AppLovin – The two-second ad auction you never see
AppLovin operates a mobile ad auction network that sells ad slots in real time to the highest bidder. A recent analysis revealed that the encryption keys used in these auctions can be derived from publicly accessible app data, allowing for potential user tracking. Despite users opting out of tracking, other device identifiers are still sent, raising privacy concerns.
- ▪AppLovin runs one of the largest mobile ad auction networks under the brand name MAX.
- ▪A security researcher found that AppLovin's encryption keys can be derived from a plaintext SDK key in app bundles.
- ▪Even when users opt out of tracking, other device identifiers are still sent, allowing for device fingerprinting.
Opening excerpt (first ~120 words) tap to expand
What happens when you open the app. A mobile "ad auction" is exactly what it sounds like. Every blank ad slot in a free app is sold in real time to the buyer willing to pay the most. The auction finishes in a few hundred milliseconds. To bid intelligently, each ad company wants signals about the device and the user, and the app sends those signals along with the request, where every bidder sees them whether they win or lose. AppLovin runs one of the largest such auction networks on mobile, under the brand name MAX. Concretely: you open a free game. Before the first frame draws, the phone sends a tiny encrypted request to a server called ms4.applovin.com. That request asks AppLovin to run the auction for the slot on your screen. AppLovin doesn't run it alone.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at NowSecure Labs.
Discussion
0 commentsMore from NowSecure Labs
