Introduction to DecryptAds
DecryptAds is a powerful and free new service that scrapes and correlates adtech data, making it simple to quickly learn a great deal about the entities that are tracking you. The service was launched to address the need for a more complete picture of the advertising ecosystem for each website or app.
How DecryptAds Works
DecryptAds constantly scrapes the files that websites and apps make publicly available to disclose the companies that are permitted to run ads or collect user data. These files include ads.txt, app-ads.txt, buyers.json, and sellers.json. Zach Edwards, chief research officer for DecryptAds and a threat researcher at Infoblox, stated that the adtech data in these files is generally only useful when it can be cross-referenced.
Use Cases for DecryptAds
Edwards explained that DecryptAds is built for a lot of privacy and security use cases that have been dramatically underserved. These use cases include tracking down the source of malicious ads, identifying ad networks located in adversarial nations, and detecting AI-generated slop websites and apps.
Example: ESPN.com
A search in DecryptAds for espn.com reveals 143 ad partners and 19 registered data broker domains. The data broker information is gradually becoming available because four states have recently passed laws requiring data brokers to register if they buy or sell data on consumers from those states.
Geo-Risk Areas
DecryptAds also makes it easy to learn the beneficiaries and national origins of the advertising firms lurking in apps and websites. The service displays a conspicuous warning when adtech partners of an app or website are based in geo-risk areas like China and Russia.
Example: Between Digital
According to DecryptAds, espn.com works with four different advertising entities that are based in either Russia, China, or the UAE, including the adtech firm Between Digital. However, the dossier on Between Digital flags them as a Russian firm, showing that their publisher offers are processed through Alfa Bank, Russia's largest private commercial bank.
Quiet Removals
Edwards stated that when advertising networks suspect a given advertiser is engaged in unauthentic clicks or displaying malicious ads, very often those networks will quietly remove the offender from their list of approved partners without letting anyone else know about their suspicions.
DecryptAds' Quiet Removals Feed
DecryptAds features a quiet removals feed that records and correlates all of the sellers.json removals across ad exchanges for the same seller domain or name. This feed helps to address the visibility gap and makes it easier to detect suspicious activity.
Malvertising and AI Slop
Malvertising, the practice of inserting malicious ads that foist malware or redirect visitors to phishing pages, remains an all-too-frequent occurrence in the modern adtech industry. Edwards stated that these malicious ads are far more commonly found now on newly generated AI slop websites than on high traffic destinations.
Example: Fengwo Group
A DecryptAds legal dossier on the Fengwo Group domain name for an AI slop website shows it shares a seller ID with a gaming website, which features another seller ID. Pivoting on that latter seller ID reveals hundreds of active websites within Russia's Yandex ad system featuring extremely low-quality games or simple utilities that pepper visitors with ads.
Conclusion
DecryptAds offers a powerful tool for exposing adtech data and tracking down malicious activity. The service provides a much-needed solution for addressing the underserved privacy and security use cases in the adtech industry. By using DecryptAds, users can gain a better understanding of who's tracking them and take steps to protect themselves.
Source: Krebs on Security