Apple VS Facebook on Ads and Consumer Privacy: Let’s Get Ready to Rumble

Posted on October 1, 2021June 30, 2026 by io-fund

Two years ago, the I/O Fund wrote about Apple’s mobile privacy changes and kept our newsletter readers aware of these changes as they rolled out. Going into earnings, we are seeing headlines that Facebook may be affected. We think when Big Tech goes up against Big Tech, that investors should watch the outcomes closely. Our stance for the past two years is that Apple owns the real estate on iOS, and everyone else is renting. The hierarchy is straight forward yet many critics question Apple’s decisions, often feigning concern for the impact to small businesses. We do not think Facebook cares about small businesses at all, per se, but rather about ad dollars.

This upcoming quarter will be the first full quarter to reflect the change. Some models suggest about 7% decline if 20% of iOS users opt-in. The opt-in rates quoted here match what is being reported (about 1 in 5 users opt-in for Facebook to track them). Flurry also stated about 20% were opting in. Meanwhile, according to Bloomberg, some agencies are reporting that companies went from spending “nearly all” of their budget on Facebook to more around two-thirds or half of their budget due to the iOS tracking changes.

The reality is that Apple built the ecosystem and it’s theirs to monetize as they see fit. In this equation, consumers matter too, and data should not have been collected without permission in the first place. Although we’ve been covering privacy concerns since 2014, we specifically called out Facebook in 2018 during Cambridge Analytica to discuss the various ways Facebook was collecting data without permissions.

We’ve also maintained that Apple is running out of near-term growth markets so it makes sense they’re looking for ways to expand their revenue. Below is a snapshot of Apple’s growth pre-Covid in 2019. Due to an increase in time spent indoors, even sleepy segments like personal computers exploded overnight. However, these segments could return to pre-Covid levels (or even lower if consumer hardware saw a pull forward). This helps us to understand Apple’s motivation taking back its real estate. My only question is … why didn’t Apple do this sooner?

Pictured below: 2019 revenue for Apple and it’s iPhone segment

Below are excerpts and links to our previous analysis, which was written for our free newsletter subscribers over the past few years.

Governments Won’t Be Able to Stop Facebook and Google — But Apple Could

Published October 3rd, 2019 in MarketWatch

In April 2018, Congress tried to piece together how Facebook’s platform works. It ended up being a disaster. Anyone who works in the mobile-ad industry knows that the mobile device, notorious for its massive data leakage, could be used to collect thousands of data points daily to reveal personal thoughts, behaviors and political preferences.

When Facebook CEO Mark Zuckerberg answered a question on how Facebook makes money — “We sell ads, senator” — he wasn’t fooling the ad industry. It’s well aware that Facebook sells audiences and identities, as the company’s ads would be worthless without extracting data points from the mobile device and aggregating them for targeting.

This isn’t your typical targeting of pizza (or beer) ads during football games. This targeting knows you better than you know yourself, as it monitors your actions with data science and look-alike modeling.

The only force that can stand up to the complex tracking methods used by Google and Facebook will be an opposite, yet equal, force. It will not come from governments, which think that paying for search results is the problem. Rather, the problem is the pervasive code and software that continually tracks people, which no competitor can compete with.

Turns out, there is an opposite and equal force in magnitude that has chipped away at the anti-competitive tracking that occurs in the browser with Intelligent Tracking Prevention (ITP). Yet it has not done so on the leakiest device of all: mobile. And that would be Apple.

Facebook and Google aren’t the only companies that track users on mobile and browsers. They simply have software and code in more places. For instance, Facebook’s software is in 32% of the top 500 app market — and up to 800,000 applications. They track billions of non-Facebook users with software that can track you whether you have navigated one of their digital properties or not.

There is no way to opt out of Facebook or Google from tracking you, as their tracking is simply everywhere. In fact, security experts, including Bruce Schneier of the Berkman Center for Internet and Society at Harvard, call such tracking outright surveillance.

The incredible depth of information those giant companies have on mobile and internet users is the “moat” that generates unprecedented cash flow in advertising.

Advertising Stocks Face New, Major Challenge with Apple’s iOS 14

Excerpts:

Tim Cook has publicly criticized [Facebook with its software development kit “Audience Network” installed in 300,000 applications on iOS and Android combined and has seen nearly 200 billion downloads. Google’s AdMob is even worse with installation in 1.5 million applications and 375 billion downloads. (Now consider that users did not authorize or download this software on purpose!)

[Despite Apple’s privacy advertisements] what happens on the iPhone most certainly does not stay on the iPhone. Mobile has become a free-for-all in data collection over the past ten years. The device leaks volumes of information through software development kits (SDKs) installed inside every application. Most applications have 18 SDKs, which extends beyond Facebook and Google to include a mix and match of ad software companies although the most pervasive being Google and Facebook who are inside the far majority due to the depth of their data for cross-targeting.

The concept of Apple pioneering privacy at the client level is not new. Apple began to restrict tracking on the Safari browser through iterations of Intelligent Tracking Prevention (ITP) from 2017 to 2019. As I covered previously in depth, Apple implemented strict requirements, such as having a relationship with the customer within the last 24 hours to place a cookie, and companies have continued to find loop holes.

Unlike cookies on the web, where there is a tag on the browser, mobile identifiers have much stronger tracking capabilities. Apple’s IDFA enables the following: user tracking, marketing measurement, attribution, ad targeting, ad monetization, programmatic advertising including DSPs, SSPs and exchanges, device graphs, retargeting of individuals and audiences.

What investors may not realize is these advertising cash machines are largely dependent on tracking software for the high CPMS (cost per thousand views) and CPIs (cost per install) they charge because they can track actions on a granular level even days after a mobile user has seen an advertisement. The mobile users are not aware they are being tracked by many companies they do not have a first-party relationship with (but the developer or publisher does). These developers and publishers must now obtain permission. Without permission, the inventory on mobile becomes less valuable.

Mobile applications, such as Spotify, Uber, Lyft, and mobile gaming, for example, are also dependent on the ability to track and identify cohorts for user acquisition. This is one reason we see the top line grow rapidly in ridesharing at the expense of the bottom line; these companies are crunching customer acquisition costs and lifetime value (LTV) across specific demographics and then using lookalike modeling to target the demographics with the best LTV.

Facebook’s Surveillance-Like Software is Called Audience Network

The betrayal was two-fold. On one hand, a first-party data company boldly entered the third-party data marketplace to broker data, risking the trust of its social media users. Secondly, Facebook did everything in its power to make sure social media users would not find out. Audience Network, which fuels a substantial portion of Facebook’s revenue from the social network, has not been disclosed to the public to this day. It is eerily absent from PR releases and discussions around privacy. Unless a Facebook user was a detective, they would have no reasonable way to know that Facebook operates Audience Network and is selling private data across hundreds of thousands of applications at an estimated 40% of the app market.

Built in 2012, Audience Network went live in 2014, and caused Facebook to stage a remarkable turnaround on the stock market. Facebook has posted consistent returns ever since. This is in marked contrast to the years prior to Audience Network, between 2012 and 2014, when Facebook faltered quarterly, often losing 50% of its stock value due to frequent, disappointing earnings.

Disclaimer: Beth Kindig and I/O Fund does not own stocks mentioned in this article. This is not financial advice. Please consult with your financial advisor in regards to any stocks you buy.

5 Ways Hackers Attack Mobile Devices and Applications

Posted on June 12, 2018June 30, 2026 by io-fund

Hackers go about achieving their goals with reverse engineering software to find vulnerabilities they can exploit, data they can extract, or ways to modify the software to do something it was never intended to do. The primary consequences of applications getting hacked include financial loss, destroyed brand reputation, exposure to liability, and regulatory risk.

Over 7 billion identities have been stolen in data breaches over the last eight years equal to one data breach for every person on the planet.

Why do Hackers Attack Mobile Devices and Applications?

In order to understand threats, we must understand what hackers are trying to achieve. Hackers will mount different kinds of attacks to achieve different kinds of goals. And so, defending against hackers in the context of application security may involve defending against many different kinds of attacks on your mobile device.

Hackers might be interested in bypassing business logic. For example, they might want to bypass controls that let them cheat at a video game or violate the terms of a software license. Of more serious concern is the potential for hackers to bypass controls in safety critical systems. It is not inconceivable that lives could be at risk if a hacker were able to hack a medical device, connected car or some component of critical infrastructure, such as a wind farm, a coal or nuclear power plant, a power grid, or a water treatment facility.

According to a recent study, automobiles today run systems that have more than 100 million lines of code. Those applications often contain valuable intellectual property, which hackers would rather steal than develop. For example, they might be a competitor or a nation state with inferior technology attempting to improve their own products in order to compete more effectively.

Hackers might also be interested in obtaining valuable pieces of data that are managed within the application, such as music or video, financial data, or privacy sensitive health data.

While data can be protected with cryptography, this only shifts the problem from protecting the data directly to protecting the cryptographic keys. Cryptographic keys are not only used to protect data. They can also be used to create a secure identity for a device.

A device may need such a key to authenticate to a cloud service. If a hacker were able to obtain this secret, they might be able to masquerade as that device or as the owner of the device. Cryptographic keys are also used to establish secure communications. For example, HTTPS is a familiar protocol that uses SSL/TLS to secure communication to websites. If a hacker were able to obtain these keys, they could snoop on or alter supposedly secure communications.

For all of these reasons, hackers are highly motivated to steal cryptographic keys embedded in or controlled by an application.

Sometimes hackers aren’t interested in the application itself, but using the application as a digital stepping stone to try to achieve some other goal. Hackers are often interested in obtaining root access on the device the application is running on, so they can install malware or use the device as a launch pad to attack something else.

Consider the 2016 Mirai botnet that infected web enabled cameras and installed a piece of malware that launched the largest distributed denial of service attack in history against the dynamic domain name service Dyn, causing wide spread internet outages. Those 100,000 cameras were able to launch 1.2 terabytes per second of data at a major piece of the global internet infrastructure. Here the goal of the attacker was not to compromise the webcam directly, but rather to bring down the web services of many companies whose DNS was controlled by Dyn.

Hacking Mobile Devices: Reverse Engineering and Tampering

Hackers employ two fundamental techniques when attacking: reverse engineering and tampering. If the hacker is trying to bypass business logic, they have to find where in the application the business logic resides. That requires reverse engineering. Then they typically must tamper with the application to bypass that logic.

If the hacker is trying to steal intellectual property, sensitive data or cryptographic keys from an application, they have to know where to look in the application. Unless those secrets are obvious, hackers need to reverse engineer the application to find them.

If the hacker is trying to create a stepping stone attack, they often use the workflow shown in Figure 1:

First, they find some vulnerability in the application, which again requires reverse engineering;
Then, they craft an exploit that takes advantage of that vulnerability;
Finally, they attack by launching the exploit to the application.

In a remote attack like the popular SQL injection attack, this may involve sending the message to the application over the internet. But if they have physical access to the device, which with mobile and IoT based systems can be as easy as a trip to the store, then they can directly tamper with the device.

How Driverless Cars will put Mobile Security to the Test?

Posted on February 28, 2018June 30, 2026 by io-fund

As GM CEO Mary Barra said in a keynote speech, “A cyber incident is a problem for every automaker in the world. It is a matter of public safety.” As Tesla, GM and many others continue to release connected vehicles – and soon driverless vehicles, the dangers are set to increase. In fact, more than half of the vehicles sold today are connected and vulnerable.

By 2025, the driverless market will be worth $42 billion up from nearly nothing with an official market entry still being anticipated [1]. Self-driving cars have the potential to save 292,000 lives annually from preventing collisions. This is in addition to the added benefits of reducing traffic and climate change, along with the costs of car ownership.

While gaining access to, and being able to control or steal a vehicle such as a Tesla is disturbing enough, it raises several concerns about not only connected cars, but also the mobile applications that extend the features of these vehicles. In fact, mobile apps are quickly becoming the main target for malicious behavior. Over the last four years, there has been a 188 percent increase in the number of Android vulnerabilities and a 262 percent increase in the number of iOS vulnerabilities. In addition, according to Gartner, 75 percent of mobile apps would fail basic security tests.

In another report, more than 80 percent of mobile apps on both the Android and iOS platforms revealed cryptographic implementation issues. Recently, Android malware has become more stealth and has begun to obfuscate code to bypass signature-based security software. Despite Google’s response to critical vulnerabilities and patches of critical issues in the Android OS, end users are still dependent on device manufacturers for these updates.

Driverless Car Security Infographic:

The main source of security and data breaches are found in hacking, malware and social engineering [2].

There are four major attack clusters in the automotive sector:

Direct physical attack: Cars can be breached through the OBDII port and/or while in for maintenance or lent to other drivers.
Indirect physical attack: A carrier is used to compromise the vehicle such as a USB stick, SD card, or through a software patch.
Wireless attacks: Bluetooth and mobile networks including the current development of iOS and Android apps open up the vehicle to an abundant variety of attacks.
Sensor fooling: As of yet, there are no known hacks documented that indicate you can take over a car by fooling the sensors alone.

Consumers are becoming more aware of the dangers around connectivity with 62% saying they are concerned that connected cars will become easily hacked in the future and 48% saying data privacy and security are extremely important. Executives of car manufacturers are also aware of the heightened concern with 52% rating data security and privacy as being of upmost importance to their customers [3].

While the path towards better cyber security for connected cars is a multi-actor road map, auto manufacturers who take the lead will be improving the security of their own brand and product will also improve the safety of their customer.

Are FinTech Solutions Safe on Mobile?

Posted on February 23, 2018June 30, 2026 by io-fund

We live in a digital world where almost everything we touch is being stored on servers, the cloud or in mobile applications. Technologists push for the adoption of digital services and applications while consumers push back for safety and fraud protection. Fintech solutions on mobile are in a predicament; on one-hand these solutions offer the premium convenience of making deposits and transfers on-the-go, and the on the other hand, it digitizes and potentially sells off a person’s most valuable possession: their wallet.

Banks and financial institutions have quite a bit to gain – especially on a global level. Although still in its early stages, the cumulative investment for FinTech in 2017 is forecast to be $150 billion.

FinTech Solutions on Mobile – Hacks Worth up to $25 Billion

“White hat” hackers (the good guys), such as security researcher Sathya Prakash, have been known to expose hacks worth up to $25 billion by taking money out of one of India’s largest banks with just a few lines of code. “I could’ve done this with anybody’s account,” Prakash told reporters at Motherboard – all he needed was an account number. While this hack had a happy ending, with a quick patch and no money lost, not all hacks do. According to Lookout, a mobile security and antivirus firm, as many as 3 percent of Android users have encountered a mobile threat in the past year [1]. This may seem like a small number, but when you consider well-known financial institutions have over 50,000 employees (and some that have over 150,000 employees like Chase or Wells Fargo), the math comes out to 1,500 to 4,500 employees who are potentially introducing risks through their mobile device operating system.

FinTech Solutions on Mobile – Reach Millennials through Mobile Banking

Millennials are digital natives and have become mobile FinTech power users with 87% of those aged 18-35 using mobile services. 71% of them expect mobile banking to transform their future. In fact, Millennials are using mobile banking 8.5 times per month compared to 3.1 times per month for the average mobile banking user. Across all age groups, 60% state mobile banking is the #1 reason for switching banks.

You can access more statistics in the Infographic below.

FinTech Solutions on Mobile – Public Perception of Mobile Banking Security is Low

For those who do not use mobile banking, 57% state it’s because they believe mobile banking is not safe, and 61% cite security as the #1 reason for not using mobile banking. In fact, only 2% of mobile banking users believe it to be “very safe” while more than 50% believe it to be somewhat unsafe or very unsafe [2]. Global financial institutions are doing their best to protect themselves by introducing features such as biometric authentication, 2 Factor Authentication, end-to-end encryption, and AI fraud scanning. Convincing customers to use and embrace these technologies is essential as research shows that users will quickly leave a bank they do not trust.

In addition to building all these technical solutions to solve real security problems, the very real issue of convincing the public to trust a particular financial institution with their assets is a moving target and perhaps a more difficult challenge.

To those who figure this out, leadership of the future financial markets await.

Sources:

[1] https://www.nbcnews.com/storyline/hacking-in-america/new-way-you-ll-get-hacked-through-banking-app-your-n651571
[2] https://www.federalreserve.gov

Should We Build a Backdoor into Mobile Devices?

Posted on February 22, 2018June 30, 2026 by io-fund

Two years ago the San Bernardino shooting stirred a debate within the security community regarding warrant-proof encryption. The debate, known as “mobile backdoor access,” refers to exceptional access to encrypted communications and data by law officials. In theory, the Department of Justice wants technologists to “hide a key under the door mat” for law officials to access when they have the proper warrants. However, many security professionals and technologists have resisted this request due to creating weaknesses that are irreversible and require falsified automatic updates which may introduce other vulnerabilities.

Perhaps the biggest conflict for technologists, as pointed out by Herbert Lin, the Senior Research Scholar of Cyber Policy and Security at Stanford, is that anything less than deploying the best security (that is technologically possible) could constitute a neglect of professional obligation and ethics. Last November at the Intertrust LINE event, I had the opportunity to interview Lin, who is on the front lines of this debate. The conflict, as he pointed out in his keynote, exists in whether you can technologically design a system allowing exceptional access that is also secure. The security community says this is not possible while law enforcement says it is possible. Lin argues the parties are not talking about the same thing, as to talk about the same thing will require less-than-maximal security for users and less-than-desired capability for law enforcement (the proverbial grey area). In other words, maximal security is a technology issue, and adequate security is a policy issue — and it’s impossible to use a technical argument to solve policy.

Watch this 2 minute clip by Herbert Lin briefly covering the topic of mobile backdoor access: “Should We Build a Backdoor Into Mobile Devices?”Should We Build a Backdoor Into Mobile Devices?”

In his keynote, Lin poses questions that all sides must eventually answer during this debate and inevitable compromise, including tech vendors and the privacy community.

Questions we must answer for mobile backdoor access:

Questions for Law Enforcement:

· Why is law enforcement unwilling to acknowledge they’re asking the public to accept a lower level of cybersecurity?

· Why has a technical proof of concept not been provided? You think it can exist. Then prove it.

· How often and for what purposes are exceptional access capabilities expected to be used? If it begins for terrorism, when will it end?

Questions for Tech Vendors:

· Why do vendors provide password features if they’re against backdoors? This proves there situations where technologists have decided the benefits outweigh the consequences.

· How would exceptional access stifle innovation? Why should information technology not be subject to regulation? Lin points out technology is often subject to regulatory measures such as seat belts in cars.

Questions for the Privacy Community:

· What is the actual harm of having a back door? There are many people who are worried about being harmed that would not actually be harmed.

· How often are improper exceptional accesses expected to occur? The privacy community has the understanding there are to be zero improper uses, while one in 1 million or one in 10 million is more reasonable.

Click here to view the full keynote by Herbert Lin, entitled “Unresolved Issues Regarding Exceptional Access to Encrypted Data and Communications.”

Thanks for reading.

p.s. Don’t forget to follow me if you enjoyed this article! On Twitter @Beth_Kindig and on Medium