Most modern cars are equipped with a Tire Pressure Monitoring System (TPMS), which has been mandatory in many countries since the late 2000s due to its contribution to road safety. This system uses small sensors on each wheel to monitor pressure and sends wireless signals to the vehicle's computer to warn if a tire is underinflated. However, research has discovered that these sensors also transmit a unique identification (ID) number in clear, unencrypted wireless signals. This means that anyone nearby with a simple radio receiver can capture the signal and later identify the same vehicle. Most current vehicle tracking uses cameras, which require a clear, direct line of sight.
TPMS tracking is different: the sensors automatically send out radio signals that pass through walls and other vehicles, allowing small, hidden wireless receivers to capture them undetected. Because each sensor emits a fixed, unique ID, the same car can be recognized repeatedly without needing to read the license plate. This makes TPMS-based tracking cheaper and harder to both detect and prevent than camera-based surveillance, posing a greater threat to privacy.
To assess the severity of this risk, researchers built a network of low-cost radio receivers, placed near roads and parking areas. Each receiver costs just $100. In total, they collected more than six million sensor messages from over 20,000 cars.
"Our results demonstrate that these signals can be used to track vehicles and understand their movement patterns," says Domenico Giustiniano, Research Professor at IMDEA Networks. "This means that a network of inexpensive wireless receivers could discreetly monitor traffic in real-world environments. Such information could reveal daily routines, such as arrival times at work or travel habits.".
The researchers also developed methods to pair the signals from all four tires of the same car. This increased the accuracy of identifying specific vehicles arriving, departing, or following regular schedules. The study proved that signals can be captured from moving cars at distances greater than 50 meters, even when the sensors are inside buildings or in concealed locations. This makes covert tracking technically feasible. Furthermore, TPMS signals include pressure readings, which could reveal the type of vehicle or whether a car or truck is carrying heavy loads, enabling more advanced surveillance methods.
"As vehicles become increasingly connected, even safety-oriented sensors, such as TPMS, should be designed with cybersecurity in mind, since data that seems passive and harmless can become a powerful identifier when collected on a large scale ," emphasizes Dr. Alessio Scalingi, a former PhD student at IMDEA Networks and now an Assistant Professor at Carlos III University of Madrid.
Despite these risks, current vehicle cybersecurity regulations do not yet specifically address TPMS security. The research team warns that, without encryption and authentication, tire sensors remain an easy target for passive surveillance. "TPMS was designed for road safety, not cybersecurity ," adds Dr. Yago Lizarribar, who participated in the work during his doctoral studies at IMDEA Networks and is currently a researcher at Armasuisse, Switzerland.
"Our findings demonstrate the need for manufacturers and regulatory bodies to improve protection in future vehicle sensor systems." Therefore, the research team urges industry leaders and policymakers to strengthen cybersecurity in future automobiles, so that safety systems do not become tracking tools.
The article, titled “Can't Hide Your Stride: Inferring Car Movement Patterns from Passive TPMS Measurements”, has been accepted for publication at IEEE WONS 2026.
