Slashdot Mirror
Millions Of Waze Users Can Have Their Movements Tracked By Hackers (fusion.net)
An anonymous reader quotes a report from Fusion: Researchers at the University of California-Santa Barbara recently discovered a Waze vulnerability that allowed them to create thousands of "ghost drivers" that can monitor the drivers around them -- an exploit that could be used to track Waze users in real-time. Here's how the exploit works. Waze's servers communicate with phones using an SSL encrypted connection, a security precaution meant to ensure that Waze's computers are really talking to a Waze app on someone's smartphone. Zhao and his graduate students discovered they could intercept that communication by getting the phone to accept their own computer as a go-between in the connection. Once in between the phone and the Waze servers, they could reverse-engineer the Waze protocol, learning the language that the Waze app uses to talk to Waze's back-end app servers. With that knowledge in hand, the team was able to write a program that issued commands directly to Waze servers, allowing the researchers to populate the Waze system with thousands of "ghost cars" -- cars that could cause a fake traffic jam or, because Waze is a social app where drivers broadcast their locations, monitor all the drivers around them. You can read the full paper detailing the researchers' findings here. Is there a solution to not being tracked? Yes. If you're a Waze user, you can set the app to invisible mode. However, Waze turns off invisible mode every time you restart the app so beware.
"You can switch to invisible mode at any time, which means for that specific drive: (1) you will appear as offline to your friends; (2) your Waze icon will show on the map; (3) you will not be able to send reports, add/edit places, or send messages to friends and other Wazers." #2 doesn't make any sense to me. Do I need Ron Weasley to snag me the invisibility cloak?
This wouldn't be a problem if the app wasn't designed to track your whereabouts and broadcast them. I'm not sure I have much sympathy for anyone using the app who is surprised by this, since tracking you and sending your info to others is the app's stated purpose.
Okay, someone at their IRB failed to run this by their legal department.
Because you really should not be committing a felony during your research. https://www.law.cornell.edu/uscode/text/18/1030
You're only supposed to blow the bloody doors off!
What's the issue. They reverse engineered a protocol, then emulated thousands of users. I saw nothing in the law that prevents emulating a user. They essentially accessed Waze using an API. It's just that the publicly accessible API wasn't expected to be used. And like most data, 1000x innocent data becomes something creepy. Like walking on the sidewalk isn't creepy, but walking past the same house 1000 times is.
Exceeding authorized access to a machine used in interstate commerce.
There are lots of stories about how the government is supposedly taking away our freedoms and a police state is coming. That police state hasn't happened.
Last year in America, the police stole^Wconfiscated more money and belongings from citizens through civil forfeiture than burglars stole. America has secret courts issuing secret warrants and serving secret orders that no one is allowed to talk about. Police are driving around using secret equipment to intercept cellphone calls and text messages, demonstrably without warrants. Cops in Chicago arrest and "disappear" citizens into a black hole of a dungeon facility called Homan Square, without even their lawyers being told where they are.
If you don't see the police state, you simply aren't fucking looking.
They run lots of stories about how Microsoft is tracking people and doing bad things with data collected through telemetry. That hasn't happened.
How do you know? None of us have any idea what Microsoft is doing with that data.
"BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
Why don't apps encrypt communications before sending?
Easy answer: use an offline satnav app.
How hard can it be? Everybody and their dogs know Waze is a user profiler / tracker disguised as a useful app - like all Google products.
In fact. If you're worried about being tracked, don't use Google products. People should be more worried about what Google learns about them through Waze than what any potential hackers of that system could.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Millions of Waze users can have their movements tracked by other Waze users #noissuethere
(The protocol reverse engineer and the ability to spoof extra cars are news worthy, I'd guess - but the headline is completely pointless)
-><- no
The police state doesn't need this exploit.
They just have to go to Google with the appropriate paperwork/goons and say, here are a few portable drives, give us all you have on people on this list from this date to this date.
When the sheep stay well within their holding areas (Taylor Swift, Kardashians, Conspiracy Nut Job sites, Facebook) and don't make a big fuss about the few that do disappear, there's really no need for the wolves to do anything.
Nothing really new here. Many things are possible if you can insert yourself in the data stream. But without breaking into data centers how are you going to do this?
nice try government shill
captcha: parasite
Client app should sign messages with private key. But then the app should be securely stored on the phone, which is not the case with Android. So it is like an alternative YouTube client, the only way to stop it, is to change the protocol from time to time.
Millions Of Waze Users Can Haz Their Movements Tracked By Hackers
systemd is Roko's Basilisk.
You're citing (a)(3). Look at (a)(2)(C), which does not require intent to defraud. Protected computers include computers used in or affecting interstate commerce, which means basically any computer.
Oh no...someone could track WazeUser83840 using an application that is meant to track their location. I found another hack: you can use Find my iPhone to find someones iPhone. The horror!
Are the ones using this app, and not caring that they're tracked by Waze or by the bad guys.
At least I'll be dead in 40 years, the rest of you and your kids can all suck it.
I wanted to download and use Waze just because the police were complaining about it. Then I started reading the user agreement and decided not to. Waze demands access to basically everything on your phone. OK, I see that it needs location data, but why the hell does it demand access to the microphone, camera, text messages, contact list and other stored data? Why does it need to link to your social network accounts and collect data that you share through FB?
If you grant an app, or worse, numerous apps, permission to access anything and everything on your phone, you're just asking to be hacked.
Would you grant every random piece of 3rd party software on your computer access to all of your data and devices? Hell no.
Spoiler: I go to work. Later, I go home.
Lose lips sink ships. Hacking boast, dollars lost.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I thought the whole point of Waze was that you could see where other drivers (including perhaps certain people you want to track) are. It puts an icon representing you on the road (with your choice of avatar) for others to see. It doesn't exactly take mad haxxor skillz to track someone with Waze, it just takes an account.
If you only want a single big company to track you, that's what Google Maps is for.
That police state hasn't happened.
Aside from Waze streaming all of its users' position updates to the NSA via its Israel office, right?
Nobody reads the Terms of Service anymore.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
So, Waze need to have the app properly implement SSL Certificate Pinning (in order to prevent a MITM SSL proxy that works via an additional Certificate Authority). Of course then it's likely still vulnerable to some reverse engineering of the app to get around that.
Waze does not place user icons on the map as live updates. They are time delayed so that WazeUser1 cannot pinpoint the location of WazeUser2 at any given moment.
The hack may be able to see through that obfuscation, but the unadulterated Waze does implement that delay to ensure some degree of privacy.
If you don't see the police state, you simply aren't fucking paranoid enough.
I'll save them the trouble.. Monday through Friday I drive to work in the morning then back home in the evening and on Satuday and\or Sunday I go to the grocery store with an occasional stop at a hardware store. BFD.
In China only luddites use apps.