Many people may not realize that the tire pressure monitoring system (TPMS) in their vehicles could be exploited to track their movements. Originally designed for vehicle safety and maintenance, this feature can inadvertently reveal signals that facilitate such tracking.
A team of researchers from universities in Spain, Switzerland, and Luxembourg recently conducted a study utilizing a network of low-cost spectrum receivers, each costing around $100, to capture TPMS transmissions from vehicles passing by on a road. Their aim was to investigate the sensitive information that could be inferred by analyzing TPMS data from a set of 12 test vehicles.
During a 10-week period, the researchers collected over six million TPMS transmissions from approximately 20,000 vehicles. They employed custom algorithms to match the TPMS signals from each tire of a vehicle, allowing them to infer the movements of the 12 vehicles involved in the study.
The researchers concluded, "Our results show that TPMS transmissions can be used to systematically infer potentially sensitive information such as the presence, type, weight, or driving pattern of the driver." They cautioned that anyone could misuse a TPMS signal to track vehicles and, consequently, their owners.
TPMS sensors, which have been mandatory in the US since 2007, automatically transmit tire pressure readings at regular intervals whenever a vehicle is in motion. This process occurs without requiring any pairing or authentication, and disabling it would compromise the safety feature it provides. The data is sent wirelessly to a receiver module, often integrated with the vehicle's onboard computer or a dedicated TPMS controller. This receiver monitors tire pressure and activates a dashboard alert if the pressure falls below a safe threshold.
In the Clear (Text)
A significant security issue identified by the researchers is that TPMS transmissions are sent in clear text without any form of authentication. This means anyone with a compatible receiver, such as the low-cost devices used in the study, can intercept these signals from outside the vehicle, similar to the vehicle's internal receiver.
Previous studies have indicated that TPMS signals can be intercepted from distances of up to 40 meters from the car. However, the current study demonstrated that data capture is possible from 50 meters away, even if the receiver is situated inside a building without windows nearby.
What makes this tracking feasible is that each time a sensor transmits tire pressure data, it includes a unique ID, allowing the vehicle's TPMS control module to identify which specific tire the data originates from. This unique ID also enables the control module to disregard signals from other nearby vehicles. The researchers highlighted, "Most TPMS sensors transmit a unique identifier in clear text that never changes during the lifetime of the tire." This unencrypted communication makes the signals vulnerable to eavesdropping and potential tracking by any third party in proximity to the vehicle.
This finding contributes to a growing body of research illustrating how modern vehicles have inadvertently become platforms for various forms of surveillance and exploitation. Modern cars contain numerous components that emit signals susceptible to interception, analysis, and exploitation in ways that manufacturers never intended. Researchers have previously shown how to track vehicles through their keyless entry fobs, spy on drivers via in-car entertainment systems, and even manipulate safety-critical functions through connected diagnostic ports.
