Who's Tracking You? Use This New Service to Find Out
Who’s Tracking You? Use This New Service to Find Out
A powerful and free new service called DecryptAds scrapes and correlates adtech data, making it simple to quickly learn a great deal about the entities that are tracking you. The newly launched decryptads.com is constantly scraping the files that websites and apps make publicly available to disclose the companies that are permitted to run ads or collect user data.
These files include:
- ads.txt: all of the adtech companies and data brokers that may run ads or harvest data from the site;
- app-ads.txt: entities that can harvest data from or display ads on mobile and smart TV apps;
- buyers.json/sellers.json: the entities buying, selling, or reselling ad inventory for a given site or app.
Zach Edwards, chief research officer for DecryptAds and a threat researcher at the security company Infoblox, stated that he and two other founders decided the service was needed because the adtech data in these files is generally only useful when it can be cross-referenced to build a more complete picture of the advertising ecosystem for each website or app. “It’s an adtech tool, but we’re trying to approach adtech from a security perspective,” Edwards said. “It’s really built for a lot of privacy and security use cases that have been dramatically underserved.”
Those use cases include tracking down the source of malicious ads that try to foist malware on targeted users, identifying ad networks located in adversarial nations, and detecting the fast-growing swarms of AI-generated slop websites and apps. “Supply-chain integrity issues rarely live in a single file,” the site explains.
DecryptAds also makes it easy to learn the beneficiaries and national origins of the advertising firms lurking in apps and websites, displaying a conspicuous warning when adtech partners of an app or website are based in “geo-risk” areas like China and Russia. According to DecryptAds, espn.com works with four different advertising entities that are based in either Russia, China, or the UAE, including the adtech firm Between Digital, which lists a New York address. However, the dossier on Between Digital flags them as a Russian firm, showing that their publisher offers are processed through Alfa Bank, Russia’s largest private commercial bank and one of several financial institutions placed under U.S. sanctions in 2022 after Russia invaded Ukraine.
A search for several top U.S. military news websites shows they all allow Between Digital to serve ads and track users, as well as two entities in the UAE and another in the ownership secrecy haven of Panama. “It means they are basically playing both sides of the bidding equation, which creates opportunities to direct client spend at your owned and operated properties or client infrastructure,” Edwards told KrebsOnSecurity.