Study Proves Drivers Can Be Tracked Via Tire Pressure Monitoring Systems

A recent study from the Madrid Institute of Advanced Studies (IMDEA) has revealed that tire pressure monitoring systems (TPMS), including older examples, can be used to remotely track individual vehicles.

Connected automobiles have been a double edged sword and both sides of the blade have been cutting into consumers for years. Despite once being heralded as the future of passenger vehicles, connectivity features have primarily been used by the industry to harvest data from customers and gatekeep hardware behind subscriptions.

While some will undoubtedly argue that having consumer products permanently connected to the internet came with some advantages, the truly observant can see the trend for what it is — highly exploitative. But this new research illustrates that a system doesn’t necessarily need to be tied to the industry’s present business strategies to come with similar drawbacks.

Tire pressure sensors predate modern connected cars and make for a good early warning to motorists who aren’t constantly checking their tire pressures manually. Despite often becoming a source of frustration as they go bad later in a vehicle’s life, they can tip drivers off to slow leaks and punctures before the situation worsens. Later versions even provide accurate estimates of individual tire pressures.

But they all operate similarly. Regardless of how the individual pressure monitors function, they are wholly dependent upon radio signals to relay the relevant information to the driver since running a wire out to the spinning wheel would be an engineering nightmare. On newer vehicles, this information is relayed to the manufacturer via the modem. However, according to the IMDEA (h/t CarBuzz), even vintage units can be exploited to effectively track a vehicle.

From CarBuzz:

In many countries, TPMS has been mandatory since the late 2000s as a road-safety requirement. In other words, most modern cars on the road today are broadcasting whether their owners know it or not.

Researchers at IMDEA Networks Institute found that each TPMS unit broadcasts a fixed, unique ID. In other words, every car is quietly tagging itself, making it possible for anyone listening to identify a specific vehicle and track where it goes.

How practical it would be to actually utilize this to track cars depends on commitment and how large of an area someone wanted to survey. The IMDEA and its European partners set up a series of cheap radio receivers ($100 each) to prove that the concept was feasible. With just a few units, the research suggested that it would be possible to identify when vehicles were within roughly 50 meters of a receiver in an urban environment, regardless of whether they were parked in a garage or moving around outdoors.

However, strategically placing them across a broad area and networking them together would allow for close tracking of individual units by accounting for the unique IDs fitted to TPMS. The research team even noted that the networked receivers could be used to predict daily patterns of automobiles after just a few days.

Over ten weeks of testing the group said that it had gathered over 6 million hits from over 20,000 individual vehicles. While the researchers were only interested in actively tracking twelve vehicles that were part of the study, the number of impressions was included to showcase just how much data could be harvested by a handful of receivers.

Considering just how much vehicle tracking and data sharing has been normalized by the industry, one could argue that the study isn’t breaking new ground. Western authorities are also partnering with networked camera systems at an alarming rate to build large-scale surveillance zones that are capable of tracking vehicles with the help of artificial intelligence.

But the IMDEA voiced concerns that this would be another avenue to track individuals who were attempting to opt-out of data harvesting by purchasing older vehicles lacking connected services. Hackers and foreign governments were another item mentioned in the paper.

“Malicious users could deploy passive receivers on large scales and track citizens without their knowledge. The advantage of such a system, over more traditional camera-based ones, is that no direct line-of-sight is needed with the TPMS sensors and spectrum receivers could be placed in covert or hidden locations, making them harder to spot by victims,” the study explains.

“A data mining company could deploy receivers, gain insight on the types of traffic and routes taken, and then sell that data, all without the knowledge of the users (the drivers). By establishing such a network of spectrum devices over a city, malicious users could track cars and infer behavioral patterns. In fact, another type of attack that results from passive surveillance could be for burglars in suburban residential areas. By tracking the vehicles of each household, they could infer the schedule and pattern of a particular household and take advantage of their absence. Finally, by combining passive monitoring with active spoofing, threat actors could track logistics trucks, spoof flat tire alerts to force stops, and then hijack the cargo.”

The rest of the report was dedicated to how the various systems work. It’s worth a read if you’re extra curious about how different forms tire pressure monitors function or are interested in building a surveillance network of your own — as everyone seems to be doing it these days.

Noting the limited scope of the study, the research team suggested that detection ranges could be scaled up dramatically with minimal effort using the appropriate software. Receives could likewise be increased in volume or placed along strategic routes to track vehicles over longer distances. More precise tracking was likewise possible by increasing the number of receivers in a smaller area.

In some instances, receivers may even be able to tell when a vehicle was hauling an unusual amount of cargo or passengers by tracking variables in tire pressure. For example, if a vehicle changed its typical route with increased tire pressure and then returned with normal pressure, there is a good chance it dropped something or someone off during the first part of the trip.

Researchers noted that tire pressure monitoring was something that never really took privacy into account, so these vulnerabilities have persisted. They recommended that policymakers start taking them into account when considering future privacy regulations.

The IMDEA should be praised for pointing out this vulnerability. But this is another drop in the bucket of the seemingly endless opportunities to swipe someone’s data. Drivers are already forced to contend with manufacturers and dealers selling their information to third parties. Data leaks and corporate hacking have also become serious problems, which is to say nothing of businesses that have networked their camera systems together to create unparalleled levels of surveillance. Citizens have a very long way before we restore any semblance of true privacy. Still, it is always good to know what you're up against.

[Images: lzf/Shutterstock; AimurK/Shutterstock; Jstengel/Shutterstock; JIPEN/Shutterstock]

Become a TTAC insider. Get the latest news, features, TTAC takes, and everything else that gets to the truth about cars first by  subscribing to our newsletter.