When Curiosity Meets Code: A Security Researcher’s Discovery

Imagine this: You’re waiting for your robotaxi, scrolling through your phone, and suddenly, you stumble upon a hidden feature that lets you rewrite the rules. That’s exactly what happened to Jane Manchun Wong, a security researcher who uncovered a secret in the Waymo app that allowed her to customize the display of a self-driving Jaguar I-Pace. Talk about hacking the future!

“I hacked my Waymo into showing weird texts like empty string, ‘wongmjane,’ and emojis as the Car ID, pls don’t ban me or patch it @waymo lol.”

Jane Manchun Wong

How She Did It: No Jailbreaking Required

Wong, a San Francisco-based researcher, didn’t need to jailbreak or root the car itself. Instead, she simply tinkered with the Waymo mobile app on her Android phone. By manipulating the app’s input fields, she was able to send custom text to the car’s dome display—officially called the “dome.”

“The good old magic of messing around with the Waymo mobile app,” Wong explained. “I guess their servers didn’t validate the input for the Car ID from non-employees. So no ‘jailbreaking’ or ‘rooting’ the car itself. All I did was change the Car ID to something beyond what it’d normally accept. A pretty harmless thing I suppose.”

Waymo’s Response: Shutting Down the Fun

Despite Wong’s playful plea to Waymo not to patch the feature, the company acted swiftly. By Tuesday, Wong confirmed that the loophole had been closed. Waymo spokesperson Sandy Karp acknowledged Wong’s discovery, stating:

“Jane identified an unreleased feature given her advanced Android knowledge. We have restricted access to the dome display features.”

Sandy Karp, Waymo Spokesperson

Why the Dome Matters: More Than Just a Display

The dome isn’t just a flashy accessory—it’s a critical communication tool. In 2020, Waymo introduced moving LEDs to the dome to help riders identify their vehicle, especially in crowded areas. It also communicates with pedestrians and cyclists, signaling when the car is yielding or when a passenger is about to open the door.

• Rider Identification: Helps passengers spot their ride among multiple Waymo vehicles.
• Pedestrian Safety: Signals yielding or door-opening actions to avoid accidents.
• Marketing Potential: Used for promotional messages and branding.

The Bigger Picture: What This Means for the Future

Wong’s discovery highlights the delicate balance between innovation and security in the world of autonomous vehicles. While her experiment was harmless, it underscores the importance of robust validation systems to prevent misuse. As self-driving technology evolves, so too must the safeguards that protect it.

So, what’s next? Will we see more hidden features in the wild? Only time will tell. But one thing’s for sure: the future of transportation is anything but boring.