If you are not paying for it, you are the product

Abstract

Online advertising is progressively moving towards a programmatic model in which ads are matched to actual interests of individuals collected as they browse the web. Le ing the huge debate around privacy aside, a very important question in this area, for which li le is known, is: How much do advertisers pay to reach an individual?In this study, we develop a rst of its kind methodology for computing exactly that -the price paid for a web user by the ad ecosystem -and we do that in real time. Our approach is based on tapping on the Real Time Bidding (RTB) protocol to collect cleartext and encrypted prices for winning bids paid by advertisers in order to place targeted ads. Our main technical contribution is a method for tallying winning bids even when they are encrypted. We achieve this by training a model using as ground truth prices obtained by running our own "probe" ad-campaigns. We design our methodology through a browser extension and a back-end server that provides it with fresh models for encrypted bids. We validate our methodology using a one year long trace of 1600 mobile users and demonstrate that it can estimate a user's advertising worth with more than 82% accuracy.

There goes Wally: Anonymously sharing your location gives you away

“…However, in exchange, and not explicitly communicated to the user, they sell collected user data to interested third-parties. This is typically the case within the real-time bidding ad-ecosystem, where data such as location and user behavioral traits are sold for better ad-targeting [17].…”

Master of Web Puppets: Abusing Web Browsers for Persistent and Stealthy Computation

“…There are also several cases where a website can end up hosting malicious content unintentionally. Those cases include: (i) the website registers a benign service worker that includes untrusted dynamic thirdparty scripts [52], which in turn possibly load malicious code; (ii) the website includes third-party libraries 1 , one of which can turn rogue or be compromised, and then divert the user to a new tab (e.g., using popunders [37] or clickjacking [80]) where it can register its own service worker bound to a third-party domain; (iii) the website is compromised and attackers plant their malicious JavaScript code directly into the page, thus registering their malicious service worker -a scenario that we see quite often in recent years [58], [53]; or (iv) the website includes iframes with dynamic content, which are typically auctioned at real-time [73] and loaded with content from third parties.…”

CrowdLED: Towards Crowd-Empowered and Privacy-Preserving Data Sharing Using Smart Contracts

“…Using smart contracts, service providers can ensure that rewards provided by the service, and the data provided by users are exchanged simultaneously. This can be achieved because smart contract terms and conditions are strictly followed after they are agreed by the parties involved [13].…”