Cracking Open the Black Box of Online Advertising to Obtain User Browsing Histories

Abstract

The collection of personal data in targeted advertising raises privacy concerns. In this paper, we explore single-user targeting and exploit advertiser capabilities to obtain user browsing histories. We investigate the features of 57 demand-side platforms, develop a threat model, and implement a proof-of-concept attack. We find that our attack is successful on 52.6% of Alexa Top 200 sites that sell ad space. We demonstrate that by selling ads, publishers inadvertently sell user data.