I can think of few uglier scenarios behind the wheel than a puncture going 120 kilometers per hour. Fortunately, tire pressure sensors minimize this risk because they act as whistleblowers in case of mishaps, ranging from a blowout to a simple loss of pressure. They were designed with security in mind and not privacy and that has opened a door: monitor where your car passes. And obviously, where are you.
Context. Tire pressure monitoring systems or TPMS are required by law: in the EU since 2014, also in the pioneering United States and other countries such as South Korea or Japan. This system uses small sensors integrated into each wheel to monitor the pressure and send wireless signals to the car’s computer to alert the driver if a tire drops below the set pressure.
Due to regulations and validity, there are millions of vehicles in circulation with TPMS and no one perceives them as a risk: they are safety sensors, not connectivity.
The discovery. A research team from IMDEA Networks has shown that TPMS sensors continuously emit a unique identification number via radio frequency that has neither encryption nor authentication. The ID does not change, so it works as if it were a license plate. Like that radar that catches you on a specific day and time at a certain point.
Thus, anyone with a radio receiver can pick it up and if they do it once, from then on they will be able to recognize that car at any other time. This operation occurs without the driver knowing and, furthermore, he cannot do anything to avoid it.
Why is it important. To begin with, because the research team has already confirmed that by crossing the four data from the four wheels, the reliability of the identification is high. Alessio Scalingi, professor at UC3M and one of the authors of the study, summarizes it like this: “data that seems passive and harmless can become a powerful identifier when collected at scale.”
But it is also much more discreet than a conventional radar or camera: the TPMS emits radio signals continuously and these are invisible and can pass through obstacles or walls. Hiding is not an option. On the other hand, there is no need to hack anything: the signal is public and by default it arrives unencrypted. In short: TPMS tracking is cheap, difficult to detect, and difficult to avoid.
How they did it. To reach this conclusion, the IMDEA Networks Institute research team together with European partners conducted a 10-week study in which they collected signals from more than 20,000 vehicles. The equipment used was a network of low-cost SDR radio receivers ($100 each), which were distributed near parking lots and roads.
In that time they were able to collect more than six million messages, which helped them to reconstruct routes and routines, for example what time someone arrives at work or how often they go shopping, the type of vehicle or even whether it transports heavy cargo. The receivers are capable of capturing signals from moving cars at more than 50 meters, even if the sensors are hidden or inside buildings.
How it affects you as a driver. You are potentially exposed to monitoring of your car journeys no matter what you do. This sensor goes inside the wheel and has no switch, so as a driver you cannot do anything to avoid this tracking beyond obviously not using your private vehicle. Of course, it requires someone to deploy this network of receivers deliberately.
The ball is in the regulators’ court. As the research team explains, the real problem is structural: the TPMS regulations do not require encryption for these sensors, so the solution is not in the hands of users, but in those who regulate and the manufacturers. As concludes Dr. Yago Lizarribarone of the authors of the study: “Our findings demonstrate the need for manufacturers and regulatory bodies to improve the protection of future vehicle sensor systems.”
In Xataka | The Government of Spain has insisted that we do not exceed the speed limits. And it has a threat: jail
Cover | Waldemar Brandt
GIPHY App Key not set. Please check settings