Today I learned that nearly every modern car has four tire pressure sensors that broadcast a unique ID in clear text, so a basic Raspberry Pi scanner can track when your car is nearby.
-
Today I learned that nearly every modern car has four tire pressure sensors that broadcast a unique ID in clear text, so a basic Raspberry Pi scanner can track when your car is nearby.
Your car’s tire sensors could be used to track you - IMDEA Networks
Researchers at IMDEA Networks Institute, together with European partners, have found that tire pressure sensors in modern cars can unintentionally expose drivers to tracking. Over a ten-week study, they collected signals from more than 20,000 vehicles, revealing a hidden privacy risk and highlighting the need for stronger security measures in future vehicle sensor systems. Most...
IMDEA Networks (networks.imdea.org)
@mikesax wow. On one hand, I get why they'd need unique IDs and I could see it being unencrypted just for cost.
But up to 50 meters away? That's just absurd to me.
-
@mikesax wow. On one hand, I get why they'd need unique IDs and I could see it being unencrypted just for cost.
But up to 50 meters away? That's just absurd to me.
-
R relay@relay.an.exchange shared this topic
-
Today I learned that nearly every modern car has four tire pressure sensors that broadcast a unique ID in clear text, so a basic Raspberry Pi scanner can track when your car is nearby.
Your car’s tire sensors could be used to track you - IMDEA Networks
Researchers at IMDEA Networks Institute, together with European partners, have found that tire pressure sensors in modern cars can unintentionally expose drivers to tracking. Over a ten-week study, they collected signals from more than 20,000 vehicles, revealing a hidden privacy risk and highlighting the need for stronger security measures in future vehicle sensor systems. Most...
IMDEA Networks (networks.imdea.org)
@mikesax some phones also broadcast a unique WiFi MAC address that anyone could use to track you (some phones rotate random MAC addresses for this reason; only governments telecoms, and big tech should be able to track you). I think most phones periodically broadcast the SSIDs you normally connect to, so anyone could record those, go to wigle.net and try to figure out where you live and work.
-
Today I learned that nearly every modern car has four tire pressure sensors that broadcast a unique ID in clear text, so a basic Raspberry Pi scanner can track when your car is nearby.
Your car’s tire sensors could be used to track you - IMDEA Networks
Researchers at IMDEA Networks Institute, together with European partners, have found that tire pressure sensors in modern cars can unintentionally expose drivers to tracking. Over a ten-week study, they collected signals from more than 20,000 vehicles, revealing a hidden privacy risk and highlighting the need for stronger security measures in future vehicle sensor systems. Most...
IMDEA Networks (networks.imdea.org)
@mikesax Christ on a bike (without tire sensors)
-
Today I learned that nearly every modern car has four tire pressure sensors that broadcast a unique ID in clear text, so a basic Raspberry Pi scanner can track when your car is nearby.
Your car’s tire sensors could be used to track you - IMDEA Networks
Researchers at IMDEA Networks Institute, together with European partners, have found that tire pressure sensors in modern cars can unintentionally expose drivers to tracking. Over a ten-week study, they collected signals from more than 20,000 vehicles, revealing a hidden privacy risk and highlighting the need for stronger security measures in future vehicle sensor systems. Most...
IMDEA Networks (networks.imdea.org)
@mikesax Every single part of modern cars is a privacy/security nightmare.
-
Holy shit, I knew this felt familiar.
Reijo Pitkänen (@reijomancer@defcon.social)
While filling up my tires, I thought to myself, "Wouldn't it be funny if you could track people with their TPMS noise? It's probably not obfuscated or rotated in any way like Bluetooth or MAC addresses, and everything with tires after 2008 has four to 12 of these things constantly broadcasting some sort of ID in addition to it's environmental data." Once again, some had to have written a Flipper zero app for this, right? Alternative use: automatic gate opener or a presence sensor for a vehicle or trailer.
DEF CON Social (defcon.social)
-
@mikesax wow. On one hand, I get why they'd need unique IDs and I could see it being unencrypted just for cost.
But up to 50 meters away? That's just absurd to me.
Well 50m might be the viable range when they're new. But each wheel unit is powered by a single coin cell battery which is functionally non-replaceable. The range degrades over time with the battery power until the vehicle can not receive from the wheel sensor anymore, at which time the entire wheel sensor is replaced.
Also while you might pick it up from 50m away in open air, the actual use case involves the vehicle reading the signal through multiple layers of steel and/or aluminum.
-
Today I learned that nearly every modern car has four tire pressure sensors that broadcast a unique ID in clear text, so a basic Raspberry Pi scanner can track when your car is nearby.
Your car’s tire sensors could be used to track you - IMDEA Networks
Researchers at IMDEA Networks Institute, together with European partners, have found that tire pressure sensors in modern cars can unintentionally expose drivers to tracking. Over a ten-week study, they collected signals from more than 20,000 vehicles, revealing a hidden privacy risk and highlighting the need for stronger security measures in future vehicle sensor systems. Most...
IMDEA Networks (networks.imdea.org)
@mikesax 1. Homeassistant automations.
2. Leave a scanner to local law enforcement HQ for a week and then bring the scanner back and alert if any learned IDs show up. -
Today I learned that nearly every modern car has four tire pressure sensors that broadcast a unique ID in clear text, so a basic Raspberry Pi scanner can track when your car is nearby.
Your car’s tire sensors could be used to track you - IMDEA Networks
Researchers at IMDEA Networks Institute, together with European partners, have found that tire pressure sensors in modern cars can unintentionally expose drivers to tracking. Over a ten-week study, they collected signals from more than 20,000 vehicles, revealing a hidden privacy risk and highlighting the need for stronger security measures in future vehicle sensor systems. Most...
IMDEA Networks (networks.imdea.org)
@mikesax not all cars use 433 MHz sensors. Our Volkswagen uses the wheel speed sensors to calculate minute speed differences. But is on all the time
I used rtl_433 to capture temperature sensor data at home. My home assistant got flooded with new sensors, thousands of them, because it wasn't possible to filter stuff before they were discovered by home assistant as new sensors. All of these were tire pressure sensors of cars driving by.
-
Today I learned that nearly every modern car has four tire pressure sensors that broadcast a unique ID in clear text, so a basic Raspberry Pi scanner can track when your car is nearby.
Your car’s tire sensors could be used to track you - IMDEA Networks
Researchers at IMDEA Networks Institute, together with European partners, have found that tire pressure sensors in modern cars can unintentionally expose drivers to tracking. Over a ten-week study, they collected signals from more than 20,000 vehicles, revealing a hidden privacy risk and highlighting the need for stronger security measures in future vehicle sensor systems. Most...
IMDEA Networks (networks.imdea.org)
@mikesax I had a load of fun a few years ago with a cheap 433 ariel. I love next to a busy road
-
Today I learned that nearly every modern car has four tire pressure sensors that broadcast a unique ID in clear text, so a basic Raspberry Pi scanner can track when your car is nearby.
Your car’s tire sensors could be used to track you - IMDEA Networks
Researchers at IMDEA Networks Institute, together with European partners, have found that tire pressure sensors in modern cars can unintentionally expose drivers to tracking. Over a ten-week study, they collected signals from more than 20,000 vehicles, revealing a hidden privacy risk and highlighting the need for stronger security measures in future vehicle sensor systems. Most...
IMDEA Networks (networks.imdea.org)
@mikesax oh seriously??
-
Well 50m might be the viable range when they're new. But each wheel unit is powered by a single coin cell battery which is functionally non-replaceable. The range degrades over time with the battery power until the vehicle can not receive from the wheel sensor anymore, at which time the entire wheel sensor is replaced.
Also while you might pick it up from 50m away in open air, the actual use case involves the vehicle reading the signal through multiple layers of steel and/or aluminum.
@lackthereof @wwahammy on the other hand these 50m are absolutely dwarfed by the range at which cars broadcast some other of their IDs electromagnetically.
Specially in the "couple of hundreds nanometers" range of the EM spectrum.
Like number plates.Note: I am not saying that car manufacturers don't need to follow best practices on each electronic gizmo they add.
... -
@lackthereof @wwahammy on the other hand these 50m are absolutely dwarfed by the range at which cars broadcast some other of their IDs electromagnetically.
Specially in the "couple of hundreds nanometers" range of the EM spectrum.
Like number plates.Note: I am not saying that car manufacturers don't need to follow best practices on each electronic gizmo they add.
...@lackthereof @wwahammy ...
I am merely pointing out that cars are trackable by design and such blunders just save money on needing to add a good camera (and bit more CPU for plate number recognition) to a tracker design.(and a Flipper zero is a bit more discrete that a Pi5 + good camera pointed at a street)
-
Oh, they exist for bikes too, though it's not that widely spread:
TyreWiz - Quarq
Nothing impacts your ride comfort like tire pressure. TyreWiz is a lightweight, durable device that sends tire pressure readings right to your cycling computer.
(www.sram.com)
-
Today I learned that nearly every modern car has four tire pressure sensors that broadcast a unique ID in clear text, so a basic Raspberry Pi scanner can track when your car is nearby.
Your car’s tire sensors could be used to track you - IMDEA Networks
Researchers at IMDEA Networks Institute, together with European partners, have found that tire pressure sensors in modern cars can unintentionally expose drivers to tracking. Over a ten-week study, they collected signals from more than 20,000 vehicles, revealing a hidden privacy risk and highlighting the need for stronger security measures in future vehicle sensor systems. Most...
IMDEA Networks (networks.imdea.org)
@mikesax Yes, and with AirSpy dongle and proper software you can keep track of what's moving around you.
Furthermore, you can even know the right frequency the garage door opener operates at.
Of course, what I've told you should never be used for commiting crimal acts.
Good ethical hacking required here. -
@mikesax not all cars use 433 MHz sensors. Our Volkswagen uses the wheel speed sensors to calculate minute speed differences. But is on all the time
I used rtl_433 to capture temperature sensor data at home. My home assistant got flooded with new sensors, thousands of them, because it wasn't possible to filter stuff before they were discovered by home assistant as new sensors. All of these were tire pressure sensors of cars driving by.
> Our Volkswagen uses the wheel speed sensors to calculate minute speed differences.
Yep, this is called indirect TPMS. We have that on our Volvo XC40 too. It doesn't require special sensors, as it uses the wheel rotation-speed sensors already in place as part of the ABS system: if the left and the right wheel don't rotate at the same angular rate, that means that the car is slipping (-> ABS) or one of the tyres has a smaller radius due to underpressure (-> TPMS).
-
Today I learned that nearly every modern car has four tire pressure sensors that broadcast a unique ID in clear text, so a basic Raspberry Pi scanner can track when your car is nearby.
Your car’s tire sensors could be used to track you - IMDEA Networks
Researchers at IMDEA Networks Institute, together with European partners, have found that tire pressure sensors in modern cars can unintentionally expose drivers to tracking. Over a ten-week study, they collected signals from more than 20,000 vehicles, revealing a hidden privacy risk and highlighting the need for stronger security measures in future vehicle sensor systems. Most...
IMDEA Networks (networks.imdea.org)
@mikesax Your phone and your headset and your other Bluetooth gadgets also do broadcast unique IDs that definitely allow to track you.
-
@radio_alelopatia @mikesax doesn't have that.. yet!
-
@lackthereof @wwahammy ...
I am merely pointing out that cars are trackable by design and such blunders just save money on needing to add a good camera (and bit more CPU for plate number recognition) to a tracker design.(and a Flipper zero is a bit more discrete that a Pi5 + good camera pointed at a street)
@dryak @lackthereof @wwahammy You have to get the IDs first in order to track the cars. TPMS devices are part of the tyre valve and its easy to just swap them out. Just changing the wheels does that. So its not reliable tracking. One of the standard functions of a decent code reader is updating pairing the TPMS devices to the car. I’ve never worried about them because I usually have my phone in the car and they can track that if they want!
-
Today I learned that nearly every modern car has four tire pressure sensors that broadcast a unique ID in clear text, so a basic Raspberry Pi scanner can track when your car is nearby.
Your car’s tire sensors could be used to track you - IMDEA Networks
Researchers at IMDEA Networks Institute, together with European partners, have found that tire pressure sensors in modern cars can unintentionally expose drivers to tracking. Over a ten-week study, they collected signals from more than 20,000 vehicles, revealing a hidden privacy risk and highlighting the need for stronger security measures in future vehicle sensor systems. Most...
IMDEA Networks (networks.imdea.org)
@mikesax @etchedpixels That 50 metre is totally ideal circumstances. TPMS systems typically don’t work more than a couple of metres. The sensor is behind the wheel arch trim so they don’t have to be read more than a few cm away. Some only work when the wheel moves. The movement of the wheel induces the current used to transmit the ID and tyre pressure. They have to he paired with the car and are relatively easily replaceable. And there are a lot easier ways to track a car. Also you are only finding out about this now? My 12 year old mini has it!
