Most radio monitoring enthusiasts are familiar with tracking technology such as GPS transmitters, LoJack systems, and automatic license plate readers. But a recent wave of cybersecurity research has revealed a surprising new tracking method that involves something found in almost every modern vehicle: the tire pressure monitoring system (TPMS).
Researchers have discovered that the wireless signals transmitted by tire pressure sensors can potentially be intercepted and used to identify and track vehicles over time.
For scanner listeners and RF hobbyists, the story is especially interesting because the tracking method involves simple radio transmissions that can be received with inexpensive equipment.
What is TPMS?
A Tire Pressure Monitoring System (TPMS) is a safety feature installed in most vehicles sold since the mid-2000s. The system uses small battery-powered sensors inside each tire to measure air pressure and transmit that information wirelessly to the vehicle’s onboard computer.
If a tire becomes underinflated, the driver receives a warning light or message on the dashboard.
To send this data, the sensors broadcast short radio signals that include:
- Tire pressure data
- Sensor status
- A unique identifier (ID) for that sensor
The transmissions are designed to be very low power to preserve battery life, but they still travel dozens of meters and can be received outside the vehicle.
How Vehicles Can Be Tracked
The issue arises because the TPMS sensor broadcasts a fixed unique ID number, and these signals are typically unencrypted.
That means anyone with a radio receiver tuned to the appropriate frequency can capture the signal and record the sensor’s ID.
Researchers demonstrated that:
- SDR Receivers costing about $100 can capture TPMS signals.
- The signals can be received at distances greater than 50 meters (160 ft).
- The same ID can be detected repeatedly as the vehicle moves through different areas.
Over time, this allows observers to identify the same vehicle appearing at multiple locations, essentially creating a tracking record without GPS or cameras.
Building a Tracking Network
In a recent study, researchers placed low-cost radio receivers near roads and parking areas. Over a ten-week period, they captured millions of TPMS transmissions from more than 20,000 vehicles.
By correlating signals from the four tires of the same car, the researchers could confidently identify individual vehicles and observe patterns such as:
- Daily commute routes
- Arrival and departure times
- Vehicles regularly parked at specific homes or workplaces
Unlike camera-based tracking systems, TPMS tracking does not require line-of-sight and can work through walls or obstacles.
Why This Matters
The technology was never intended for surveillance. TPMS was created as a safety system to prevent accidents caused by underinflated tires.
However, the research highlights a potential privacy risk:
- Signals broadcast automatically whenever the vehicle is operating
- Drivers have no indication the transmissions can be intercepted
- Receivers can be hidden or placed in multiple locations
In theory, a network of receivers around a city could track vehicle movement patterns without using cameras or license plate recognition.
Implications for Radio Monitoring Enthusiasts
For the radio monitoring community, this story highlights how many modern devices quietly transmit RF signals that can be intercepted and analyzed.
TPMS transmissions are typically found in the 315 MHz or 433 MHz UHF bands, depending on the manufacturer. These signals are short digital bursts that can often be received with:
- Software Defined Radios (SDR)
- Low-cost RF receivers
- Specialized TPMS monitoring tools
While the research demonstrates technical feasibility, intercepting these signals for tracking purposes may raise legal and privacy concerns, depending on the jurisdiction.
What Could Change in the Future
Security researchers are now calling on automakers to address the issue by:
- Encrypting TPMS transmissions
- Randomizing sensor IDs
- Implementing improved vehicle cybersecurity standards
Until then, the humble tire pressure sensor remains an unexpected example of how even simple RF safety systems can reveal more information than intended.
SCMA Takeaway:
Modern vehicles are packed with wireless systems—from keyless entry and Bluetooth to TPMS and vehicle telemetry. For radio hobbyists, these signals represent an entire hidden RF ecosystem that continues to grow as cars become more connected.