DecryptAds Service Illuminates Adtech Tracking and Privacy Risks

A new free service called DecryptAds is making it significantly easier for security researchers and privacy-conscious individuals to understand the complex web of advertising technology (adtech) companies that track users across websites and mobile applications. By scraping and correlating publicly available adtech data, DecryptAds aims to shed light on entities involved in ad serving, data harvesting, and programmatic advertising, offering crucial use cases for identifying malicious ads, detecting scam sites, and understanding supply-chain integrity.

The service focuses on three key types of files that publishers make available: ads.txt, which lists authorized sellers for ad inventory on websites; app-ads.txt, serving a similar purpose for mobile and smart TV apps; and buyers.json/sellers.json, which detail the entities buying, selling, or reselling ad inventory. Traditionally, this data has been siloed within large advertising platforms, making it difficult to piece together a comprehensive view of the advertising ecosystem for any given site or app. DecryptAds bridges this gap by cross-referencing this information to build a more complete picture.

Zach Edwards, Chief Research Officer at DecryptAds and a threat researcher at Infoblox, explained that the tool was developed to address underserved security and privacy use cases. "It's really built for a lot of privacy and security use cases that have been dramatically underserved," Edwards stated. He highlighted its utility in tracking down the origins of malicious ads, identifying ad networks operating from adversarial nations, and spotting the proliferation of AI-generated scam websites and applications.

The importance of cross-referencing data becomes apparent when examining potential security and privacy threats. DecryptAds emphasizes that supply-chain integrity issues rarely manifest in a single file. Instead, they often appear as broken cross-references between different adtech declaration files, cloned declaration sets across unrelated domains, or seller removals that only make sense when viewed across multiple exchanges. The service also flags supply paths in bid logs that are not present in a publisher's authorized-seller list, indicating potential manipulation or misrepresentation.

DecryptAds also provides a "Geo Risk" feature, flagging adtech partners operating from countries deemed high-risk, such as China, Russia, Cyprus, and the United Arab Emirates (UAE). For example, a search for espn.com revealed that it works with four advertising entities based in these geo-risk areas. One such entity, Between Digital, lists a New York address but is flagged by DecryptAds as a Russian firm whose publisher offers are processed through Alfa Bank, a Russian bank under U.S. sanctions. Similar findings were noted for several U.S. military news websites, which also allow Between Digital and entities from the UAE and Panama to serve ads and track users.

Edwards further pointed out potential conflicts of interest within the adtech ecosystem. He noted that companies like Between Digital, which act as both publishers and resellers, can direct client spending towards their own properties or associated infrastructure. "The problem we have right now is that for years we've had almost no one policing these ads.txt and app-ads.txt files," he commented, underscoring the need for greater oversight and transparency.

The service also leverages recent state-level data privacy legislation, such as laws in California, Oregon, Texas, and Vermont requiring data brokers to register if they buy or sell data on consumers from those states. This has led to more data broker information becoming publicly available within the ads.txt and app-ads.txt files, which DecryptAds aggregates. For espn.com, nearly half of the listed data brokers collect geolocation data from users who are not blocking ads, while others disclose the collection of device fingerprints and sensitive personal information.

By consolidating and analyzing this disparate adtech data, DecryptAds offers a powerful new tool for understanding the often-opaque advertising landscape, empowering users and security professionals to better identify and mitigate privacy risks and potential malicious activities within the digital advertising supply chain.