# Waze: How I Tracked Your Mother

Waze livemap API leaked stable user IDs and usernames of drivers who acknowledged road reports, enabling tracking and deanonymization of users.

- Payout: $1,337
- Severity: medium
- Program: Google
- Credited: Peter Gasper
- Disclosed: 2020-08-25
- Write-up quality: 7/10
- Original: https://www.malgregator.com/post/waze-how-i-tracked-your-mother/
- Library page: https://bugbountylibrary.com/r/blog%3Amalgregator-com-post-waze-how-i-tracked-your-mother
- Tags: domain:api domain:web impact:pii-leak kind:bounty platform:blog sev:medium tech:rest technique:js-analysis technique:recon vuln:info-disclosure

**Target:** Waze livemap API (waze.com/livemap)
**Root cause:** The livemap API returns persistent user IDs for nearby driver icons and returns username+ID of any user who acknowledged an obstacle report, even though the UI hides this data.
**Steps:**
1. Query the Waze livemap API with lat/long coordinates and observe driver icons carry stable IDs over time.
2. Build a Chromium devtools extension to capture JSON responses and log ID->location over time.
3. Identify a target's ID by correlating their known location in a low-density area.
4. Pick high-traffic locations with active obstacle/police reports and poll the API.
5. Parse responses to harvest username+ID pairs of users who acknowledged reports.
6. Correlate harvested IDs with tracked icon locations to deanonymize and track users.
**How found:** Noticed driver icons on livemap had IDs that didn't change over time; built a devtools extension to capture API JSON and confirmed a tracked driver moved; then searched the API for an oracle mapping ID to username and found acknowledgements leak both.
**Exploitation:** Attacker polls the livemap API around busy locations with active reports, harvesting username/ID pairs from acknowledgements, then correlates those IDs with continuously crawled icon coordinates to track and identify specific drivers.
**Escalation:** Building a dictionary of usernames to IDs over time enables tracking many users and correlating mobility across districts and cities.
**Insight:** Mobile/web map APIs often return richer fields (usernames, stable IDs, timestamps) than the UI renders; diff raw API responses against displayed UI to find hidden identity leaks, and check whether IDs are stable across sessions.