Vehicle Tire Pressure Sensors Enable Silent Tracking (darkreading.com)
- Reference: 0180906034
- News link: https://tech.slashdot.org/story/26/03/04/1856240/vehicle-tire-pressure-sensors-enable-silent-tracking
- Source link: https://www.darkreading.com/ics-ot-security/tire-pressure-sensors-silent-tracking
> Dark Reading [2]reports that a team of researchers has determined that signals from tire pressure monitoring systems (TPMSs), required in U.S. cars since 2007, can be [3]used to track the presence, type, weight, and driving pattern of vehicles . The researchers [4]report (PDF) that the [5]TPMS data , which includes unique sensor IDs, is sent in clear text without authentication and can be intercepted 40-50 meters from a vehicle using devices costing $100.
"Researchers have discovered that most TPMS sensors transmit a unique identifier in clear text that never changes during the lifetime of the tire," the researchers pointed out. "This unencrypted wireless communication makes the signals susceptible to eavesdropping and potential tracking by any third party in proximity to the car."
[1] https://slashdot.org/~linuxwrangler
[2] https://www.darkreading.com/ics-ot-security/tire-pressure-sensors-silent-tracking
[3] https://www.darkreading.com/ics-ot-security/tire-pressure-sensors-silent-tracking
[4] https://dspace.networks.imdea.org/bitstream/handle/20.500.12761/2011/Can%E2%80%99t%20Hide%20Your%20Stride_Inferring%20Car%20Movement.pdf?sequence=1&isAllowed=y
[5] https://en.wikipedia.org/wiki/Tire-pressure_monitoring_system
Well (Score:2)
There is an obvious way to remove them if you don't want to be tracked. But I guess we need a TPMv2 with encryption
Re: (Score:2)
> There is an obvious way to remove them if you don't want to be tracked. ...
More obvious way, wrap your tires in tin foil. :-)
Re: (Score:2)
I was thinking airless tires \_()_/
To what end? (Score:1)
If you're within 40 or 50 meters of the vehicle, aren't you *already* tracking it?
Re:To what end? (Score:4, Insightful)
I think the idea is that you can install sensors around town and track the movements of a vehicle, much like a flock camera. There's also been rumors for decades that car tires themselves have RFID tags embedded in the rubber and the magnetic loop sensors at traffic lights can read these RFID tags to track cars as well.
Re: To what end? (Score:2)
I think your tin foil hat needs polishing. Any RFID tags in tyres would be easy to find with a scanner unless you think a gubbermint is installing special mil spec ones for ... whatever.
Re: To what end? (Score:2)
Tires absolutely do typically contain RFID tags. So do lots of other things these days. Just the clothes you are wearing may constitute a tag cloud sufficient to identify you.
On the flip... No the TPMS doesn't tell what the weight of your vehicle is. Tire pressure can be set incorrectly.
Re: (Score:2, Insightful)
No, you are not. I'm within 50 meters of countless cars every day yet I'm not tracking any of them.
However, a better point is to what end? The information itself is worthless, only associating it with a traveling vehicle to track the vehicle could be, yet there are other ways to track vehicles. And is reading tire pressures from remarkably far away and efficient way to implement tracking in volume? Seems like a crappy way to do something that is otherwise not hard, not to mention that while there may be
Re: (Score:2)
I'm not tracking any of them.
That's what they want you to think.
Re: To what end? (Score:2)
This. Wtf use is a tracker when you have to track the vehicle manually a few car lengths behind to stay in contact with the devices!
Re: To what end? (Score:2)
The usual theory is that there are sensors placed in the road or just at intersections. I know of no smoking gun but it's absolutely possible.
Interesting, but not much of a threat (Score:4, Insightful)
It is an interesting paper and it is clever. But the threat of someone knowing my vehicle tire pressure (and thereby inferring weight) etc. is not something I'd worry about. After all, one could discretely check the tire pressure of my parked car without me knowing. And from the tread pattern, could tell a lot about driving habits. And if they wanted to track my vehicle around town, they can look at the license plate.
In other words, this can already be easily ascertained. But still cool paper. I don't think auto manufacturers will be moving to encrypted tire sensors anytime soon.
Re: (Score:2)
"I don't think auto manufacturers will be moving to encrypted tire sensors anytime soon."
They are more likely to transition cars to clean coal.
Re: (Score:2)
Then they'll mandate taggants in the coal.
Re: (Score:1)
> the TPMS data, which includes unique sensor IDs, is sent in clear text without authentication and can be intercepted 40-50 meters from a vehicle using devices costing $100
A mesh of sensors can track and collate the driving patterns of all cars in an area without obvious cameras.
Re: (Score:3)
It's illegal to change your license plate. It's not illegal to scan someone's sensor ids, clone them on your vehicle, then drive by one of these 3rd party sensors while committing a crime (well the crime part is illegal). The point is someone can steal your 'car identify' by doing this. Today's that's not too useful. Maybe tomorrow it will be. Perhaps there's a push back against cameras and cities switch to tire tracking instead. It'll matter then. Or perhaps these ids are already being tracked into
Re: (Score:2)
> It is an interesting paper and it is clever. But the threat of someone knowing my vehicle tire pressure (and thereby inferring weight) etc. is not something I'd worry about. After all, one could discretely check the tire pressure of my parked car without me knowing. And from the tread pattern, could tell a lot about driving habits. And if they wanted to track my vehicle around town, they can look at the license plate.
That's kind of true, but not entirely. You're assuming authorized government surveillance. For unauthorized surveillance, there are potentially significant differences.
Assuming the people doing the tracking don't have access to DOT cameras, they would need to add a bunch of cameras in various places, and that means putting them in places where it would be obvious that something had been added. After all, if you can't see the camera, it can't see your license plate. So the risk of discovery is high, and
Re: (Score:2)
> By contrast, an antenna could be located anywhere within several feet of the road
Just because the speed camera your local government puts up is in a massive box doesn't mean cameras in general need to be. There's no finite difference here. If someone installed a camera on the side of a street and made an attempt to hide it you won't find it.
Like seriously hidden cameras have been a thing back in the days when we still used words like "Pentium" and through the world would end at midnight 1999, and they've only gotten smaller since then.
Re: (Score:2)
Tell this to the people who put those shields on their license plates to foil flock cameras.
It's like browser fingerprinting. Your car is emitting all kinds of signals, taken together, it can form a fingerprint. That fingerprint allows tracking. The only remaining thing is to tie the fingerprint to a person, which is easy enough in the case of a car due to a perfectly visible (by law) license plate.
But, really, the best method of tracking you is already in your pocket.
Not me! (Score:2)
I've got the cheap version that uses the anti-lock brake optical sensors to try to guess if the tire is flat. No RF sensors required.
I get a false positive and have to recalibrate a couple of times per year, but that's a small price to pay to make sure nobody is tracking me!
(Now I just have to figure out how to work around having those big high-contrast unique ID numbers screwed onto my front and rear bumpers.)
Re: (Score:2)
> Now I just have to figure out how to work around having those big high-contrast unique ID numbers screwed onto my front and rear bumpers.
Check out some Sovereign Citizen content, they've got all sorts of ways to deal with those. None have worked so far, but it's worth the entertainment.
Ever feel "safety" is a Trojan Horse? (Score:2)
Ever feel "safety" is a Trojan Horse, used by governments to curtail your rights, track you, and / or just make your life a bit more complicated?
"it's for your own good.'
That's what my "mother" used to say before she'd make with the belt and try to "correct" me.
Governments' the same way. "It's for your own good" while over-complicating your car and simultaneously draining your wallet. And now, with added privacy loss for your embiggenment!
We need a Restoration. A movement to lead us back to Common Sense.
Re: (Score:2)
Your next car will have a remote kill switch, and if your passenger has alcohol on their breath, it will refuse to start.
Lifetime of the tire, or lifetime of the sensor? (Score:1)
The article says that the id number never changes during the lifetime of the tire.
Do they mean the tire sensor or the actual tire? I can't see how the tire, the rubber-and-metal thing that wraps around the rim, would have a readable id number.
But I don't know how these sensors work so maybe the tires do have some kind of a unique serial number that's involved here.
Or not?
Re: (Score:2)
It's the sensor that has the unique ID. Tires might have a serial number as well. But they aren't replaced along with their TPS. So unless your tire has some sort of inventory control chip in it*, it's not readale as you drive by.
*The presence of such inventory tracking RFID makes the whole TPMS snooping a moot point. They can track you based upon the chip in your Fruit of the Looms.
Re: (Score:2)
Lifetime of the sensor. The sensor can be embedded in any number of tires (mine are swapped back and forth from summer to winter tires twice a year).
Remember, they have a lifespan though - about 10 years, give or take. Then you need a new set of sensors as the batteries are not (apparently) replaceable.
Solutions anyone? (Score:1)
Dial down the power to shorten the sniffing range?
Randomize the "ID" code every time the car starts or every time the wheel is idle for 10 minutes?
Enable some simple encryption?
Each of these has some costs.
Re: (Score:2)
Not a lot of great solutions. Reducing the power a lot is probably the best one. Then the car needs a receiver near each wheel to get the data. Some already have this, that's how they magically figure out which tire ended up where when you do a rotation. Randomizing the IDs could work in this scenario, too, but then the car has to relearn the IDs every time they rotate, which could be error prone.
Anything involving fancy crypto is going to take a bite out of the sensor battery life, and require them to
The jokes on you (Score:2)
The batteries ran out on my tire pressure sensors years ago. I have to check the pressure manually, as nature intended.
Re: (Score:2)
I was going to say the same thing. Mine have gotten so weak that once the temperature drops below about 50 F (10 C) they stop being read, and that cutoff temperature has been rising for the last few years. I told my dealer, who has otherwise provided excellent service, that the batteries in them were getting weak and I'd like to have them serviced (I assume they replace the whole sensor, and not just the batteries), and I intentionally took it to them on a cold day to be sure the TPMS light was on. But a
Come on, guys... (Score:1)
Just roll with it!
Required? (Score:2)
The article states these are required, but some cars (like mine) only use "indirect" sensing, meaning there are no actual sensors in the tire. The onboard computer just uses speed and rotation data from the ABS system to detect pressure changes. So before you worry about this, find out if your car actually has them.
BTDT (Score:3)
My Home Assistant has an RTL-433 radio and logs every tire that passes within range while transmitting. I can match that to camera feeds and get the schedules of anyone who uses my residential street.
Mainly I use it to notify me when one of the family cars arrives home, but the other uses are trivial and I've played around with them.
old news... (Score:2)
This has been an know issues/concern going back to at least 2014. People were talking about it at security conferences back then.
Re: (Score:2)
> This has been an know issues/concern going back to at least 2014. People were talking about it at security conferences back then.
Yeah, I was gonna say, no s**t, Sherlock. I thought this was common knowledge. That's how the car knows which tire is low. Otherwise, it would have to guess.
In an ideal world, it wouldn't work that way. You'd do a pairing handshake at the beginning, and the car and the TPMS would do an elliptic-curve Diffie-Hellman key exchange or similar, and then they would use that symmetrical key for all future communication. But the extra crypto would mean more power consumption, both of which are problematic. An
Re: (Score:2)
I think that there is another method than a wireless sensor.
For example, I believe that my wife's 2015 Jetta (low end model) uses torque somehow. In her car, once the low tire pressure alerts is tripped, you have to manually re-set the sensor even after filling the tire back up to the recommended level.
Re: (Score:3)
What you describe is called indirect TPMS. It works by measuring the differences in speed between wheels through the ABS wheel speed sensors, and triggers if it detects an outlier. It doesn't require an additional sensor inside each wheel, instead using existing sensors and some arithmetic, so it costs less, but cannot indicate the pressure for each individual wheel, plus it requires the reset procedure that you referenced when new tires are installed or after you've corrected whatever caused it to trigger.
Re: (Score:2)
Some vehicles can sense a low tire by comparing the revolutions per mile of each. Measured with the anti-lock sensor (wired) and integrated over a long period of time. It's not very accurate and it doesn't respond quickly to a developing flat. But it works with no in-tire sensor.
Re: (Score:2)
I think you're hiding the wrong information here. The concern is tracking, not third parties being able to find out if you have a flat. (How would they use that information? Run behind you and try to sell you a new tire? Not to mention if you have a severe enough flat it's pretty easy for someone to see it visually!) Your proposal, in addition to the issues you yourself raise, would add to the unique information being transmitted by each tire, not subtract.
Re: (Score:2)
> I think you're hiding the wrong information here. The concern is tracking, not third parties being able to find out if you have a flat. (How would they use that information? Run behind you and try to sell you a new tire? Not to mention if you have a severe enough flat it's pretty easy for someone to see it visually!) Your proposal, in addition to the issues you yourself raise, would add to the unique information being transmitted by each tire, not subtract.
I think you're misunderstanding what we mean by tracking here. The signal from TPMS isn't a continuous signal that you could track, for example, with a directional antenna from a dirigible. It's a periodic burst that happens every 30 to 120 seconds. Even with a decent number of monitoring stations, you won't have an exact path for a vehicle, because they could make multiple turns between detection events, and you may not have a monitoring station close enough to detect every event. It would mostly be us