Ad targeting can be used to track a target's location for $1,000
Ad-targeting technology, costing just $1,000, can track users' locations and other personal data with alarming accuracy, according to a report from security researchers from the University of Washington. Demand-side platforms enable ad buyers to input specific parameters, such as demographic, app choices and mobile model, which can be used to track users' phones within a range of 25 feet whenever apps are open. The team was able to follow a test subject over seven days, successfully locating the person's home and work addresses.

"If you want to make the point that advertising networks should be more concerned with privacy, the bogeyman you usually pull out is that big corporations know so much about you. But people don't really care about that," says University of Washington researcher Paul Vines. "But the potential person using this information isn't some large corporation motivated by profits and constrained by potential lawsuits. It can be a person with relatively small amounts of money and very different motives."

The research team used 10 Moto G Android phones for testing, a mobile banner ad they created, and a website that served as the landing page if someone clicked on the ad. Then they spent the minimum $1,000 deposit to place orders with a so-called demand-side platform—think Facebook, Google AdWords, MediaMath, Centro, Simpli.fi, and others—that allows ad buyers to specify criteria like where their ad appears, for which unique phone identifiers, and in which apps. (They declined to reveal which specific DSP they tested, arguing that nothing about that platform was more intrusive than many others in the industry.)

They then used that DSP to place a geographic grid of location-targeted ad buys around a 3-mile-square section of Seattle, which for their tests they set to appear on the popular ad-supported calling and texting app Talkatone.

Every time a target phone had Talkatone open near one of the coordinates the researchers had set on their grid of ad buys, the ad would appear on it, the researchers would be charged 2 cents, and they'd receive confirmation from the DSP of approximately where, when, and on which phone the ad had been shown. With that method, they they were able to follow their test phones' locations within a range of about 25 feet any time the phone user left an app open in one location for about 4 minutes or opened it twice in the same location during that time span. They registered just a 6-minute delay in the ad network's real-time reporting of the phone's location. Following a human test subject carrying each test phone over seven days, they were able to easily identify the person's home and work address, based on where their target stopped. (See the map above.)

"You’re using whether or not your ad gets served as an oracle to tell you whether or not an event happened: that this particular device was at this location," Vines says. They note that the DSP they used never flagged their behavior as unusual or cut off their account for attempting targeted surveillance.

That tracking method has a couple of serious limitations. The target would have to have a certain app open on their phone at the time they're being tracked, so that the ad can appear. And to track a specific phone, any ad-buying spy would have to know a unique identifier of the target phone, known as a mobile advertising ID, or MAID.

But to get around the first of those limitations, a spy could buy ads against a range of popular apps in the hope that one of them would show the ad. And for the second, the researchers suggest a variety of ways to obtain that MAID, including placing an "active-content" ad that uses javascript to pull the MAID from a phone at a certain location, then use that identifier to continue to track the phone with normal ads. Perhaps more simply, they point out, MAIDs can also be intercepted by someone on the same Wi-Fi network as the target phone.