1. What Mobile Ads Know About Mobile Users
By Sooel Son (Google), Daehyeok Kim (KAIST), and Vitaly Shmatikov (Cornell Tech)
Presented by Rebecca Lee

2. Introduction Mobile Apps rely on advertising for most of their income
Apps use advertising libraries (AdSDKs) to deliver ads
41% of Apps in the Google Play Store uses at least one mobile advertising library
AdSDKs fetch ads from its servers and displays it to users
Redirection, obfuscation, and proliferation of ads makes it difficult to check they are safe
This study focuses on the idea of malicious advertisers
Introduction

3. Background Focused on 4 popular Android AdSDKs AdMob MoPub AirPush
AdMarvel
External storage in a modern Android device is shared
Some apps cache files with very predictable names
Easier for malicious advertisers to have their ads displayed
Each Creative (Ad) displayed on a mobile device is called an Advertising Impression
Background

4. The Threat AdSDKs need access to geolocation and external storage
Permission requested by the app is for AdSDK or app?
Users cannot determine
Critical for AdSDK to reduce latency, thus need cached files
From Android 4.4, permission is needed to access external storage
READ_EXTERNAL_STORAGE permission is implicitly granted by the WRITE_EXTERNAL_STORAGE permission
MoPub, AirPush, and AdMarvel all ask for the Write permission
The Threat

5. Integrate each AdSDK into an Android test app and use a proxy server to analyse advertising requests
Target app creates the local files that contain sensitive information
Attack-vector app is the ad- supporting app that happens to show a malicious creative
Experiment & Results

7. Sensitive Information
Medications
Gender preferences for dating partners
Browsing history
Social graph
User trajectories
Sensitive Information

8. Attack Mechanism Reading local files
User downloads an HTML page that holds malicious payload (unintentionally)
Attacker’s ad invokes the payload, Javascript in the payload can steal local files
Javascript code may seem harmless in Web Context , when translated into Mobile context, causes privacy issues
Attack Mechanism

9. The Defence Developers have few options to protect their users
No way for app developers to restrict privileges of the AdSDKs they include
Apps cannot confine WebView modules to subspace of external storage, not supported by Android
AdSDK providers can
Ban scripts -> Impractical
“Jail” the WebView instance
*Proposed defence is designed against malicious advertisers. Not effective against malicious apps
The Defence

10. Opinions Not many experiments The Experiment Assumptions Proxy servers
Phones tested
Android versions tested
Apps tested
Opinions

11. After thoughts Expectations What other ways of attacking?
What can users do?
IOS?
After thoughts