Malware May be Using Real GPS Data to Scam Speeders

There is a new malware scam hitting computers in Pennsylvania posing as an email containing a speeding ticket and containing a link that loads malicious software onto the user’s computer. The emails claim to be from the police department of Tredyffrin, Pennsylvania, and masquerading as an official body is nothing special for malware. What is interesting is that the data used in the tickets is said to be accurate, including the street names, their speed limits and the actual speed that the perpetrator drove at, according to the Tredyffrin Police Department.

Exactly where the data is coming from is unknown, but the current suspect is that the source is a phone app with access to the user’s GPS data and perhaps other personal information that provided the attackers with contact details. This source could be from either a legitimate app that has been compromised and hands over data to the attackers or a purpose-built malicious app that has been uploaded to the internet. It is common knowledge that GPS data can be used to determine speed as well as location, which would make GPS-using apps a good method for obtaining the data.

Thankfully for many, this malware scam seems to be highly localized to the Tredyffrin area, but it gives a good view of a new type of attack emerging. Possessing data that normally only legitimate sources would have makes a great way to deceive people into believing that they are the sources they claim to be. Despite this, this scam chooses not to offer a payment link for the fictional speeding ticking, in lieu of downloading malware, but other parties may make use of this method to different ends on a much larger scale in future.