DecryptAds exposes the murky depths of the global adtech ecosystem and its hidden security risks
Navigating the labyrinthine world of online advertising has long been a daunting task for both privacy advocates and security researchers. While the digital footprints left by websites and mobile applications are technically public, the information regarding which entities are harvesting user data or serving advertisements has remained sequestered behind the opaque walls of massive advertising conglomerates. A newly launched service, DecryptAds, seeks to dismantle this information asymmetry by scraping, correlating, and simplifying complex adtech data, providing a transparent view into the entities tracking users across the digital landscape.
The platform, accessible at decryptads.com, functions by continuously monitoring the publicly available declaration files that websites and mobile applications utilize to authorize ad partners. These files—specifically ads.txt, app-ads.txt, and the associated sellers.json and buyers.json files—serve as the backbone of the advertising supply chain. Historically, these files have been difficult to parse, and their true value only emerges when cross-referenced to form a comprehensive picture of the advertising ecosystem. By automating this synthesis, DecryptAds allows users to identify not just the companies involved, but the potential security vulnerabilities inherent in their partnerships.
The Genesis of Adtech Transparency
Zach Edwards, the chief research officer at DecryptAds and a veteran threat researcher at Infoblox, spearheaded the project alongside two co-founders. According to Edwards, the service was born out of a critical need to approach advertising technology through the lens of cybersecurity. The adtech industry has long been plagued by a lack of oversight, leaving these declaration files largely unmonitored.
"It’s an adtech tool, but we are trying to approach it from a security perspective," Edwards stated. "It is built for privacy and security use cases that have been dramatically underserved." The implications of this work are significant. By aggregating data across these files, the service can detect "supply-chain integrity issues" that are invisible when looking at a single file in isolation. These include broken cross-references, cloned declaration sets across unrelated domains, and discrepancies between authorized seller lists and actual bid logs.
A Data-Driven Look at Industry Giants
To illustrate the depth of the tracking ecosystem, a search of the popular sports network espn.com on the DecryptAds platform reveals a staggering 143 advertising partners and 19 registered data brokers. This granular level of insight is bolstered by recent legislative shifts in the United States. Laws in California, Oregon, Texas, and Vermont now mandate that data brokers register if they engage in the buying or selling of consumer information.
DecryptAds’ analysis suggests that nearly half of the brokers associated with major domains like ESPN are collecting geolocation data from non-blocking visitors. Furthermore, several entities explicitly disclose the collection of device fingerprints and other sensitive personal information. This data collection is often automated, occurring in the background without the explicit, informed consent of the end-user, illustrating the expansive nature of modern surveillance capitalism.
Geopolitical Risks and the Supply Chain
One of the most concerning features of the DecryptAds platform is its "geo-risk" analysis. The service flags advertising partners based in high-risk jurisdictions, including Russia, China, and nations with significant political and financial ties to these countries, such as Cyprus and the United Arab Emirates.
The findings are striking. Even high-profile American outlets, including military-focused news sites such as armytimes.com and defensenews.com, have been found to allow adtech firms with questionable origins to serve content and track users. A notable example is Between Digital, a firm that lists a New York address but is identified by DecryptAds as a Russian-based entity. The dossier on Between Digital indicates that its publisher offers are processed through Alfa Bank, Russia’s largest private commercial bank, which has been subject to U.S. sanctions since the 2022 invasion of Ukraine. Despite these connections, Between Digital maintains a presence on approximately 55,000 partner websites, highlighting the severe lack of vetting within the adtech supply chain.
The Mechanics of Malvertising and AI Slop
The rise of AI-generated "slop"—low-quality websites and apps filled with machine-generated content—has exacerbated the problem of malvertising. Malvertising, the practice of using advertising networks to distribute malware or redirect users to phishing sites, is thriving in the ecosystem surrounding these AI-generated platforms.
According to Edwards, while high-traffic, reputable websites employ rigorous protection standards, AI-driven content farms often bypass these safeguards to maximize short-term revenue. These sites frequently partner with low-tier ad networks, effectively creating a "greased rail" for cybercriminals to deliver zero-click payloads to unsuspecting users.
The recent case involving the H96 line of TV streaming sticks provides a grim case study. Researchers from Bitsight discovered that these devices were not only renting out users’ internet connections but were also spoofing themselves as mobile devices to click on ads hosted by AI-generated websites. DecryptAds was able to trace these activities back to the Fengwo Group, a Chinese entity that managed both the malicious applications on the streaming sticks and the network of ad-heavy, AI-generated sites receiving the fraudulent clicks.
Improving Accountability: The Quiet Removals Feed
A central challenge in addressing ad fraud is the industry’s tendency to handle bad actors behind closed doors. When an ad exchange identifies an advertiser engaging in malicious behavior, they often remove the offender from their sellers.json file without public notice. This "quiet removal" allows the fraudulent firm to continue operating across other platforms, evading accountability.
DecryptAds addresses this with a "quiet removals feed," which correlates seller removals across multiple exchanges. By documenting these patterns, the service provides security professionals with the intelligence needed to identify serial offenders. Edwards emphasizes that the adtech industry must move toward greater transparency, specifically by sharing the "supply chain object" (SCO)—structured data that reveals the full path of an ad impression. Currently, the lack of access to this server-side data makes it nearly impossible for publishers and security teams to track the origin of a malicious ad payload.
Practical Steps for User Protection
For the average internet user, the complexity of the adtech ecosystem underscores the importance of proactive defense. Security experts generally recommend the following strategies to mitigate tracking and malvertising risks:
- Browser-Level Ad Blocking: Utilizing open-source, maintained extensions such as uBlock Origin Lite is considered the most effective first line of defense for desktop users. These tools block ads and trackers before they can load, preventing the initial handshake between the user’s device and the adtech server.
- Network-Level Blocking: For those seeking a more robust solution, implementing a "DNS sinkhole" like Pi-hole on a local network device, such as a Raspberry Pi, provides a comprehensive, scalable defense that covers all devices connected to the home or office network.
- App Vigilance: Mobile apps are often more intrusive than their browser-based counterparts, frequently collecting precise location and usage data. When possible, interacting with services directly through a web browser is safer. Users should also remain cautious about the apps they install on mobile devices and smart TVs, as these are increasingly targeted for data harvesting.
The Road Ahead
The launch of DecryptAds represents a shift toward greater accountability in an industry that has operated in the shadows for far too long. By providing researchers and the public with the tools to visualize the adtech supply chain, the platform is forcing a conversation about the risks associated with the current digital advertising model.
The implications extend beyond privacy; they touch upon national security, the integrity of the internet, and the proliferation of harmful content. As organizations and regulators begin to grapple with these issues, the ability to parse and understand adtech data will become an essential skill for anyone tasked with securing digital infrastructure. While total transparency may remain an elusive goal, tools like DecryptAds provide a necessary roadmap for identifying, monitoring, and ultimately mitigating the risks posed by the modern adtech machine.
Related posts:
