Tracking Users on Waze

2020-10-29 14:52

What I found is that I can ask Waze API for data on a location by sending my latitude and longitude coordinates.

Except the essential traffic information, Waze also sends me coordinates of other drivers who are nearby.

What caught my eyes was that identification numbers associated with the icons were not changing over time.

I decided to track one driver and after some time she really appeared in a different place on the same road. The vulnerability has been fixed.

More interesting is that the researcher was able to de-anonymize some of the Waze users, proving yet again that anonymity is hard when we're all so different.

News URL

https://www.schneier.com/blog/archives/2020/10/tracking-users-on-waze.html

#tracking