Sunday, 30 August 2015

UK Parking Controls scammers cast doubts on use of SmartPhone technology

Many car parking operators today use SmartPhone technology, especially for self-ticketing. The solution is appealing - simply download an App to your SmartPhone, then use the camera to record contraventions and date and time stamp them before uploading them to the operator.

UK Parking Control use such a solution called iWarden2. The App can be downloaded to your SmartPhone, and then you are up and running, earning 10% of the revenue you generate.


However, a number of UK Parking Control wardens appear to be abusing the system, by taking photographs with fake timestamps. Presumably this is done by altering the time on the SmartPhone before taking a photograph.

If done deliberately, this would appear to be fraud.The Prankster has received 5 reports so far, making a total of £500 apparently fraudulently demanded. This may be the tip of the iceberg and the true scale of fraud may be much larger.

This of course sheds doubts on all operators who use SmartPhone technology. The Prankster calls on legitimate operators to declare if they have safeguards built into their applications to prevent fraudulent use. There are many ways to detect this type of activity. For instance, the App could monitor the time when it is running, and silently alert the operator if the time ever goes backwards.
The App could also check system settings when it retrieves the time to check that the time zone has not been altered and also that the time is being provided by the network, rather than being manually set.

This Android programming site gives some details on how this could be achieved.

No doubt other devices have similar properties.

Until this is done all tickets issued via SmartPhone are suspect.

Happy Parking

The Parking Prankster


.


10 comments:

  1. a person who has not got the correct business insurance , and without wearing uniform/ID can take a photo (or 2) and run away without writing a ticket.

    this is not what the government had in mind

    ReplyDelete
  2. nobody made a complaint to the police?

    ReplyDelete
  3. "civil matter sir"

    yes on peppipo/MSE a person has reported "fraud" but the police will not get involved

    ReplyDelete
  4. I have found a dash-cam incredibly useful in a recent driving matter. Given what we now know about PPC's I use the dash-cam to record entry and exit from car parks. It also gives the GPS position, pictures of signage etc.
    The cost of a dash-cam is a small price to pay to insure yourself against these scams.

    ReplyDelete
  5. This fraud opportunity is so obvious, and must have been so to the app developers and to the UKPC directors who would have commissioned its development.
    I wouldn't be surprised if this flaw was deliberately included within the app and unofficially communicated to the self ticketers amongst UKPCs clients.

    ReplyDelete
  6. It would be really straight-forward to include alongside each photo the NMEA string coming off the GPS module on the smart-phone. This NMEA data includes (of course) the location where the photo was taken, but also the UTC time at which the fix was made and crucially the number and identity of the satellites that contributed to the time and position fix. I doubt any of the car park monkeys would have the wherewithal to fake the satellite locations convincingly, and they certainly haven't got a spare space shuttle to move them around to their whims. Oh, and add a public/private key pair cryptographic element too based on time and geographic position.

    ReplyDelete
  7. but if they do that ,,,,,,,,, they won't be able to lie and cheat

    ReplyDelete
  8. The PPC scammers will blame this on 'a few rogue self-employed contractors'.....nothing to do with us, honest guv.

    ReplyDelete
  9. a company is responsible for its employees ,

    time the DVLA/gov stepped in and set the rules , would you accept a policeman doing a police interview via a smartphone recorder?

    ReplyDelete