If you drive a car that’s newer than 2008, a new study finds your vehicle’s tire pressure monitoring system can be used to track you.
A group of researchers at IMDEA Networks Institute — an English-speaking research organization on data networks based in Madrid — discovered this privacy risk at the end of a 10-week study in which they collected roughly 6 million wireless signals from over 20,000 cars. Their findings point to a serious hacker threat hiding in the tire sensors of most modern vehicles.
A representative for IMDEA didn’t immediately respond to a request for comment.
The TREAD Act of 2000 mandated that modern cars come equipped with TPMS for road safety. The system works by releasing wireless signals through tiny sensors attached to each tire, which communicate each tire’s pressure information to the car’s electronic control unit. A warning light on the vehicle’s dashboard indicates low tire pressure.
Instead of using a camera with a clear line of sight to the car, hackers can hypothetically track it using the wireless signals emitted by the car’s tire sensors. That signal is continuously sent out as an unencrypted unique ID number.
Basically, anyone nearby with a cheap radio receiver can pick up the signal and later recognize the same vehicle without ever seeing the license plate.
Information could help users track drivers
“Our results show that these tire sensor signals can be used to follow vehicles and learn their movement patterns,” Domenico Giustiniano, research professor at IMDEA Networks Institute, said in the peer-reviewed report. “This means a network of inexpensive wireless receivers could quietly monitor the patterns of cars in real-world environments. Such information could reveal daily routines, such as work arrival times or travel habits.”
The researchers were able to capture signals from more than 50 meters away from moving cars, through walls and from inside buildings. The tire pressure readings helped reveal the vehicle type, its weight and the driving pattern of the driver. It’s a cheap, tough-to-detect, potentially covert tracking method.
This isn’t the first time a group of researchers has raised the red flag about this system in cars. A 2010 study by researchers at Rutgers University and the University of South Carolina warned of the potential privacy threat hiding in a vehicle’s tire pressure system. Sixteen years later, the flaw persists.
“TPMS was designed for safety, not security,” said Dr. Yago Lizarribar, one of the study’s authors. “Our findings show the need for manufacturers and regulators to improve protection in future vehicle sensor systems.”
The study urges policymakers and car manufacturers to design a more secure and privacy-preserving TPMS for future cars.
