TPMS signals: car tracking without GPS

Tracking Vehicles via Passive TPMS Signals: A Privacy Threat Analysis

Signals from direct Tire Pressure Monitoring Systems (dTPMS) are transmitted in the clear with fixed, unique tire IDs. Deploying a network of inexpensive SDR receivers along roads allows for the collection of millions of messages, enabling the detection of vehicle presence, type, load, and driving style. Over a 10-week experiment, over 6 million transmissions from 20,000 vehicles were recorded, including 12 verified ones. The cost of a single receiver is about $100, making this threat highly accessible.

Structure and Operating Modes of dTPMS

dTPMS differ from indirect iTPMS by directly measuring pressure and temperature via sensors inside the tires. Transmissions occur at 315/433 MHz with ASK/FSK modulation; packet length is 100 bits at 20 Kbit/s (5 ms per transmission). The packet includes:

• A preamble (0x55555556 or 0xaaaaaaa9);
• Sensor ID (24–32 bits);
• Temperature and pressure;
• Flags (battery status);
• CRC.

Activation: while moving — intervals of 30–120 seconds, or via an LF pulse (125 kHz). Modes (per Schrader): driving (1 message/7.5 s), rest (1/hour), identification. Some systems transmit continuously, even when parked.

Threat Model: A Network of SDR Receivers

Passive surveillance is built using RTL-SDR + Raspberry Pi. Receivers capture signals within a radius of up to 40 meters, with data aggregated for tracking. Algorithms match the IDs of four tires to a single vehicle based on temporal patterns, RSSI, and parameters (pressure, temperature).

Key extractable data:

• Presence and Routes: A sequence of detections across the receiver network builds a track.
• Vehicle Type: Clustering IDs by brand/model (proprietary protocols).
• Load: Pressure variations correlate with weight.
• Driving Style: Transmission frequency, accelerations inferred from RSSI deltas and motion sensor data.

On 12 test vehicles, tire matching accuracy was 95%+, and movement profiles were reconstructed with an error of <5%.

Signal Analysis Methods

Collection: 5 RTL-SDR units on roads, 10 weeks, >6 million packets. Processing:

• Demodulation and decoding of preambles/IDs;
• Clustering by ID (fixed for the tire's lifespan);
• Matching tires to vehicles: time window + geo-context + RSSI patterns;
• Profiling: ML models on features (transmission intervals, pressure deltas, temperature).

Example of a decoded packet (typical for Schrader):

Preamble: 0x55555556
ID: 0x1A2B3C4D
Pressure: 2.2 bar
Temperature: 25°C
Battery: OK
CRC: 0xE7

Deployment is scalable: thousands of vehicles can be tracked automatically.

Key Takeaways

• Fixed IDs transmitted in the clear enable permanent tracking without owner consent;
• A network of 5 receivers for $500 can cover an area, capturing 20k+ vehicles;
• Extracted data includes not just routes, but also load and driving style from passive metrics;
• The lack of encryption in dTPMS is overlooked by regulations (UNECE R155);
• Recommendation: ID rotation, encryption, and frequency hopping for new systems.

— Editorial Team