Civil Servant Attendance Fraud Scheme Uncovered in Brebes
Police have revealed a manipulation of the attendance system involving several civil servants (ASN) in Brebes. The perpetrators allegedly used various methods to deceive the online attendance system so that their recorded location did not match their actual position.
Cybersecurity expert Alfons Tanujaya explained that perpetrators can utilise at least three scenarios to falsify their location. One method involves using the Mock Location feature on Android devices, where a fraudulent app registers as a fake location provider, replacing the GPS signal so other applications read the false coordinates.
Another method involves rooting the device or using a framework to hook directly into the Location Manager API. This allows the target application to receive fake coordinates without detecting the mock provider. The third and most likely scenario in this case, according to Tanujaya, involves sending requests directly to the attendance backend API using a pre-prepared list of coordinates.
“This is likely what happened and should be a concern because the weakness lies in the attendance server. The app most likely sent requests directly to the attendance backend API with a list of coordinates that had been prepared beforehand,” Tanujaya told CNBC Indonesia. “This means the backend was accessed because it was not properly protected or was left open for some reason. This is serious and indicates reverse engineering of the protocol/API. This is suspected because there was an official statement that ‘the server was down but attendance was still recorded’, so the third point is more likely.”
To prevent similar incidents, Tanujaya shared several countermeasures. First, validate requests to ensure they come from unmodified devices. Second, ensure requests without a valid signature to the API are immediately rejected. He also advised cross-checking multiple location signals, not just GPS, but also office WiFi BSSID and cell tower IDs, as GPS spoofing cannot fake these.
He further recommended detecting anomalies on the server, such as drastic location jumps in a short time or many different devices reporting identical coordinates, which indicates hardcoded spoofing. Finally, he suggested considering an upgrade to a liveness biometric-based attendance system to ensure the authenticity of the person clocking in, while maintaining server-side security by restricting direct access to the API.
The Brebes Police previously uncovered the alleged misuse of the electronic attendance system within the Brebes Regency Government, naming nine suspects. The case came to light following a report of suspected illegal online attendance on 29-30 April 2026 by the Regional Personnel and Human Resources Development Agency (BKPSDMD) of Brebes Regency. Investigations found that coordinate points in the system had been altered, allowing civil servants to clock in without being at the designated location.