Spying on Android users through targeted ads

Targeted ads are a vital source of revenue for ad networks, and ad networks compile detailed profiles of users for targeting purposes. This wealth of private information can motivate an attacker to spy on a victim by sampling the victim's information available at the ad networks. In this paper, we explore the possibility to spy on an Android user by requesting ads targeted at that user. During our controlled experiments, an attacker was able to remotely request and receive mobile ads using a leaked identifier belonging to their victim. The lack of targeted ads from some of the studied ad networks, which we believe to be partly caused by our geographical location, restricts us from drawing strong conclusions on the success of such an attack. However, we believe that our methodology can be used to perform similar experiments to explore the success in spying on Android users through targeted ads.