Tire sensors in cars can be used to track you

Tire pressure sensors in modern cars can unintentionally expose drivers to being tracked, according to researchers at IMDEA Networks Institute.

The group collected signals from 20,000 vehicles over 10 weeks to reveal the privacy risk using relatively cheap wireless receiver gear. They called on the auto industry to provide stronger security, such as encryption, in future vehicle sensor systems.

“Our results show that these tire sensor signals can be used to follow vehicles and learn their movement patterns,” said Domenic Guistiniano, research professor at IMDEA Networks Institute. “This means a network of inexpensive wireless receivers could quietly monitor the patterns of cars in real-world environments. Such information could reveal daily routines, such as work arrival times or travel habits.”

It isn’t clear if the sensor signals have ever been used maliciously, but the institute said the threat is real. “Our findings show the need for manufacturers and regulators to improve protection in future vehicle sensor systems,” said Yago Lizarribar, a PhD student at IMDEA Networks and now a Researcher at Armasuisse, Switzerland. 

Nothing new here, well, maybe…

The vulnerability has been studied for years, but what’s new is the IMDEA team was able to use inexpensive gear to capture the sensor signals, potentially putting the hack within the reach of more bad guys. 

MIT Technology Review wrote in 2010 that TPMS can be considered insecure from a cybersecurity perspective, but said the vulnerabilities pose minimal immediate safety risk to drivers. 

At that point 16 years ago, researchers from South Carolina-Rutgers used equipment that cost $1,500 to pick up a car’s tire pressure readings. By comparison, the IMDEA group said their equipment only cost $100 per receiver, which could point to the capability of modern-day hijackers to operate at a much lower entry price point.

IMDEA institute explained that most modern cars are quipped with a Tire Pressure Monitoring System (TPMS), mandatory since the late 2000s  in many countries to contribute to road safety. Small sensors in each wheel monitor tire pressure and then send wireless signals to the car’s computer to alert the driver if a tire is underinflated.    The researchers posted their findings titled “Can’t hide your stride: Inferring car movement patterns from passive TPMS measurements.“

The researchers said the tire sensors also send out a unique ID number in clear, unencrypted wireless signals. That means anymore nearby with a simple radio receive could capture the signal and use that information to identify the same car again at a later time. TPMS is different from the use of cameras for vehicle tracking. Tire sensors send radio signals automatically that can pass through walls and other vehicles. Each sensor broadcasts a fixed unique ID, meaning the same car can be recognized repeatedly without reading a license plate. As a result, TPMS-based tracking is cheaper and harder to detect than camera-based surveillance and a greater privacy threat.

The IMDEA Networks researchers used $100 receivers in a network near roads and parking areas and collected more than 6 million tire sensor messages from more than 20,000 cars. The TPMS signals include the tire pressure readings, which could help someone know if the vehicles if a car or a heavy truck with a big load, to allow more advanced surveillance. “As vehicles become increasingly connected, even safety-oriented sensors like TPMS should be designed with security in mind. Data that appears passive and harmless can become a powerful identifier when collected at scale,” said Alessio Scalingo, former PhD student at IMDEA Networks and now an assistant professor at UC3M in Madrid.

The team was able to match signals from four tires of a car to increase the accuracy of vehicles as they arrive, leave or follow regular schedules. Siognals can be captured from moving cars and distances greter than 50 meters, even when the sensors are inside buildings or hidden locations. The team said covert tracking is feasible.

Current cybersecurity regulations do not specifically address TPMS security, and the researchers warned that encryption or authentication would help limit passive surveillance 

“TPMS was designed for safety, not security,” Lizarribar added.

TPMS sensors often use Ultra High Frequency radio signals over unlicensed bands, such as 315 MHz in North America or 433 MHz in Europe and Asia. Some aftermarket systems may be use Bluetooth Low Energy as does the Tesla Model Y. The signal power is very low to conserve battery. The sensors are often activated by a 125 kHz low frequency signal then transmitted via UHF.