How AdFection exploits a largely unprotected system

The online ad market operates largely via real-time bidding (RTB), auctions hosted by ad exchanges. Run by companies like Google, these take place “hundreds of billions” times a day, the researchers explained. When an ad box pops up on an app or website on a user’s device, it immediately triggers a bid request; advertisers then submit their offers, and the exchange grants a winner the ability to push their ad to the user within split seconds. These ads can contain images, video, and, most importantly to cybercriminals, code.

Demand-side platforms (DSPs) and supply-side platforms (SSPs) act as intermediaries in the process, and data about specific users and devices is shared across the exchanges so advertisers can decide whether they want to show specific ads to a specific individual, based on device identifiers and characteristics such as a user’s precise location, cookie ID, mobile ad ID, or IP address.

“The auction system is designed to enable targeting single individuals,” the researchers explained. “The totality of information gleaned from ad auctions is quite valuable.” Companies with access to auction data can track users without their knowledge, across cellular, Wi-Fi, and virtual private networks (VPNs).