Imagine your quiet little street suddenly gets turned into a three-ring circus: clogged with traffic jams, honking cars, their drivers swerving around curbside basketball hoops and dogwalkers, their gazes wandering to their mobile phones and the app that rerouted them to get around months-long construction work.
Who can blame residents for trying to throw a monkey wrench into this mobile app-generated mess, which has been brought to them courtesy of Waze?
If you’re not familiar with Waze, it’s a Google-owned app that relies on crowdsourcing as people report accidents, traffic jams, and speed and police traps, while its online map editor gives drivers updates on roads, landmarks, house numbers, and the cheapest nearby fuel.
According to The Washgington Post, residents on a formerly quiet residential street in Takoma Park, Maryland, have been fighting back after traffic increased by several hundred cars per hour, all thanks to this get-there-fast app rerouting motorists to avoid road construction blocks away.
One of the residents, Timothy Connor, told the newspaper that it had become a nightmare:
I could see them looking down at their phones. We had traffic jams, people were honking. It was pretty harrowing.
So he decided to put up his own, virtual roadblock: namely, reporting bogus traffic data to try to trick the app into sending motorists away.
Rumor also had it that Miami police have tried to pollute Waze’s data stream to foil the app’s tracking of police, speed trap and driving under intoxication (DUI) checkpoint locations.
Connor followed others’ examples: he got on the app during every day’s rush hour, posting fake reports about a wreck, a speed trap, or some other traffic snarl on his street, hoping to deflect the traffic.
Of course, when you’re talking about crowd-verified data, lone imposters will eventually get sniffed out. He lasted two weeks before Waze kicked him out for his unreliable feeds.
Aggravated residents should, at least in theory, gain more credibility if they conduct a concerted campaign to fool the app with multiple, similar reports with faked data.
That, actually, is what Israeli students did: as a school project, they created a virtual traffic jam to show how malicious hackers might create a real one.
First, they wrote a program that impersonated mobile phones to create and register thousands of fake Waze users.
Then, the fake accounts used an app that gave false GPS coordinates. They programmed the army of false users to submit reports claiming to be stuck in traffic at the bogus coordinates.
It worked, at least in the short term: The students managed to simulate a traffic jam that lasted for hours, causing motorists on Waze to deviate from their planned routes.
Then, they reported their findings to Waze, given that they weren’t really out to cause traffic jams; they were actually trying to help keep the app from being manipulated into sending drivers into dangerous situations.
But these shenanigans won’t work for long. Waze officials told the Washington Post that the system can detect whether you’re actually in motion.
And, as all crowd-sourcing goes, so too goes Waze: it constantly self-corrects as other drivers provide accurate data.
Julie Mossler, Waze’s head of communications:
The nature of crowdsourcing is that if you put in a fake accident, the next 10 people are going to report that it’s not there.
Users who tamper with the map will be suspended, she said.
And to be sure, the app has its upsides and its fans: some governments have begun working directly with Waze, the Washington Post reports, to glean information about potholes, backups and other real-time data.
Connor and his neighbors turned to putting up signs: “No through traffic,” read one. Another displayed “watch-for-children” figures.
One sign was hit by a car.
The other was stolen.Follow @NakedSecurity