Most people don’t realize the TPMS system in their vehicle uses a radio signal from each sensor – one in each wheel – to measure the tire pressure in each tire. That radio signal, weak as it is, can be received from roadside receivers. Each TPMS sensor transmits tire pressure data along with the sensor serial number so the vehicle’s system knows which tire’s data is being sent. That also makes it possible to identify the vehicle transmitting that data.
But wait! There’s more!
Researchers at IMDEA Networks Institute in Spain, together with European partners, have found that tire pressure sensors in modern cars can unintentionally expose drivers to tracking. Over a 10-week study, they collected signals from more than 20,000 vehicles, revealing a hidden privacy risk and highlighting the need for stronger security measures in future vehicle sensor systems.The sensors use 315MHz in the ISM (Industrial, Scientific, and Medical) license-free band in North America and most of the rest of the world, and 433MHz in Europe. Receivers capable of receiving those frequencies are readily available. Decoding the signals isn’t difficult since they employ data formats laid out in the TPMS specifications. In the US, TPMS requirements and specifications are laid out in 49 CFR § 571.138 - Standard No. 138.
--snip--
However, the researchers found that these tire sensors also send a unique ID number in clear, unencrypted wireless signals, meaning that anyone nearby with a simple radio receiver can capture the signal -- and recognize the same car again later. Most vehicle tracking today uses cameras that need clear visibility and line-of-sight to a car.
TPMS tracking is different: Tire sensors automatically send radio signals that pass through walls and vehicles, allowing small hidden wireless receivers to capture them without being seen. Because each sensor broadcasts a fixed unique ID, the same car can be recognized repeatedly without reading a license plate. This makes TPMS-based tracking less expensive, harder to detect, and more difficult to avoid than camera-based surveillance, and therefore a stronger privacy threat according to the researchers.
To test how serious this risk is, the team built a network of low-cost radio receivers, located near roads and parking areas. The necessary equipment costs only $100 per receiver. In total, they collected more than 6 million tire sensor messages from over 20,000 cars.
Those involved with the study have addressed the issue, bringing up the security of automotive systems including TPMS.
"As vehicles become increasingly connected, even safety-oriented sensors like TPMS should be designed with security in mind, since data that appears passive and harmless can become a powerful identifier when collected at scale," says Alessio Scalingi, former PhD student at IMDEA Networks and now assistant professor at UC3M, Madrid.The question is, will those manufacturers and policymakers make the changes needed? I have a feeling that they will, but not anytime soon.
Despite these risks, current vehicle cybersecurity regulations do not yet specifically address TPMS security. The researchers warn that without encryption or authentication, tire sensors remain an easy target for passive surveillance.
"TPMS was designed for safety, not security," adds Dr. Yago Lizarribar, former PhD student at IMDEA Networks during the research study, and now a researcher at Armasuisse, Switzerland. "Our findings show the need for manufacturers and regulators to improve protection in future vehicle sensor systems."
Therefore, the research team urges the manufacturers and policymakers to strengthen cybersecurity in future cars, so that safety systems do not become tracking tools.