It might seem like the title of a science fiction movie, but it’s not: “Your tire pressure sensors monitor you.” Rather, they could be used to track you or that is what a joint study carried out by researchers at the IMDEA Networks Institute, together with European partners, concludes. In just 10 weeks they have managed to collect movement data from more than 20,000 vehicles.
Your tire pressure sensors converted into data transmitters
As detailed in the report, tire pressure sensors in modern vehicles can unintentionally expose drivers to tracking. During a study that lasted approximately ten weeks, they were able to collect signals from more than 20,000 vehicles. This fact highlights an obvious hidden privacy risk, underlining the need for stronger security measures in future pressure sensor systems that will be equipped in vehicles of all types.
Nowadays, most modern vehicles are equipped with a Tire Pressure Monitoring System (TPMSfor its acronym in English), mandatory since the late 2000s in many countries for its contribution to road safety. The report explains that “This system uses small sensors on each wheel to monitor pressure and sends wireless signals to the vehicle’s computer to warn if a tire is underinflated.”
However, research found that these pressure sensors also send a unique identification (ID) number in clear, unencrypted wireless signals. This means that anyone nearby with a simple radio receiver can capture the signal and recognize the same vehicle again later, resulting in personal privacy.
Most vehicle tracking today uses cameras that need clear, direct visibility. In the case of TPMS tracking it is different, since “The sensors automatically send radio signals that pass through walls and other vehicles, allowing small hidden wireless receivers to capture them without being detected”they explain in the report itself.
Since each pressure sensor emits a fixed unique ID, the same vehicle can be recognized repeatedly without needing to read the license plate. This makes TPMS-based tracking cheaper and harder to both detect and prevent than camera-based surveillance, posing a greater threat to privacy.
To test the severity of this risk, the researchers built a network of low-cost radio receivers located near roads and parking areas. Each receiver costs approximately 85 euros. In total, They collected more than six million messages from sensors from more than 20,000 vehiclesmainly cars, although this study could be applicable to any new motorcycle that incorporates the aforementioned pressure sensors.
As stated Domenico Giustinianoresearch professor at IMDEA Networks: “Our results show that these signals can be used to track vehicles and understand their movement patterns. This means that a network of inexpensive wireless receivers could discreetly monitor traffic in real-world environments. Such information could reveal daily routines, such as work arrival times or travel habits.”
The researchers also developed methods to match the signals from all the tires on a vehicle. This increased accuracy by identifying them when they arrived, left, or followed regular schedules. The study proved that signals can be captured from moving vehicles and from distances greater than 50 meters, even when the pressure sensors are inside buildings or hidden locations. This makes covert tracking technically feasible.
Alessio Scalingiformer doctoral student at IMDEA Networks and now assistant professor at the Carlos III University of Madrid, warns on the subject: “As vehicles become more connected, even safety-oriented sensors like TPMS should be designed with cybersecurity in mind, as data that seems passive and harmless can become a powerful identifier when collected at scale.”
Despite these risks, current vehicle cybersecurity regulations do not yet specifically address TPMS security. The research team warns that without encryption or authentication, tire pressure sensors remain an easy target for passive surveillance.
Yago Lizarribar, who participated in the work during his PhD at IMDEA Networks and is currently a researcher at Armasuisse, Switzerland, adds: “TPMS was designed for road safety, not computer security. Our findings show the need for manufacturers and regulators to improve protection in future vehicle sensor systems.”
After this elaborate study on the direct consequences against privacy resulting from the operation of tire pressure sensors, the research team urges the industry and public policy makers to reinforce cybersecurity in the cars of the future, so that security systems do not become tracking tools.
