An embarrassing blunder has been discovered with Westfield’s ‘Find My Car’ feature announced in July, that allowed anyone to access images taken using its ParkAssist technology using a public API.

The issue, discovered by software architect and Microsoft MVP Troy Hunt, revolves around the application programming interface (API) that Westfield was using to power the license plate search for its Bondi complex, provided by ParkAssist.

The API gave Westfield the ability to provide a new feature in its iPhone application – downloaded more than 83,000 times — that allowed visitors to its Bondi complex find their car in the car park by simply typing in their license plate.

However as Hunt discovered using tools such as Fiddler, the API for the service wasn’t protected at all, potentially allowing anyone access to information provided by the service outside of the iPhone app.

“What this means is that anyone with some rudimentary programming knowledge can track the comings and goings of every single vehicle in one of the country’s busiest shopping centres,” Hunt wrote in a lengthy post detailing the vulnerability.

“Whilst I’m by no means a strong privacy advocate, something about this just doesn’t sit quite right with me.”

Images of the cars weren’t the only information available through the API — according to Hunt, it was also possible to gain access to the license plate in text and the time of arrival of a car in a parking space, or even the entire carpark.

Westfield said in a statement this afternoon that it had only been made aware of the authentication issue by provider ParkAssist this morning, and that it was working on a solution with the company, in the meantime disabling the car finding functionality.

“This issue has been addressed immediately by Park Assist and the Find My Car functionality will be not be available for approximately one week until the app has been modified to ensure that data cannot be publicly assessable online,” a spokesperson for the company said.

On the more broader topic of privacy concerns raised by the car finding functionality, Westfield says it doesn’t believe the app contravenes Australian privacy laws, with license plates not considered “personal information” under the act.

“The application theoretically could be used for purposes other than its original intention, however it does not facilitate any activity that couldn’t already happen otherwise,” the spokesperson said, before mentioning in extreme cases police may request access to the application to “assist in their enquiries”.

Westfield said it plans to introduce the Find My Car tool into “future” complexes in Australia, with visitors to existing Australian complexes able to mark their parking spots manually.

Image Credit: Westfield

Related posts:

1. Google grilled in privacy enquiry
2. Privacy Commissioner still won’t talk OzLog
3. Google didn’t collect bank data: Privacy Commissioner
4. CBA’s Kaching app raises privacy concerns
5. VHA breached Privacy Act, says Commissioner

Tweet

1. grum
   Posted 14/09/2011 at 7:46 am | Permalink | Reply

   I wish this wasn’t announced. How am I supposed to stalk my ex now??

   • PeterA
     Posted 15/09/2011 at 1:45 am | Permalink | Reply

     You still can, you just have to use the iPhone app to do it now, instead of your custom built API accessing program.

     • Josh
       Posted 15/09/2011 at 5:57 am | Permalink | Reply

       So much less convenient and so much less of a privacy issue using an iPhone app.

2. Terry Green
   Posted 14/09/2011 at 7:55 am | Permalink | Reply

   There is of course a simple solution to this problem, remember where you parked, seriously it’s not that difficult.

   • Dean Harding
     Posted 15/09/2011 at 5:48 am | Permalink | Reply

     Unfortunately not, since it’s tracking your license plate whether you want it to or not… Of course, you could just not shop at Bondi Westfield (or come by public transport).

     • Terry Green
       Posted 15/09/2011 at 7:25 am | Permalink | Reply

       Well I’m on the Central Coast so won’t be shopping at Bondi anytime soon, and the only time we have any real trouble with parking is during tourist season

3. Toby Allen
   Posted 15/09/2011 at 1:01 am | Permalink | Reply

   I think its a great idea. Although I do agree its not that hard to remember where you parked. That being said it was only a matter of time for something like this to happen.

   Also, grum, you can still stalk your ex, just enter her number plate and see if she is in the shopping center and then wait by the car.

4. Anonymous
   Posted 15/09/2011 at 1:09 am | Permalink | Reply

   I don’t think Australian car parks are big enough to forget where you parked.

   • Clinton O'Hara
     Posted 15/09/2011 at 4:27 am | Permalink | Reply

     after just having returned from malaysia and parking in places such as the KLCC and Gurney plaza and queensbay mall, i would have to agree with you 100%.

     place like that have multi level parking that can only be access from certain escalators or lifts and even then they have things like half levels. it can be a real task to locate your car.

     australian parking lots are a piece of piss.

     • Anonymous
       Posted 15/09/2011 at 11:58 pm | Permalink | Reply

       haha yeah the multi story carparks in Malayasia are evil