Researchers have demonstrated that tire pressure monitoring systems (TPMS) in modern vehicles can be exploited for low-cost, silent tracking. Using receivers costing around $100, they intercepted unencrypted TPMS signals containing unique, unchanging tire identifiers from passing cars. This allows third parties to capture these signals from up to 50 meters away and track specific vehicle movements over time. The main topics covered are a vehicle security vulnerability, the method of data interception, and the privacy implications of unencrypted automotive sensor data.
Vehicle Tire Pressure Sensors Enable Silent Tracking
Like many other features and systems in modern cars, tire pressure sensors leak sensitive data that can be abused by threat actors.
Most people would never imagine that the innocuous tire pressure monitoring system (TPMS) in their vehicles could be used to track their movements.
But, as with many things digital, it turns out the feature, designed for vehicle safety and maintenance, can also expose unintended signals that enable precisely that capability.
Low Cost Vehicle Tracking
A team of researchers from universities in Spain, Switzerland, and Luxembourg recently conducted a study where they deployed a small network of low-cost spectrum receivers, priced at around $100 each, along a road to capture TPMS transmissions from passing vehicles. Their goal was to explore the potentially sensitive information they could infer by analyzing the TPMS transmission data from a set of 12 test vehicles.
Over a 10-week period, the researchers gathered more than six million TPMS transmissions from some 20,000 vehicles that used the road. The researchers then used custom-developed algorithms to try and match TPMS signals from each of the different tires on a vehicle to the same car and from there to infer movement of the 12 vehicles in the study.
"Our results show that TPMS transmissions can be used to systematically infer potentially sensitive information such as the presence, type, weight or driving pattern of the driver," the researchers noted in a research paper. Anyone can misuse a TPMS signal to track vehicles and, by extension, the movements of their owners, the researchers said.
TPMS sensors — mandated in the US since 2007 — transmit tire pressure readings automatically and at regular intervals whenever a vehicle is in motion. It requires no pairing or authentication and cannot be disabled without compromising the safety function it is designed to provide. The data is sent wirelessly to a receiver module, which is often integrated with the vehicle's onboard computer or a dedicated TPMS controller. The receiver monitors tire pressure and triggers a dashboard alert if the pressure drops below a predetermined safe threshold.
In the Clear (Text)
The security issue the researchers discovered is that TPMS transmissions are sent over the air in clear text without any authentication. Thus, anyone with a receiver capable of picking up that frequency — like the $100 devices the researchers used — can intercept the transmission from outside the vehicle, just as the vehicle's own internal receiver can.
As the researchers noted in their report, previous studies have "highlighted that TPMS signals can be intercepted up to 40m from the car." Their own study showed data capture is possible from 50 meters away from a vehicle and even when a receiver might be located inside a building without any nearby windows.
What makes the tracking itself possible is the fact that when a sensor transmits tire pressure data, it includes a unique ID so the vehicle's TPMS control module can tell which specific tire the data is coming from. The unique IDs also allows the control module to ignore signals from other vehicles nearby. "Researchers have discovered that most TPMS sensors transmit a unique identifier in clear text that never changes during the lifetime of the tire," the researchers pointed out. "This unencrypted wireless communication makes the signals susceptible to eavesdropping and potential tracking by any third party in proximity to the car."
The finding adds to a growing body of research showing how modern vehicles have become unintended platforms for all kinds of surveillance and exploits. Modern cars contain numerous components that emit signals that can be intercepted, analyzed, and exploited in ways the equipment manufacturers never intended. Researchers previously demonstrated how to track vehicles through their keyless entry fobs, spy on drivers through in-car entertainment systems, and even remotely manipulate safety-critical functions through connected diagnostic ports.
Meridiano
