TPMS in Toyota, Mercedes, Hyundai Enables Silent Car Tracking

Tire Pressure Monitoring Systems in Toyota, Mercedes, Hyundai, and Renault cars send unencrypted data. This lets anyone with cheap receivers track vehicles and drivers passively. Researchers captured over 6 million signals from 20,000 cars in a 10-week study using $100 devices.

Direct TPMS sensors sit inside tires. They broadcast pressure, temperature, battery level, and a fixed 24-32 bit ID in cleartext. Frequencies hit 315 or 433 MHz at low power. No encryption protects these signals, unlike indirect systems in Volkswagen cars.

Signals travel up to 55 meters, even around corners. Transmissions happen every 30-120 seconds while driving. Some brands ping hourly when parked. Toyota sensors run nonstop, creating easy digital fingerprints for anyone listening.

Researchers from IMDEA Networks used RTL-SDR receivers on Raspberry Pi units. They covered 10,000 square meters near roads. Open-source rtl_433 decoded the data into databases. Tests at 50 km/h proved reliable omnidirectional capture.

Affected Manufacturers

These systems became mandatory for safety from 2007-2012. UN Regulation 155 covers car cybersecurity but skips TPMS. Gaps leave privacy exposed despite global rules.

Attackers match tires to cars using Jaccard similarity on signal clusters. Coverage jumps from 40% with one ID to nearly 100% with four. Patterns reveal work hours, remote days, lunch spots, or trips.

Tire pressure hints at vehicle type or load. Cameras link it to owners. Burglars spot empty homes. Firms surveil employees. Spoofing jams signals for chaos.

Tracking Techniques

• Jaccard index clusters co-occurring IDs: J(A,B) = |A ∩ B| / |A ∪ B|.
• Temporal analysis spots routines like 8 AM arrivals.
• Pressure trends track maintenance or weight changes.
• Scale to city-wide surveillance without plates.

Newer Cyber Tyre from Pirelli uses BLE. It remains eavesdroppable and costs extra. Fixes need ID encryption, rotation, or silent modes. Regulations like EU 2019/2144 must add TPMS rules.

Drivers lack disable switches. Trigger tools read IDs for checks. Aftermarket encrypted sensors exist but prove nothing yet.

FAQ