Wayfare Mobility

Program overview

Wayfare builds the connected layer of a commercial vehicle: the telematics unit that talks to our backend, the head unit the driver touches, the phone app that unlocks and preconditions a cab, and the update channel that keeps all of it current. Around 412,000 vehicles across 23 fleet operators carry our hardware, most of them vans and light trucks in daily service.

Our own product security incident response team runs this programme. Nobody sits between you and the engineer who owns the firmware. That is a choice with a price: a firmware fix is validated on a hardware-in-the-loop rig before it is staged into an update campaign, and a campaign can take six weeks to reach a fleet that parks indoors only at weekends. The resolution figure above is the real one.

Since June 2022 we have posted bench hardware to researchers rather than leave them hunting the second-hand market. It did more for report quality than any rewrite of this page.

Testing rules and expectations

One rule outranks every other rule here, and it is not negotiable.

Never test against a vehicle that is moving, on a public road, or with a person aboard. Not a slow roll across a yard, not with a colleague at the wheel and a hand on the brake. Where a finding can only be reached on a vehicle in service, write up the theory and we will reproduce it ourselves on the proving ground with a safety driver and a closed surface. You are paid as though you had reached it yourself; that has happened eleven times.

The rest follows from it.

• Hardware work happens on a bench harness. Buy a unit, take one out of a vehicle you own outright, or ask for a loaner.
• No CAN, LIN or automotive Ethernet fuzzing against a unit fitted to an assembled vehicle. Fuzzing leaves a control unit in a state that needs a dealer tool, and on something that still drives that is a safety problem rather than an inconvenience.
• Backend work goes through a bench account bound to your own units; ask and we will provision one with synthetic fleet data inside a day. Do not enumerate vehicle identifiers that are not yours.
• No availability testing against the cellular backend. In several markets, a vehicle that loses connectivity loses its emergency call feature with it.
• No social engineering of drivers, dispatchers, depot staff, dealers or our own people, and nothing physical at any of our sites.
• Trip histories are personal data. If you reach one that is not yours, keep a single record as proof, stop, and delete the rest.

Proving write access

If you find a way to write, do not prove it by causing damage. Prove it with the smallest change that can be attributed to you and undone in the same minute.

• One or two punctuation characters. Delete a full stop, add a comma. Nothing longer, nothing visible, no payload, no changed number or amount.
• Only on a record you created yourself. Never another user's record, never site content, never anything the public can see.
• Revert within sixty seconds, in the same run, without being asked.
• Capture four states: before, after the change, after the revert, and an independent re-read confirming the revert held.
• If it cannot be reverted, do not change it. Report the write primitive and stop. A row count and a column list already prove database access.

Every request must carry headers that let us separate your traffic from a real attack in our logs:

X-Bug-Bounty:        wayfare-mobility
X-Research-Account:  <the account you submit the report under>
X-Authorisation-Ref: <engagement or report reference>
X-Request-Id:        <unique per request>
User-Agent:          sentinel-research/<handle> (+<this page>)

scripts/proof_of_write.py performs exactly this sequence, refuses any host outside the scope above, refuses a diff longer than two characters, always attempts the revert, and writes a timestamped evidence file. Run it without --execute first, then attach the evidence to your report.

Safe harbour

Stay inside the rules above and your work is authorised. We will not bring a legal action, will not support anyone else's, and will confirm your authorisation in writing to an employer, an operator or a regulator who asks. We have written eight such letters since 2021.

The protection covers electronic research on equipment you own or we loaned you, and on the backend assets in scope. It does not reach a vehicle owned by somebody else, an operator's depot, our suppliers' systems, or anything fitted to a vehicle in service. It ends if driver location data is kept past the point of proof, and it ends if a finding is shown publicly on a road.

Should testing ever put a person in physical danger, we will handle it as a safety incident first and a security report second, and cooperate with any authority that asks.

Reward decisions

Severity starts from CVSS v3.1, then is adjusted for reachability, which in a vehicle counts for more than the vector string suggests. A defect an attacker reaches over cellular from another country pays bands above the same defect that needs an unlocked cab and ten minutes with a laptop.

Physical-access findings cap at High unless they leave a persistent foothold triggerable remotely. Anything crossing from an external radio into the bus gateway is Critical, without argument: that boundary is why the architecture has the shape it has.

Duplicates go to the first reproducible report, and since March 2024 the window runs from triage rather than from submission. Chained findings pay once at the severity of the outcome, plus a 15 percent analysis bonus.

The 2023 forged-manifest report is the one we measure others against. It paid the top of the Critical band with the bonus and went further than money: we opened a voluntary field safety campaign with our type-approval authority and re-flashed 6,400 vehicles.

Disclosure policy

We ask for 180 days. The reason is the campaign calendar rather than reluctance. Where a fix lands sooner, the clock stops when the campaign closes for the affected operators, and we send you the date.

After that, publish. Redact vehicle identification numbers, operator names, subscriber identifiers, keys, and anything that resolves to a named driver. To present before day 180, tell us early; we have never refused, and three times one of our engineers has stood on stage beside the researcher.

Report quality

Reports that move fastest through our rig queue carry all of this:

• Hardware revision, firmware build string and app version, copied from the unit rather than remembered.
• Whether the unit was bought, loaned by us, or pulled from a vehicle you own.
• A photograph or sketch of the bench topology wherever a harness, probe or glitcher is involved.
• Steps a firmware engineer can follow on an identical rig, with nothing left implicit.
• The external entry point stated outright: cellular, Wi-Fi, Bluetooth, USB, diagnostic port or local console.
• Raw captures rather than screenshots: a pcap, a bus log or a serial transcript.