Thread by @intidc

🔥PRIVACY SCOOP: How ANYONE can track your car using only your license plate: a thread! 🧵👇
#osint #privacy (1/X)

Between June and Sept '22, I challenged 120 car owners to track their location using their license plate. Over 100 days, I was able to track down 29% using three different methods. The issues discovered are widespread and there’s no easy fix - so I made one! (2/X)

Method #1: registering the target's license plate in parking apps and enabling license plate recognition (ANPR). I could add as many plates as I wanted. Doesn't matter if they already used parking apps: I could claim their plate as if it were my own.(3/X) support.4411.io/hc/en-be/artic…

Method #1 (cont): the moment my targets entered one of the 100's ANPR-enabled parking lots in their area, I would get an instant notification of their location: hospitals, concert venues, office buildings, libraries, shopping malls, public transit stations and even the zoo. (4/X)

Method #1 (cont) Most sessions would cost the attacker a few €.But with an average cost of €8.56 per hit it's incredibly cheap. Since their targets are stationed for a while, attackers can go to the vehicle and await them. Victims of abuse, crime and war are most at risk.(5/X)

Method #2 is 100% free and works for free on-street parking (e.g. 30 mins, kiss & ride...). Once a target uses their slot, anyone else entering their plate will be refused a free slot that day. Attackers can use this error find out whether their victim parked there that day.(6/X)

Method #2 (cont) I developed a stalkerware tool 'platescan' that automates this and creates a free session for the target's license plates in all zones every night. If it detects the error, it sends a notification to the attacker with their location (7/X)

Method #3 is also free and requires no technical knowledge: some vendors allow you to request an overview of parking sessions & receipts by supplying the target's license plate and phone number. That's all you need. Automate this & get real-time updates on incoming sessions.(8/X)

The privacy disaster is widespread throughout Europe: I was able to track down targets near the Spanish border, 1.100km away from their home. We detected 1000's of affected locations already and more are being installed as we speak. Is anonymous parking a thing of the past? (9/X)

Not only parking is affected: ANPR-enabled toll roads are becoming the norm. The toll you pay: your privacy. Or are you willing to take a 100km detour? (10/X)

There is no opt-out to having your car tracked. So we created one. Today we're releasing notmyplate.com: a website built with the help of privacy lawyers allowing drivers to invoke their GDPR right to restrict data processing to all vendors at once. It's 100% free.(11/X)

We need to stop the unsafe rollout of these systems before it's too late. Inform your friends & call your legislators to spread awareness & drive change.
📝 Whitepaper: notmyplate.com/whitepaper
📰 Press: notmyplate.com/press
🐦 Twitter: @intidc (NL) and @securinti (EN)
(12/X)