The Westfield’s iPhone app privacy smorgasbord

http://www.troyhunt.com/2011/09/find-my-car-find-your-car-find.html

by pavel_lishin • 15 years ago

90 36 15 years ago

shoota2• 15 years ago

This is just sad. I'm sure someone was using the extra information for debugging purposes at one point and never thought to remove it from the json interface.

angusgr4• 15 years ago

I expect a Westfield developer thought they were being very clever. "Oh look, ParkAssist already has a full API! I'll just put it on a public API and I don't have to do any backend development at all."

frankPants2• 15 years ago

bingo! I'll be my life that's exactly what's happened.

objclxt2• 15 years ago

So the underlying server is getting hammered with traffic right now, but this really illustrates why you should always be encrypting this kind of thing.

Because not only did the developers of the app expose public data, they also managed to post their own source code online by using Pastie (check it out here: http://pastie.org/pastes/1789181), and exposed their entire web service documentation here: http://120.151.59.193/v2/help (although it will probably be down by now).

veyron• 15 years ago

How did you find this?

objclxt2• 15 years ago

I googled for the "v2/bays.json" string, thinking I might find a few more carparks using the system, but instead found that! So not exactly rocket science.

angusgr4• 15 years ago

I hope there's authentication on the signs.json PUT update API, or Westfield's signs are probably about to go crazy...

ghuntley2• 15 years ago

I have notified ParkAssist (Australia); appropriate contact details were found via the API:

    http://120.151.59.193/v2/email-alerts

0x12• 15 years ago

Still up, 1 hour and counting...

Someone is going to get fired over this.

ajtaylor• 15 years ago

I was looking over the pastie code (reading is learning :) and noticed they are using Raphael.js for drawing a tooltip polygon. Perhaps I'll add "play with Raphael" to my TODO list. Anyone else using this toolkit for production drawing?

lawnchair_larry• 15 years ago

That is amazing. How are people this short-sighted and reckless with people's data? It's so frustrating.

I just told my family that no vehicles are to be parked at a Westfield parking garage until further notice. I'm used to them rolling their eyes at me over data security issues, but I gave them the link to this one and their jaws dropped.

fungi• 15 years ago

> told my family that no vehicles are to be parked at a Westfield

wow, you and i are very different people.

hugh32• 15 years ago

While I share your concern that this is poor protection of privacy, are you really sufficiently concerned that someone is desperately interested in the location of your car to bother to put yourself to any inconvenience?

pavel_lishin2• 15 years ago

I think it's a case of voting with his wallet.

Then again, I don't know anything about him. For all I know his wife has a crazy, vengeful ex, and his daughter has a stalker.

njharman• 15 years ago

Mountain <-> molehill.

Really.

throwaway32• 15 years ago

to paraphrase a certain Google executive "if you don't want somebody to know where you parked, maybe you shouldn't be parking your car"

jnorthrop• 15 years ago

It's more than than just a single snapshot in time though. They are keeping a record of every car's coming and going every day. It wouldn't be difficult to poll a service like that to gather the information yourself for weeks or months worth of data.

Certainly you could drive around a parking lot everyday and get that information but that isn't very likely. It's that aspect of the service that is most troubling.

jbermudes• 15 years ago

So there's a camera at every spot? Seems like overkill when a simple sensor (IR/magnetic) would have gotten pretty much the same information. Instead of letting a camera guess your tag, just number each spot and send the number of the spot to the phone once you park.

nl• 15 years ago

So then you actively need to do something on your phone when you park?

Additionally, this tech is better for the car park owners because they can (are?) using the same technology to check for cars parked too long in a spot. For that you need the number plate.

martingordon2• 15 years ago

I always laugh at people who back into spots in large parking lots (although in close-quarters it sometimes makes sense to), but now I realize that it could be a security measure (particularly in states without front plates), with or without this park assist.

hugh32• 15 years ago

This is only in Australia, where all cars have (iirc) front and back plates.

jesseendahl• 15 years ago

California also requires all cars have both front and back plates.

illant2• 15 years ago

Further Down the Rabbit Hole: http://westfi48.lnk.telstra.net

It only gets worse.

shoota2• 15 years ago

Well this is certainly interesting.

mcbarry• 15 years ago

What was it? The server isn't serving the Silverlight app any more.

illant2• 15 years ago

Web Dashboard and Config info of the Parking Structure / Devices.

evan_• 15 years ago

Privacy implications aside, this is actually a pretty cool concept for an iPhone app.

mattgreenrocks• 15 years ago

How can Westfield secure this? Whichever method they choose, they have to ship the key with the app, won't they? And then someone can just reverse engineer it out, and we're back at the same place.

Or is there a nice way to do this?

angusgr4• 15 years ago

Well, to start with they could lock the API down correctly so you had to supply a number plate to get 2-3 likely matches. And fuzz the photos they send a bit more so it is legible enough to identify your car, but not to read the license plate itself. And remove superfluous data from the IP results, like time of entry.

As compared to the current system where you can immediately get a list of every car in the carpark, with its location, entry time, and photos where the license plates are discernable.

And they could institute per-IP throttling of requests (no more than 5 an hour or something) to stop someone brute-forcing number plate combinations to get a "map" of the centre.

Finally they could have locked out the admin interface so that random members of the public couldn't do other things as well. ;)

But you're right in general - even implemented correctly, this feature has an interesting privacy implication - at any given time, anyone with a license plate number and a vague description of the vehicle can check if that car is parked at a Westfield, and where it is parked.

angusgr4• 15 years ago

Some people have talked about "crypto" and I can see lot of ways you could add some level of encryption or auth to make things slightly more obfuscated (perhaps require pre-registration of your car), but I can't see a any way that would change the fundamentals.

The app is essentially designed to let people look up car locations by license plate numbers, and as long as it does that it seems to me there will be some level of privacy issue.

frankPants2• 15 years ago

There's no need for encryption of anything. Send the service a number plate, it returns you an image, tick if that's you're car, and it'll tell you where it is. If it's not it goes to the next one in the list. The issue here, is that the server team haven't tailored the API for the app. They've just dumped everything out to the app via a queryable url string, and let all the logic in there.

/api/v3/plate_search?plate=ABC123 and it can return you the closest match. Search it again from the same phone, get the second mate(track the cookie). It's not that hard, it just takes some thought, and the Westfield, and the vendor have tried to cut corners.

The Westfield’s iPhone app privacy smorgasbord

Related Stories