By James Kelly
There are a number of ways to track a vehicle. License plates are the most straightforward method used by government agencies, whereas a criminal’s weapon of choice was the Apple Air Tag. But both of these ways of monitoring a vehicle – let's say a Hyundai Sonata (previously one of America's most stolen vehicles) – can easily be thwarted. However, a new way of tracking a car has been revealed, and it’s a little harder to counter than the former. Your car’s Tire Pressure Monitoring System (TPMS) can be used to tip-off anybody trying hard enough to track vehicles using this technology.
IMDEA Study
Researchers for the Madrid Institute for Advanced Studies (IMDEA) tested a theory regarding vehicle tracking using a car’s TPMS. The study claims the system can “unintentionally expose drivers to tracking,” which the researchers discovered after gathering data on 20,000 vehicles over the 10 weeks the study took place. The study discusses both how easy it is to track vehicles this way, and how it’s difficult to detect how a car is being tracked.
TPMS – How It Works
A vehicle’s Tire Pressure Monitoring System keeps track of each of the tire’s internal pressure to make sure they are not under or overinflated. The two types of monitoring systems are called “direct” and “indirect” systems. The former is most common with each wheel containing a sensor that reads the pressure, sends it to the vehicle’s computer, which then determines if it’s safe or under/overinflated and thus tripping the tire warning light.
An indirect system works by using a wheel’s speed sensor – already in use for the traction control and anti-lock braking (ABS) system – to determine the same outcome. If a wheel is spinning more quickly than the others, it’s underinflated. If it’s spinning slower, it’s overinflated.
In some cars, it’s possible to see each individual tire’s pressure via a direct TPMS, but since indirect TPMS doesn’t measure pressure, it will only trip a light in the instrument cluster. Newer Honda and Volkswagen Group vehicles utilize this type of system more often than other manufacturers. Since the direct system requires sensors to be on each wheel, a wireless signal is required to communicate with the computer, transmitting, along with the data, a unique ID that can be picked up by a radio receiver, making it the system in question for the study.
IMEDA Research Method
To produce the study, researchers built small radio receivers and placed them along roads and parking lots to intercept vehicles’ TPMS signals. Over the 10-week period used to gather data for the study, the team harvested six million messages from tire pressure sensors from 20,000 individual vehicles. The cost to produce each receiver was less than $100, and they could pick up signals from moving vehicles from upwards of 50-yards away – even when placed inside buildings or other hidden spots.
Because some cars have a TPMS which displays the readings, pressure readings are picked up as well, which the researchers determined could hint at what type of vehicle is being tracked and if it’s carrying a light or heavy load, something they claim could be used for surveillance purposes. Part of their final conclusion was that tracking via a vehicle’s TPMS is “cheaper, harder to detect, and more difficult to avoid than camera-based surveillance,” determining it’s a stronger privacy threat.
“Our results show that these tire sensor signals can be used to follow vehicles and learn their movement patterns. This means a network of inexpensive wireless receivers could quietly monitor the patterns of cars in real-world environments. Such information could reveal daily routines, such as work arrival times or travel habits.”
– Domenico Giustiniano, research Professor at IMDEA Networks Institute
Are There TPMS Tracking Countermeasures?
Unfortunately, there isn’t much the typical consumer can do to throw off trackers using this method of surveillance, but what researchers offered as a solution to this problem could offer some respite. One of the participating researchers, Dr Yago Lizarribar, hopes that manufacturers recognize the system’s lack of security and seek to change it in the future. This is something that can be done, albeit not cheaply, on the OEM side of things.
The signal sent by the TPMS sensors can be encrypted or at least require authentication, but no vehicle cybersecurity regulations contain such language. The reasoning behind why it isn’t is due to the ease of programming new sensors when they break, and additional costs to refine the system. The batteries which power each sensor can last just over a decade, with the average lifespan of a sensor around seven years, according to TPMS Direct. Adding security measures by way of signal encryption requires more power and drains the battery faster.
Fortunately, this type of surveillance is tedious to monitor or refine and use for any mildly nefarious acts perpetrated by local riffraff. The researchers disclosed that this kind of surveillance is only dangerous in large quantities given its nature of revealing more about what’s being monitored the longer it’s studied.
Read the full article on CarBuzz
This article originally appeared on CarBuzz and is republished here with permission.
