Uncovering the Secrets of Tire Pressure Monitoring Systems
Reveals how unencrypted RF broadcasts from direct Tire Pressure Monitoring Systems (TPMS) enable vehicle tracking and custom message injection to spoof ECUs.
Summary
Wireless Architecture of Direct TPMS
Direct Tire Pressure Monitoring Systems (TPMS) rely on battery-powered sensor modules installed inside each vehicle tire. These sensors periodically broadcast pressure, temperature, and unique sensor identification numbers over unencrypted RF frequencies (typically 315 MHz or 433 MHz).
Vehicle Tracking via Unencrypted Sensor IDs
Because TPMS sensor identifiers remain fixed and transmit in plaintext without cryptographic authentication, low-cost radio receivers positioned along roadways or parking garages can capture these signals to track specific vehicles persistently.
Custom Packet Crafting and ECU Spoofing
Using software-defined radios (SDR), researchers developed tools to forge custom TPMS packets, transmitting manipulated pressure readings directly to the vehicle's electronic control unit (ECU) to trigger false warning indicators or instrument cluster anomalies.
Automotive Wireless Security Defenses
Securing future TPMS architectures requires implementing rolling cryptographic identifiers, authenticated message frames, and RF shielding within wheel wells to prevent passive surveillance and signal spoofing.
Related talks
Car Hacking Village·40 min
Ayyapan Rajesh
Ayyapan Rajesh details CVE-2022-27254, demonstrating how unencrypted fixed rolling codes in Honda remote keyless entry systems allow replay and vehicle theft.
Car Hacking Village·51 min
Nick Ashworth
Nick Ashworth presents 'Marco', a radar-like RF attack that probes Passive Keyless Entry (PKE) systems to identify and track specific vehicles across a city.
Creator Stage·26 min
G. Longo · V. Lenders
Demonstrates practical RF attacks against TCAS II collision avoidance systems to forge resolution advisories and disable collision detection.