Tech-savvy motorists beware: The latest hacking scheme could send commuters straight into the middle of a traffic jam.
Tobias Jeske, a doctoral student at the Hamburg University of Technology in Germany, recently demonstrated how hackers could influence real-time traffic-flow-analysis systems on popular mobile smartphone apps such as Google Maps and its smaller rival Waze.
Such systems are vulnerable because of their reliance on real-time information, collected via both Wi-Fi and GPS, that lets the navigation systems track user location.
In Google's navigation system, this location information is guarded by a Transport Layer Security (TLS) tunnel, but as PCWorld reports, the TLS is useless if a hacker controls the beginning of the tunnel.
Using an Android 4.0.4 smartphone, Jeske demonstrated that if a hacker took over the phone — as common Android malware does — he could control the beginning of the TLS tunnel and then send false traffic data to Google.
[ How Your Cellphone Lets the Government Track You ]
For example, Jeske was able to collect data packets from particular driving routes and then replay them later with modified cookies, platform keys and time stamps.
He said a more intense attack on the app could fool Google into thinking that several cars were following this falsified route.
To accomplish this, a hacker need only send multiple data packets with different cookies and platform keys to Google.
In his research paper, Jeske pointed out that a hacker didn't even have to drive a particular route to manipulate data. Google accepts data from phones without cross-checking the phone's location against known Wi-Fi access points.
In other words, a hacker could hypothetically affect traffic data anywhere in the world from a single location.
The Israel-based crowd-sourced navigation app Waze is also vulnerable to similar attacks on traffic data, Jeske found.
However, it's not as easy for a hacker to simulate multiple cars along a given route using Waze because the company associates location data with specific user accounts.
If a hacker wanted to fool Waze, he or she would need to create new accounts with new email addresses.
In order for this hacking scheme to really have an effect on traffic data, Jeske said that a substantial amount of Waze or Google users would have to be in the same area.
While the hack might not be successful in a small suburb, it could affect traffic data for users in metropolitan areas.
Though Jeske tested only Waze and Google apps for Android, he said that other map and navigation apps using similar methods of data collection might also be vulnerable.
Other navigation apps should take heed and link their location information to one-time, time-stamped authentication, Jeske said.
