As an important channel for mobile marketing,mobile advertising has become more and more popular among app developers.However,in pursuit of targeted ads delivery and other illegal tactics,mobile ads may introduce serious threat to users' privacy and property.Recently,many researches have paid attention on the threat of advertisement platforms,advertisement providers,and mobile apps,though few studies put focus on the security of advertisement network.In this paper,based on the automatic analysis of host app's permissions,a man-in-the-middle (MITM) attack scheme is proposed to inject malicious code into the ads' traffic.Through analyzing network traffic,this method can identify the name of host app and extract the permissions from the official app market.Moreover,it also extracts the device information such as system version and sensors,which is helpful to excavate the loophole of corresponding WebView.To generate the attack code automatically,a capability description language (CDL),which can describe the attacker's ability in a standardized format,is also developed.The distribution of loopholes among different Android versions are studied.Experimental results show that the proposed attack scheme can affect many apps,and the attack cases also illustrate the feasibility of this work.In the end,several protection methods and security enhance schemes,including host app name confusion,ads content integrity check,and the remission technologies of MITM attacks,are put forward.