Sandra Vi going for record across America

Gary kiernan wrote:

It's starting to sound like running the route might actually be easier than spoofing the Strava data from a Suunto watch.

I'm pretty sure you could pay someone that can already hack the firmware on a Suunto or has reverse engineered their communications protocol. It's not rocket science, just needs a programmer. People root and flash their Android phones all the time. Tinkering with a fitness watch is not out of the ordinary.

Old Timey Guy wrote:

Boring me now wrote:

No proof apart from two weeks worth of Strava uploads you mean. Two dozen or so runs totalling over 1000 miles.

So why isn't anyone commenting on that? Apart from continually repeating the refrain ' data can be scammed'

So show me how? Don't tell me it can be done, show me how to do it. We've already had GPXpro up there ^ asking for sample files, let's see how easy it is to do

Being able to create spoofed data on Strava is irrelevant. I want to see someone spoof her Movescount profile. Do that, and then we can start further speculation. Spoofing stuff on Movescount would be significantly harder than on Strava and would involve hacking into the code of Movescount and/or the watches.

Have you verified that all the data is actually in Mimi's Movescount and matches exactly what is in Strava?

Scam_Watcheroo wrote:

Old Timey Guy wrote:

Being able to create spoofed data on Strava is irrelevant. I want to see someone spoof her Movescount profile. Do that, and then we can start further speculation. Spoofing stuff on Movescount would be significantly harder than on Strava and would involve hacking into the code of Movescount and/or the watches.

Have you verified that all the data is actually in Mimi's Movescount and matches exactly what is in Strava?

I took a quick look at it and yes, it did seem to match. Someone already posted her profile...here it is again;

Old Timey Guy wrote:

Spoofing stuff on Movescount would be significantly harder than on Strava and would involve hacking into the code of Movescount and/or the watches.

Except it's still doable with the right tools and knowledge:

I think arguing whether spoofing is possible or not is irrelevant right now, as we don't have complete data from multiple sources to evaluate and cross reference yet, do we?

Scam_Watcheroo wrote:

Gary kiernan wrote:

It's starting to sound like running the route might actually be easier than spoofing the Strava data from a Suunto watch.

I'm pretty sure you could pay someone that can already hack the firmware on a Suunto or has reverse engineered their communications protocol. It's not rocket science, just needs a programmer. People root and flash their Android phones all the time. Tinkering with a fitness watch is not out of the ordinary.

So essentially for this to be a fake run Mimi has to have a pro programmer on board her crew to adjust her daily mileage counts before uploading them. I know you're saying a programme could be written theoretically to do that automatically but realistically you'd need someone to monitor it wouldn't you? Just to make sure things tally up?

Now we have one of Mimi's crew charting on the URC who gave us a crew breakdown and a programmer wasn't mentioned. I know Mimi and she wouldn't have a clue how to.do such a thing. So in the absence of a likely alternative I'm going to stick with my belief it is as it seems, a genuine run.

Gary kiernan wrote:

It's starting to sound like running the route might actually be easier than spoofing the Strava data from a Suunto watch.

No. The nail in Mimi's coffin is her units (Mimi and car) showing more than an hour of being stopped off the road at the same spot, a road with no shoulders, in unpacked soil, in a drainage ditch, in shrubbery. ... While just 1 km before that there was a paved vehicle pullout area.

Actually, no, spoofing Suunto/Movescount data is way easier than I thought. No need for a hired programmer. As the poster above showed, OpenAmbit already allows you to edit the Suunto/Movescount data.

And I found people talking online about simply syncing the Suunto watch to their laptop and editing the data before uploading to Movescount. And the watch data just gets stored as plain XML so not much different from spoofing Strava data. There is essentially zero security on Suunto watches.

Gary kiernan wrote:

So essentially for this to be a fake run Mimi has to have a pro programmer on board her crew to adjust her daily mileage counts before uploading them. I know you're saying a programme could be written theoretically to do that automatically but realistically you'd need someone to monitor it wouldn't you? Just to make sure things tally up?

Now we have one of Mimi's crew charting on the URC who gave us a crew breakdown and a programmer wasn't mentioned. I know Mimi and she wouldn't have a clue how to.do such a thing. So in the absence of a likely alternative I'm going to stick with my belief it is as it seems, a genuine run.

^ British Ostrich

So many of the Mimi fanboi past are in the posting style. ... Butt using different handles.

I know what you are thinking Gary, you want me to spoof Movescount data now that we know it is no different than spoofing Strava.

Scam_Watcheroo wrote:

Hold your horses, I've only had a few days to research and start spoofing from scratch while these transcons had years in planning and way more money than I have (want to sponsor a fake transcon so I can spoof full time). If you are curious, check out the world record mile and marathon spoofing thread for the low effort attempts we just made at spoofing. I'm coding up my tool and will try to have a long run spoofed this weekend.

Fair enough. Post when you have fakes that you think will fool us.

runwalkcrawlcry wrote:

[quote]Old Timey Guy wrote:

Spoofing stuff on Movescount would be significantly harder than on Strava and would involve hacking into the code of Movescount and/or the watches.

Except it's still doable with the right tools and knowledge:

Good work. I'm not a tech guy so I can't begin to comment on this. Yes it's doable, but as the site says, not easy and in reading the issues log, things look a little buggy.

"Let's be clear, building from the latest revision in the repository is not quite for the faint of heart. You need a development environment, make sure build requirements are met, actually build (doh!) and pray things work as intended. And if worse comes to worst, you might even brick your Ambit watch and turn it into a paperweight."

Personally, I'd think that there would be much easier ways to cheat.

Scam_Watcheroo, are you up to the challenge of spoofing Movescount data?

Scam_Watcheroo wrote:

Actually, no, spoofing Suunto/Movescount data is way easier than I thought. No need for a hired programmer. As the poster above showed, OpenAmbit already allows you to edit the Suunto/Movescount data.

And I found people talking online about simply syncing the Suunto watch to their laptop and editing the data before uploading to Movescount. And the watch data just gets stored as plain XML so not much different from spoofing Strava data. There is essentially zero security on Suunto watches.

http://forums.watchuseek.com/#/topics/789922

Someone please post the above to the URC thread. We need to make it absolutely clear that it is now known that Suunto/Movescount data is not secure and is actually very easy to edit.

GPX Pro wrote:

Scam_Watcheroo wrote:

Hold your horses, I've only had a few days to research and start spoofing from scratch while these transcons had years in planning and way more money than I have (want to sponsor a fake transcon so I can spoof full time). If you are curious, check out the world record mile and marathon spoofing thread for the low effort attempts we just made at spoofing. I'm coding up my tool and will try to have a long run spoofed this weekend.

Fair enough. Post when you have fakes that you think will fool us.

It makes no difference at this point. The UK is not so technologically backwards that they cannot post results immediately.

As others have said, Mimi's run is unofficial. No world record.

Sloetry in Motion wrote:

Good point. Although I would think quite a few people would be on record setting pace this early in the run. Are there any recognized standards of tracking that need to be met for the run to be considered the new record? I would guess it would just be the consensus of the ultra community as to who has the fastest time?

The Guinness guidelines are so soft that cheating is almost encouraged.

The guidelines from the ultrarunning community are much more stringent.

Sorry, this thread is moving faster than my responses so my above response may be redundant as it appears that it may be easy to spoof Movescount data.

What I'd be interested in seeing is if Movescount will recognize spoofed data as coming from a non manipulated Suunto watch. For instance, in Strava, if I sync straight from Movescount, Strava indicates that my move came from my watch. However, if I post my run to Strava by manually importing it straight from a Movescount export with zero manipulation, it drops the Suunto designation making that move suspect in my eyes.

So my question is, is there something in Movescount which does the same thing? If you spoof it, does it still indicate that the data came from the Suunto?

Old Timey Guy wrote:

Good work. I'm not a tech guy so I can't begin to comment on this. Yes it's doable, but as the site says, not easy and in reading the issues log, things look a little buggy.

"Let's be clear, building from the latest revision in the repository is not quite for the faint of heart. You need a development environment, make sure build requirements are met, actually build (doh!) and pray things work as intended. And if worse comes to worst, you might even brick your Ambit watch and turn it into a paperweight."

Personally, I'd think that there would be much easier ways to cheat.

Scam_Watcheroo, are you up to the challenge of spoofing Movescount data?

You are reading developer issues when they compile the bleeding edge version of the code, which is not what a normal user does. You use the prebuilt binaries or compile from a stable branch.

I have a feeling a need a Suunto watch to get some of the XML files to start with. I don't have a Suunto watch so someone would need to upload their XML files they got. If I can spoof it without buying something, I will give it an eventual try after Strava. But I have a feeling this Suunto spoof would be easier for someone here that already has access to a watch to start with.

If you UKers are serious about doing a long run properly, follow Sandy Vi. Her Strava, and more importantly, her real-time Garmin.

The Garmin updates miles run as it updates position. The entire trail run (breadcrumbs) is there, from the start to the current point. You can find her stopping points and use Google maps in satellite view to see if they make sense; and you use Google street view to put you 'boots' right on the road where she stopped.

Follow the Garmin at random points. Look at the blue dots of points were measurements were made. Click any dot and you will see time and date. Click 'more' and you will see speed, elevation, and latitude (Lat) and longitude (Lon). You can copy the Lat and Lon (values only separated by a space) and enter them into Google maps.

So, not only is the Garmin data being posted in real-time, you can confirm where she is immediately using a separate mapping tool (Google Maps).

https://share.garmin.com/SandraVillines

Scam_Watcheroo wrote:

I know what you are thinking Gary, you want me to spoof Movescount data now that we know it is no different than spoofing Strava.

If it's possible. Or indeed if it is possible how easy is it to do and how easy that would be to detect if it was done.

Now don't be a twat, that's proof of nothing.