TPMS Flaw in Toyota, Mercedes, and Other Major Brands Enables Covert Vehicle Tracking

Tire Pressure Monitoring Systems (TPMS) in various automobile brands such as Toyota and Mercedes are capable of broadcasting radio signals that could be utilized as vehicle-tracking tools. Recent research indicates that these safety messages can be collected extensively, enabling the mapping of vehicle movements using affordable hardware.

Modern vehicles utilize direct TPMS sensors within each wheel to wirelessly transmit tire pressure and temperature data to the car's electronic control unit. In brands including Toyota, Mercedes, Renault, and Hyundai, these sensors emit unencrypted messages at 315 or 433 MHz, incorporating a fixed, unique identifier that seldom changes. As the messages are transmitted in clear text, any nearby receiver can intercept them without interacting with the vehicle.

Researchers from IMDEA Networks and partners conducted a study using a network of five low-cost software-defined radios positioned along roads and parking areas over ten weeks. With equipment costing approximately 100 dollars per receiver, they gathered over six million TPMS messages from more than 20,000 vehicles, including 12 cars with verified tire IDs. TPMS signals were successfully received at distances exceeding 50 meters, often through walls and without line of sight, facilitating the concealment of receivers in buildings or roadside infrastructure.

Each tire in a vehicle sends periodic messages while the vehicle is in motion, and in some brands, even when parked. Malicious users could establish a network of spectrum devices across a city to track vehicles and infer behavioral patterns.

By analyzing the four tire IDs that appear together within short timeframes, researchers could reliably attribute them to a unique vehicle "fingerprint." Utilizing similarity metrics such as the Jaccard index, they could match tire IDs to vehicles, reconstructing driving and parking patterns over time. From these patterns, observers could infer sensitive information, including:

Daily work schedules and remote work days based on vehicle presence and absence at specific locations. Lunch breaks, evening classes, or business trips, indicated by deviations from routine movements. Whether a vehicle belongs to an internal employee, contractor, or occasional visitor, based on visit frequency and duration.

The pressure values themselves may also reveal information; higher pressures can suggest heavier vehicles or loaded trucks, indicating vehicle type and cargo state. Combined with cameras or address knowledge, a TPMS ID could be linked to a specific individual, enabling tracking wherever receivers are deployed.

Major manufacturers, including Toyota, Renault, Hyundai, and Mercedes, commonly employ direct TPMS designs that follow this vulnerable pattern of unencrypted wireless beacons with fixed IDs. In many instances, sensors continue transmitting when the vehicle is parked, extending the potential tracking window.

Unlike smartphones, drivers cannot disable TPMS as the system is legally required in regions such as the US and EU, with disabling it potentially triggering warning lights or inspection failures.

Global regulations like UN Regulation No. 155 mandate carmakers to implement a cybersecurity management system, but current rules do not explicitly address TPMS privacy or require encryption for these radio messages. Consequently, a substantial number of vehicles on the road today are broadcasting trackable identifiers without clear regulatory pressure on manufacturers to address the issue.

Challenges in Detection and Prevention

TPMS transmissions are infrequent, and the probability of capturing all four sensors from a passing vehicle decreases with speed. TPMS-based tracking is particularly concerning because it is:

Passive: receivers only listen, so victims receive no alerts, and logs remain empty. Cost-effective and scalable: a small city could be monitored using dozens of 100-dollar radio nodes and free decoding software. Persistent: sensor IDs are hardware-coded and long-lasting, ensuring the same "fingerprint" follows the vehicle for years.

Currently, drivers have limited defenses beyond replacing sensors or wheels, which is costly and does not guarantee privacy if new IDs are collected again. Researchers advocate for carmakers to adopt encrypted, rotating identifiers for TPMS, and for regulators to include these systems in automotive cybersecurity standards. Until such measures are implemented, tire pressure systems in brands like Toyota and Mercedes remain a potential tracking channel.

Based on reporting by GBHackers.