access external storage READ_EXTERNAL_STORAGE permission is implicitly granted by the WRITE_EXTERNAL_STORAGE permission MoPub, AirPush, and AdMarvel all ask for the Write permission The Threat

Integrate each AdSDK into an Android test app and use a proxy server to analyse advertising requests Target app creates the local files that contain sensitive information Attack-vector app is the ad- supporting app that happens to show a malicious creative Experiment & Results

Sensitive Information Medications Gender preferences for dating partners Browsing history Social graph User trajectories Sensitive Information

Attack Mechanism Reading local files User downloads an HTML page that holds malicious payload (unintentionally) Attacker’s ad invokes the payload, Javascript in the payload can steal local files Javascript code may seem harmless in Web Context , when translated into Mobile context, causes privacy issues Attack Mechanism

The Defence Developers have few options to protect their users No way for app developers to restrict privileges of the AdSDKs they include Apps cannot confine WebView modules to subspace of external storage, not supported by Android AdSDK providers can Ban scripts -> Impractical “Jail” the WebView instance *Proposed defence is designed against malicious advertisers. Not effective against malicious apps The Defence

Opinions Not many experiments The Experiment Assumptions Proxy servers Phones tested Android versions tested Apps tested Opinions

After thoughts Expectations What other ways of attacking? What can users do? IOS? After thoughts