Students hack Waze GPS app, create fake traffic jams

Waze, the crowdsourced navigation service owned by Google, was attacked by two Israeli software engineering students from the Israel Institute of Technology.

Fortunately, it was not a malicious attack, but instead part of a university project.

Shir Yadid and Meital Ben-Sinai created a program in order to hack the GPS and create a fake traffic jam that lasted hours. In order to cause as little inconvenience to those really using the app, they created the jam on a back road behind their campus.

In order to successfully execute the hack, the duo had to create a number of fake Waze accounts and get them to mimic false GPS information.

According to Wired.Co.UK, the pair divided the research into three parts. They created a system that creates multiple fake Android devices by using a computer program called “Android Emulator.” Then they built a control system using code that mimicked human activity on all of the made-up devices. Finally, they used their newly created system to log in to the Waze app from each fake human’s device and as a result created what they called an “army” of fake Waze users, or “Wazer bots.”

Then they created their own Android app called “TrafficJam,” which generated fake GPS coordinates that they gave to the Waze app to make it think that the Waze bots were actually people. They set up their TrafficJam app to make it seem like the Wazer bots were slowing down at a particular spot (hence creating an actual traffic jam in the eyes of the app).

The last part of the project was done experimentally. The team needed to figure out which traffic patterns were considered to be congested by the Waze app. Once successful, the duo saw that Waze reported the road they had singled out to be congested and then offered an alternative route for users.

Afterwards, the university faculty had to call Waze and make the company aware of the successful hack.

Once news of the hack was released, some users were fearful, but the Israel Institute of Technology assured the public that it gave Waze a 40-day notice prior to releasing the findings of the hack and that the hack was conducted solely on campus grounds. The main point of the project was to figure out how to defend against attacks of this nature.

According to Wired.Co.UK, Waze is looking into the issue.

Story via Wired.Co.UK