Tire Pressure Sensors Could Expose Owners To Tracking

Researchers at the IMDEA Networks Institute have found a vulnerability in the Tire Pressure Monitoring System (TPMS) used to monitor a car's tire pressures that could be used to track owners. The study claims that TPMS are vulnerable to hacking, providing a gateway for someone to track a vehicle based on the unique identifiers freely emitted by TPMS, which interface wirelessly with your vehicle to convey tire pressures.

TPMS has been federally mandated since 2007, but the aging technology behind it means that the system leaves driver data vulnerable to those with the know-how to exploit it. Each tire sensor possesses a unique ID number, normally so that sensors in each of a vehicle's four wheels can be individually identified. Normally, this system can be used to identify if, for example, the driver's side front tire is low on air. However, the unique IDs can also be picked up by a radio receiver and recognized, as the data is broadcast by each TPMS sensor unencrypted.

"Most vehicle tracking today uses cameras that need clear visibility and line-of-sight to a car. TPMS tracking is different: tire sensors automatically send radio signals that pass through walls and vehicles, allowing small hidden wireless receivers to capture them without being seen. Because each sensor broadcasts a fixed, unique ID, the same car can be recognized repeatedly without reading a license plate," says the IMDEA Networks Institute study.

These sensors don't require you to be visible to someone tracking your vehicle. After all, the sensors are designed to project their signals through solid objects, so that pressures can be read by a vehicle. An individual doesn't need to be close to the vehicle to track it via these unique IDs, says the study, which increases security risk. To illustrate the point, the study made a network of cheap radio receivers, which were placed near busy roads and parking lots. These aren't a lot of money; each was made for around $100. Researchers were able to use the devices to collect data from six million tire sensors and more than 20,000 vehicles. The team was also able to match the sensors of all four tires per vehicle, which would help to ensure an observed vehicle was the intended target.

"As vehicles become increasingly connected, even safety-oriented sensors like TPMS should be designed with security in mind, since data that appears passive and harmless can become a powerful identifier when collected at scale," says Dr. Alessio Scalingi, former PhD student at IMDEA Networks and now assistant professor at UC3M, Madrid.