Can Tire Pressure Sensors Enable Vehicle Tracking?
Researchers from the Cyber-Defence Campus (CYD Campus) of armasuisse Science and Technology (S+T), together with international partners, have investigated the privacy risks posed by tire pressure sensors in modern vehicles. Their study shows that unencrypted wireless signals from Tire Pressure Monitoring Systems (TPMS) can be captured with inexpensive hardware, making it possible to infer vehicle movement patterns.
This paper by the Cyber-Defence Campus and its international partners provides new insights into privacy risks related to connected vehicles. The research demonstrates how seemingly simple components such as tire pressure sensors can expose sensitive information. Based on real-world measurements, the study highlights the need for stronger security and privacy mechanisms in future vehicle systems
Modern vehicles increasingly rely on wireless technologies to improve safety and comfort. One such component is the Tire Pressure Monitoring System (TPMS), which continuously measures tire pressure and transmits this information wirelessly to the vehicle’s electronic control unit. In many current implementations, these transmissions are sent in clear text and contain a unique identifier that remains unchanged.
A new study involving researchers from the CYD Campus including Dr. Gérôme Bovet and Dr. Yago Lizarribar, together with international research partners, investigates whether these signals can be used to infer vehicle movement patterns.
To analyze this risk, the researchers deployed a network of low-cost spectrum receivers that collected wireless TPMS transmissions over a period of ten weeks. During this measurement campaign, more than six million TPMS messages from over 20,000 vehicles were captured and analyzed. Using data analysis techniques, the team was able to associate signals from different tires with individual vehicles and identify recurring patterns in their movements
The results demonstrate that such tracking is technically feasible using relatively inexpensive hardware, such as software-defined radio receivers costing around 100 USD. By combining the signals from multiple tire sensors belonging to the same vehicle, it becomes possible to recognize vehicles and reconstruct movement patterns over time.
In addition, the analysis shows that certain behavioral insights may be inferred from these signals, such as regular arrival and departure times or changes in driving patterns. In real-world scenarios, such information could potentially be exploited to analyze routines of individuals or organizations.
The study highlights the importance of applying security- and privacy-by-design principles even to seemingly simple components within modern vehicles. The researchers therefore recommend that future TPMS systems incorporate stronger protections, such as encryption or privacy-preserving identifiers.
Through this work, the CYD Campus contributes to advancing the understanding of cybersecurity and privacy risks in connected technologies and supports the development of more secure and resilient digital systems.
Read the whole paper: Can’t Hide Your Stride - Inferring Car Movement.pdf
