Apps with access to your phone's microphone can pick up high-frequency tones in advertisements and billboards, web pages and retail outlets or sports stadiums and build a profile about what you've seen, where you've been and even the websites you've visited.
The researchers from the Technical University of Braunschweig noted in their report that some apps use the beacons to display advertising content on user's phones that are specific to their location, such as tickets and festival vouchers. These ultrasonic beacons have already been installed in two unnamed European cities.
The team of researchers criticised the technique as a “threat to the privacy of a user.”
The technology allows ad companies to link media-consuming habits to a person's identity by picking up ultrasonic tones from websites, and radio and television broadcasts. It can also be used to de-anonymise users of Bitcoin, in which a name is not needed.
Researchers say it's not known off the bat if an app contains the ad-tracking technology, but if it asks for your microphone, that could be a dead giveaway.
“The user just needs to install a regular mobile application that is listening to ultrasonic signals through the microphone in the background. Once the user has installed these application on her phone, she neither knows when the microphone is activated nor is she able to see which information is sent to the company servers,” said the researchers.
It's not as simple to tell if an app has the ultrasonic technology built-in, but it would be smart for users to check their app permissions. Switch off your microphone if there's no reason for an app to have access to it.
Reacting to this news, Robert Lipovsky, researcher at ESET, told SC Media UK:
"Although the described techniques may sound as science fiction, it's not overly surprising. Location tracking based on ultrasonic beacons, while innovative, appears as another method of location tracking, which, sadly, doesn't raise an eyebrow from most users. And this privacy-ignoring mindset is the biggest problem."
“Technically speaking, the methods are not merely a question of individual apps, but entire advertisement frameworks. Unfortunately, unlike regular malware, ads and their intrusiveness is a sensitive grey area.”
“Our findings strengthen our concerns that the deployment of ultrasonic tracking increases in the wild and therefore needs serious attention regarding its privacy consequences,” the researchers concluded.