Locate smartphones using Advertising ID without spyware or exploit

This blog is actually a video that explains how it is possible to locate Google and Apple smartphones legally by misusing device unique Advertising ID and stream of data collected by advertising plugins. These plugins are part of thousands of popular and legitimate apps. Problem is that these data are being sold to third party companies that use it to create a smartphones tracking tool. Unfortunately, this is not just a theoretical scenario, because US government already bought such software.

Figure 1. Number of plugins in MyFitnessPal app (source: https://www.appbrain.com/app/com.myfitnesspal.android)

This information was disclosed on October 23, 2024 by KrebsOnSecurity, 404media, and Notus.

In the video I will explain how this technique works, demonstrate how app retrieved Advertising ID eight times right after startup and share with you how to disable this ID for Android and iOS.