Hacker Threat Lurks in Your Car's Tire Pressure System, Study Warns

Spain - Ekhbary News Agency

Automotive Security Alert: Your Car's Tire Pressure Sensors May Be a Tracking Device

In a development that could affect millions of drivers worldwide, a new scientific study has identified a serious security flaw within the Tire Pressure Monitoring Systems (TPMS) integrated into most modern vehicles. Researchers at the IMDEA Networks Institute, based in Madrid, have discovered that these systems, originally designed to enhance road safety, can be repurposed into effective tools for espionage and tracking vehicle movements without the owner's knowledge.

These findings emerge from a 10-week study where researchers collected approximately 6 million wireless signals from over 20,000 cars. The results highlight a significant hacker threat embedded within the tire sensors – a component mandated in most vehicles manufactured after 2008, following the TREAD Act of 2000 which required TPMS for road safety.

The TPMS functions by employing small sensors attached to each tire. These sensors transmit wireless signals containing tire pressure information to the car's central electronic control unit. Typically, this data is displayed on the dashboard, with a warning light illuminating if pressure drops below safe levels, alerting the driver to take necessary action.

However, the researchers found that these wireless signals, continuously broadcast as a unique, unencrypted identifier for the vehicle, are susceptible to interception. Instead of relying on traditional tracking methods or visual surveillance, malicious actors with a simple, inexpensive radio receiver can capture these signals. More alarmingly, such a device can later recognize the same vehicle by its unique signal signature, even without seeing the license plate.

"Our results show that these tire sensor signals can be used to follow vehicles and learn their movement patterns," stated Domenico Giustiniano, a research professor at IMDEA Networks Institute, in the peer-reviewed report. "This means a network of inexpensive wireless receivers could quietly monitor the patterns of cars in real-world environments. Such information could reveal daily routines, such as work arrival times or travel habits."

The research team successfully captured signals from moving vehicles at distances exceeding 50 meters, penetrating walls and operating from within buildings. The data gleaned not only identified the vehicle but also revealed its type, weight, and the driver's patterns. This constitutes a cheap, difficult-to-detect, and potentially covert method of tracking.

While this discovery is startling, Cooper Quintin, a senior staff technologist at the Electronic Frontier Foundation (EFF), commented to CNET that it's not the sole privacy threat within a car's complex computer systems. "Any method that can be misused to surreptitiously track people's movements without their knowledge is concerning," he said. "But so are all of the technologies in modern cars that intentionally violate drivers' privacy by collecting and sharing data for purposes of advertising, insurance risk assessment, and more. It's sad that drivers have to worry about this, and everyone should learn how to protect themselves whenever possible while manufacturers are pressured to do better."

This is not the first time researchers have raised alarms about this particular sensor system. A 2010 study by researchers at Rutgers University and the University of South Carolina had previously warned of the potential privacy risks associated with vehicle tire pressure systems. Sixteen years later, the vulnerability persists.

"TPMS was designed for safety, not security," noted Dr. Yago Lizarribar, one of the study's authors. "Our findings show the need for manufacturers and regulators to improve protection in future vehicle sensor systems."

The study's authors urge policymakers and automotive manufacturers to collaborate on designing more secure, privacy-preserving TPMS for future vehicles, addressing this critical security gap before it can be widely exploited.

Ekhbary News Agency