Overview
- An IMDEA-led team passively logged more than 6 million TPMS messages from about 20,000 vehicles over 10 weeks using five low-cost receivers.
- TPMS sensors transmit fixed identifiers in clear text that can persist for the life of the tire, enabling long-term reidentification of specific vehicles.
- Researchers captured signals from moving cars beyond 50 meters and through walls, enabling tracking without line-of-sight.
- By correlating signals from all four wheels, the study reconstructed arrivals and departures and inferred routines and attributes such as vehicle type or load.
- The authors call on automakers and regulators to add protections, warning that attackers could combine passive tracking with spoofed flat-tire alerts or targeted surveillance.