Your Car Tire Pressure Sensors Pose An Unexpected Privacy Threat, Study Finds
Basically, each TPMS relies on radio frequency (RF) signals transmitted by the small sensors located inside a car’s wheels, communicating tire pressure data to the vehicle’s ECU at set intervals. However, security researchers at Instituto Madrileño De Estudios Avanzados (IMDEA) have demonstrated that these transmissions are frequently unencrypted and lack basic authentication protocols. Because each sensor has a unique identification code to prevent it from being confused with the car in the next lane, a vehicle effectively broadcasts a digital fingerprint to anyone with a low-cost radio receiver. In fact, the IMDEA team proved this by building a network of receivers costing $100 each and was ultimately able to capture 6 million tire sensor pings from over 20,000 cars.
By placing similar receivers along a highway or near a parking garage entrance, a third party could log these unique IDs and track the movements of specific vehicles with pinpoint accuracy. While the average commuter might not be a target, this level of remote surveillance poses a significant risk to VIPs or victims of stalking.
The vulnerability likewise extends into the realm of active safety. In controlled demonstrations, other studies have been able to intercept and spoof the TPMS signals, sending false data to the car’s dashboard. By blasting a vehicle with fake low-pressure alerts, a hacker can trigger a driver’s panic, potentially causing them to pull over in an unsafe location or slam on the brakes in traffic. More sophisticated attacks could theoretically overwhelm the vehicle’s electronic control unit (ECU). In some tests, researchers were able to cause the entire tire pressure management system to crash, forcing a hard reset of the car’s internal computer system.
The fact is, most current TPMS sensors are designed for extreme battery efficiency and low cost, which typically leaves little room for robust encryption. And with cars becoming increasingly connected through Wi-Fi, Bluetooth, and cellular networks, smaller, invisible gateways like tire sensors and headlights can provide an easy backdoor for malicious actors.
Addressing this flaw requires a major awakening on how car manufacturers handle short-range wireless data. Future iterations of these sensors will need to incorporate cryptographic signatures to ensure that the data being received is legitimate and that the unique ID of the sensor cannot be harvested by passersby.
Image credits: Wikimedia Commons
