Floating Car Data from Smartphones: What Google and Waze Know About You and How Hackers Can Control Traffic

In recent years, a trend of using real-time traffic data for navigation has developed. Google Navigation and Waze, for instance, generate traffic data from movement profiles of smartphones. In this paper we tackle the question to which extent it is possible for Google and Waze to track the smartphone and its owner. Furthermore, we show how wireless access points and smartphones acting like wireless access points can be located around the world. In addition to the privacy issue, we examine whether the authenticity of traffic data can be guaranteed. We demonstrate in practice how hackers can take control of navigation systems and, in the case of a wide distribution of floating car data, can actively control the traffic flow. At the end we present a practical protocol preventing such attacks and at the same time preserving the user’s privacy. The protocol has been implemented on different hardware platforms and benchmark results are given.