Cybersecurity experts confirm Israeli-linked server code in Waze, but report no proof data was sent

Technology & Innovation Calculating...

🇲🇾 Malay

🇨🇳 Mandarin

🇮🇳 Tamil

↩️ Show Original

Kritik
02 Nov 2026
21
SubCategory | Cybersecurity

Cybersecurity experts confirm Israeli-linked server code in Waze, but report no proof data was sent

By Faiz Ruzman

PETALING JAYA: Navigation apps can record every trip a driver makes, yet pinning down where that location data ends up is far from simple.

Concerns over data security intensified following the government’s restriction on Waze use among civil servants, citing potential national security risks and the application’s links to Israel.

Two independent cybersecurity specialists have since confirmed an Israeli-linked server address previously identified by Malaysian anti-scam website PenipuMY, although neither could establish whether Malaysian users’ data had been transmitted through it.

PenipuMY’s Oct 22 analysis examined more than 32,000 software classes and found no signs of spyware behaviour in the portions inspected.

It nevertheless identified several Israeli-linked server addresses, including one associated with an inbox test server, a system used during software development to test the application’s messaging functions.

The test-server address, identified as stgweb.waze.co.il/InboxServer, uses HTTP instead of HTTPS. Put simply, HTTPS protects information travelling between an app and a server by encrypting it. HTTP does not provide that protection on its own, meaning information sent through such a connection could be read or altered if intercepted and not otherwise secured.

However, the presence of a server address in the application does not necessarily mean Waze is using it to send information. The address may remain in the software without being used, and its presence alone does not prove that users’ data have been exposed.

PenipuMY also found that Waze’s default settings appeared to direct Malaysian users to servers designated for countries outside Israel.

It cautioned that these settings could be changed remotely and that it had not monitored live internet traffic to establish where every request went.

When contacted for wider independent checks, Universiti Tun Hussein Onn Malaysia Centre for Cybersecurity and Data Intelligence senior researcher Assoc Prof Dr Zubaile Abdullah said he examined Waze’s Android installation package and independently located the same HTTP reference, linked to its inbox configuration.

“It appears to refer to a test environment, but its actual use has not been confirmed,” he said in a written response to theSun. “If sensitive information is sent over that connection without additional protection, someone who intercepts the traffic could potentially read or alter it.”

He stressed that the address alone did not prove the connection was active or that location data had been transmitted through it.

Zubaile said further verification would require researchers to record the app’s internet traffic on a controlled device while opening its inbox and starting navigation, to determine whether it contacts the server and what information it sends.

rawSEC ( the technical arm of the Malaysian Cyber Security Community Organization) head of technology research Yusri Yusof separately confirmed the test-server reference through his examination of Waze’s code.

“The staging-server reference is there, but by default it is not used unless the server assigns it,” he said.

Yusri said he found no indication of Malaysian data being redirected to Israeli servers. However, he had not conducted live traffic monitoring, so his findings could not establish every destination receiving data during actual use.

He said the wider issue was data sovereignty, particularly who ultimately controlled and processed navigation information.

Meanwhile, cybersecurity consultant and VortiQx founder and CEO Jane Teh said outside researchers faced limits in establishing what happened to information once it reached an application provider’s systems.

“We require permission or consent to ‘poke around’ to collect evidence or trails of compromises from the app owner,” she said.

She cited Waze’s own privacy policy, which states that account deletion generally takes about two months, while some information may remain in backup records even after the process is completed.

Waze previously rejected allegations that it collected sensitive government information or allowed others to exploit personal data, saying it followed strict privacy policies and international data-protection standards.

In its published FAQ, the National Cyber Security Agency (Nacsa) warned that location and travel records could reveal movement patterns when analysed collectively.

It acknowledged there was no evidence Waze itself conducted the type of movement-pattern analysis it identified as a potential security risk.

Nacsa had not responded to theSun’s enquiries on whether its security assessment involved direct technical testing as of press time.

Source: cybersecurity-experts-confirm-israeli-linked-server-code-in-waze-but-report-no-proof-data-was-sent

Disclaimer

The views and opinions expressed in this article are solely those of the author and do not necessarily reflect the official stance of Kritik.com.my. As an open platform, we welcome diverse perspectives, but the accuracy and integrity of contributed content remain the responsibility of the individual writer. Readers are encouraged to critically evaluate the information presented.

AI Summary

Analyzing article content...

AI-generated summary of key points

0 Comments

No comments yet. Be the first to comment!

Court Politics Donald Trump Martial Law South Korea Selangor International Business Summit 2025 Tariff Strategy Economic Reforms Trade Diversification Supply Chain Resilience Export Promotion US Malaysia Trade Fire Gas Pipeline Water

Grow Your Business With Kritikal News

Reach a wider audience and boost your sales — advertise your product here.