Playing Candy Crush, swiping left on a dating app and checking your Yahoo inbox shouldn’t expose your location. I say shouldn’t, but those apps and thousands more were likely hijacked by data brokers who turned your personal info into cash.
Now, cybercriminals on the Dark Web have access to the location information of tens of millions of people. I’ll explain how this happened and share my secret weapon for fighting this kind of privacy invasion.
🔎 Whodunnit?
It all started with Gravy Analytics, a data broker that tracks over a billion devices worldwide. (They also own Venntel, which sells info to U.S. government agencies like the FBI and IRS.) A Russian hacker wormed into Gravy’s records, stealing 1.4 gigabytes of info.
▶️ That data includes over 30 million location points. 404 Media (paywall link) investigated the breach and found the shocking way they obtained your whereabouts.
This is clever (and super sketchy)
When you open a site or app, there’s a millisecond-long auction to decide the ads you see. The process is called real-time bidding (RTB), and it’s based on, among other things, all the data points they have about you and what you’re most likely to buy.
RTB collects enough information to make sure the right people are seeing an ad, and data brokers are in those auctions, too, with another purpose: To snag your info. The scummiest part is they don’t even need to buy any ads to do it.
The Gravy Analytics leak data shows thousands of apps gathered your location data. The working theory is they collected RTB data themselves or bought it from other data-broker companies.
Who’s on this list?
The list is long, and I’ll get to the specifics. Some apps, like Tinder, say they’ve never worked with Gravy Analytics. (I’ve heard that excuse before.) But if the info came from RTB, that’s in the advertising ecosystem, not the app’s code.
Really, that’s worse in some ways. This type of location tracking is happening through apps whether or not developers explicitly OK it. This includes:
Continue reading →