Uncovering the Secrets of Tire Pressure Monitoring Systems

Uncovering the Secrets of Tire Pressure Monitoring Systems

Speakers: Yago Lizarribar

Conference: DEF CON

YouTube: https://www.youtube.com/watch?v=K5Kltw5kQpM

Overview

In this DEF CON talk, Yago Lizarribar, a researcher specializing in the intersection of cybersecurity and artificial intelligence, sheds light on significant vulnerabilities within Tire Pressure Monitoring Systems (TPMS). Specifically, the presentation focuses on Direct TPMS (DTPMS), a safety-critical component mandatory in vehicles across the US and Europe for over a decade. Lizarribar demonstrates how these systems, designed to enhance vehicle safety by monitoring tire pressure, are fundamentally insecure due to a pervasive lack of encryption and authentication in their wireless communication protocols.

The talk details both passive monitoring techniques, which enable long-term tracking and behavioral profiling of vehicles and their owners, and active attacking (spoofing) methods, capable of injecting false data to trigger warning lights or even disrupt vehicle operation. Lizarribar underscores that despite the known vulnerabilities existing for over 15 years, the underlying technology in DTPMS has remained largely unchanged, while the accessibility and power of Software-Defined Radios (SDRs) have dramatically increased, making these attacks easier and more affordable to execute than ever before. This research highlights a critical, unaddressed security gap in modern automobiles, with profound implications for privacy and safety.

Background

▶ Watch: Introduction to TPMS vulnerabilities and safety criticality (0:00)

Tire Pressure Monitoring Systems (TPMS) are integral to modern vehicle safety, mandated in the US since 2007 and Europe since 2010. Their primary function is to measure and report tire pressure, a crucial parameter given the wheel's direct contact with the road. The talk distinguishes between several families of TPMS:

1. Indirect TPMS: This system leverages existing vehicle sensors, such as those for wheel rotation, to estimate tire pressure. It is less accurate and favored by manufacturers like Volkswagen Group and GM.
2. Direct TPMS (DTPMS): The focus of Lizarribar's research, these systems utilize dedicated sensors directly inserted into each wheel. They provide more accurate, real-time measurements of both tire pressure and temperature. DTPMS is commonly adopted by manufacturers such as Toyota, Ford, Renault, and Honda.
3. Bluetooth-based TPMS: A newer variant used by some manufacturers like Tesla and specific tire brands like Pirelli, though these also introduce their own set of security considerations.

The core problem with DTPMS lies in its fundamental design. These battery-powered sensors wirelessly transmit information to the vehicle's Engine Control Unit (ECU) using proprietary protocols. Critically, these protocols typically lack any form of encryption or authentication. This absence means that while the protocols are proprietary, they are easily reversible, as demonstrated by the existence of numerous open-source libraries like RTL 433, which can decode a wide array of DTPMS transmissions.

The wireless communication typically occurs in the ISM band, at 433 MHz in Europe and often 915 MHz in the US, using simple modulations such as Amplitude Shift Keying (ASK) or Frequency Shift Keying (FSK). Each DTPMS sensor contains an MCU, a motion sensor (designed to transmit only when the car is moving, typically every 30-60 seconds), a pressure sensor, a temperature sensor, and an RF chain for transmission. A less commonly discussed component is a 125 kHz receive module, which can be activated by an external signal to force immediate transmission of pressure information, even when the vehicle is stationary.

A typical DTPMS frame includes temperature, pressure, and a unique 32-bit sensor ID, allowing for approximately 4 billion unique identifiers. All this vital information is transmitted in cleartext, making it susceptible to interception and manipulation. Researchers have been aware of these vulnerabilities for over 15 years, with papers dating back to 2008 and previous DEF CON talks on the subject in 2018. However, the hardware technology of DTPMS sensors has seen little to no security improvements, while the proliferation and affordability of powerful SDRs have dramatically lowered the barrier to entry for exploiting these long-standing weaknesses.

Key Findings

▶ Watch: Direct TPMS protocols: proprietary, unencrypted, easily reversible (3:00)

Yago Lizarribar's research reveals several critical findings regarding the insecurity of Direct TPMS (DTPMS), establishing that these systems are highly vulnerable to both passive monitoring and active attacking due to their fundamental lack of encryption and authentication.

1. Ubiquitous Vulnerability: DTPMS systems, despite their safety-critical role, are inherently insecure. The absence of encryption and authentication means that anyone with readily available hardware and software can intercept, decode, and potentially spoof DTPMS messages.
2. Effective Passive Monitoring for Vehicle Tracking:

• Long-Term Tracking and Profiling: By passively collecting DTPMS signals, researchers demonstrated the ability to track individual vehicles over extended periods. This allowed them to discern patterns such as daily commutes, working hours, holidays, and even anomalous behaviors (e.g., working late, taking lunch breaks outside the building, driving on holidays).
• Car Correlation: A significant finding was the ability to correlate the four DTPMS sensors belonging to a single car. Sensors from the same vehicle tend to transmit at similar times, often with IDs sharing the first 26 out of 32 bits, simplifying the grouping of sensors to a specific car. This vastly improves tracking accuracy compared to monitoring a single ID.
• Range and Conditions: Passive monitoring proved effective under various conditions. A single sensor could track up to 200 cars in 30-second windows. Signals could be captured up to 200 meters away (especially for "chatty" brands like Toyota) and up to 60 meters even without direct line of sight (e.g., through walls). Vehicles moving at urban speeds (up to 50 kilometers per hour) could still be reliably tracked, though highway speeds might pose challenges.

1. Manufacturer-Specific Transmission Behavior: Not all DTPMS implementations are equal. Toyota, particularly those using the PMV vendor, was identified as the "chattiest" brand. Their DTPMS sensors transmit information every 15 minutes, regardless of whether the car is parked or moving, and at a higher transmit power. This behavior significantly increases the ease and range of passive tracking for Toyota vehicles compared to brands like Renault or Hyundai, which tend to adhere more closely to the design principle of transmitting only when the car is in motion.
2. Feasibility of Active Spoofing: The ability to passively decode DTPMS messages directly translates into the ability to actively spoof them. By reversing the decoding process, attackers can craft and transmit arbitrary DTPMS messages. This allows for injecting false pressure or temperature readings, or even entirely fabricated sensor IDs.
3. Accessibility of Attack Tools: The increasing availability and decreasing cost of powerful SDRs, such as the HackRF Mini or even the Flipper Zero, have made both passive monitoring and active spoofing highly accessible to a broader audience. The core DTPMS technology has not evolved to counter these advancements, creating a widening security gap.
4. Lack of Immediate Defensive Solutions: For owners of existing DTPMS-equipped vehicles, there is currently no practical solution to mitigate these vulnerabilities. The vehicle's ECU is designed to expect cleartext messages, meaning a software patch to enable encryption or authentication is not feasible without significant hardware and firmware overhauls.

These findings collectively paint a stark picture: a critical vehicle safety system is fundamentally insecure, exposing drivers to privacy risks through tracking and potential safety hazards from malicious data injection, with no easy remedy for the millions of cars already on the road.

Technical Deep Dive

▶ Watch: TPMS sensor components, activation, and clear data transmission (4:00)

The technical exposition of DTPMS vulnerabilities is divided into two primary areas: passive monitoring and active attacking, both leveraging the inherent insecurity of the communication channel.

Passive Monitoring Infrastructure

Building a passive monitoring setup is remarkably straightforward and cost-effective:

• Hardware: The core components include an RTLSDR (a cheap USB dongle acting as a software-defined radio receiver) and a compatible 433 MHz antenna (or 915 MHz for US frequencies). A single-board computer like a Raspberry Pi provides processing power, along with internet connectivity and a power source. The total hardware cost is approximately $100.
• Software: The essential software is RTL 433, an open-source tool capable of decoding a vast array of 433 MHz ISM band devices, including many DTPMS protocols. Custom models can be integrated to filter unwanted data.
• Infrastructure: Decoded messages are typically streamed to a time-series database like InfluxDB. This data can then be visualized using dashboards like Grafana, enabling long-term analysis and pattern detection.

The process involves DTPMS sensors transmitting cleartext messages to the vehicle's ECU. Crucially, any nearby receiver can also intercept these messages. The RTL 433 software decodes the raw RF signals into structured data (pressure, temperature, ID), which is then stored and analyzed.

Car Correlation

To effectively track a car rather than just individual sensors, it's vital to correlate the four DTPMS IDs belonging to a single vehicle. Lizarribar noted that DTPMS sensors within the same car tend to transmit at similar times, often appearing in "blocks of four" in detection logs. Techniques employed for correlation include:

• Cross-correlation of time series: Analyzing the temporal relationships between transmissions from different IDs.
• Jaccard Index: Measuring the similarity between sets of detected IDs over specific time windows.
• Robust matching algorithms: Designed to handle noisy or incomplete data, further refining the correlation.

A key observation aiding correlation is that for a given car, manufacturers often program DTPMS sensor IDs such that the first 26 bits of the 32-bit ID are identical, with only the last few bits differing. This provides a strong fingerprint for grouping sensors to a single vehicle.

Active Attacking (Spoofing)

The ability to spoof DTPMS messages stems directly from the lack of authentication and encryption. If a signal can be received and decoded, the process can be reversed to transmit a crafted signal.

• Hardware: An SDR with transmit capabilities is required, such as a HackRF Mini (around $300) or increasingly, cheaper alternatives like the Flipper Zero, which also offers transmit functionality.
• Software: The core logic involves reversing the decoding pipeline.

Renault DTPMS Protocol Example

Lizarribar provided a detailed breakdown of reverse-engineering and spoofing a Renault DTPMS sensor, illustrating the general principles applicable to other manufacturers:

1. Frequency: 433 MHz (Europe).
2. Modulation: 2FSK (Two-Frequency Shift Keying) combined with Pulse Width Modulation. This means that a '1' or '0' is represented by a shift between two distinct frequencies, and the duration of these frequency states encodes additional information (pulse width).
3. Bit Duration: Each bit lasts approximately 52 microseconds.
4. Coding: Manchester coding is used, a self-clocking line code where each bit is represented by a transition in the middle of the bit period, making it robust against timing errors.
5. Message Structure: The final message contains:

• Flags: Indicating message type or status.
• ID: A 3-byte unique identifier for the sensor.
• Pressure: The measured tire pressure.
• Temperature: The measured tire temperature.
• Battery Voltage: Sensor battery status.
• Magnum Parameters: Related to tire deflation characteristics.
• CRC (Cyclic Redundancy Check): For error detection, confirming proper decoding.

Decoding Pipeline (Receive):

• RF Signal Capture: An SDR captures the 433 MHz signal.
• 2FSK Demodulation: The signal is converted from frequency shifts to a sequence of high/low states based on the two frequencies.
• Pulse Width Demodulation: The duration of these high/low states is measured to extract raw pulses.
• Bit Inversion: In the specific case of Renault, an inversion of the bit sequence is required (this is manufacturer-dependent).
• Manchester Decoding: The Manchester-coded bit stream is converted into a standard binary sequence.
• Preamble Detection: Manufacturers often include a known preamble (e.g., a specific starting value) to help receivers synchronize and discard false positives.
• Message Parsing: The final binary message is parsed into its constituent fields (flags, ID, pressure, temperature, etc.).
• CRC Check: The CRC is calculated and compared to the received CRC to verify data integrity.

Spoofing Pipeline (Transmit):

To spoof a message, the entire decoding process is simply reversed:

• Craft Message: An attacker constructs the desired message, including a target ID, false pressure, temperature, and calculates the correct CRC.
• Manchester Encoding: The binary message is Manchester-encoded.
• Bit Inversion (if applicable): The sequence is inverted (for Renault).
• Pulse Width Modulation: The encoded bits are converted into a sequence of pulses with specific widths.
• 2FSK Modulation: The pulses are modulated onto the two carrier frequencies.
• RF Transmission: The SDR transmits the crafted RF signal.

Because the DTPMS channel is not authenticated, the vehicle's ECU receives this crafted message, perceives it as legitimate, and updates its internal state or triggers warnings accordingly. This complete lack of security allows for trivial manipulation of a safety-critical system.

Demo / Proof of Concept

▶ Watch: SDR advancements enable easier TPMS passive and active attacks (5:00)

The talk presented compelling demonstrations for both passive monitoring and active attacking, showcasing the practical impact of DTPMS vulnerabilities.

Passive Monitoring Demonstrations

1. Long-Term Personal Tracking: Lizarribar illustrated the ability to track an IT director's Toyota over time. By analyzing DTPMS transmissions, the researchers could deduce the individual's work hours, absences, and even holidays. This early observation highlighted the privacy implications of DTPMS.
2. Behavioral Profiling: A more in-depth study involving 12 participants showed how a low-cost, easily deployable infrastructure (RTLSDR, Raspberry Pi, RTL 433) could capture millions of unique DTPMS IDs from nearby roads.

• Workday Patterns: For a part-time student, the system accurately identified typical working hours (e.g., 8 AM to 1 PM).
• Anomalous Behavior Detection: The system successfully detected instances where the student came to work on a holiday late at night, or when a full-time worker left the building for lunch in the middle of the day. These real-world examples underscore the granularity of information that can be passively collected.
• Safety Alerts (Ethical Use): In a somewhat humorous yet illustrative example, the researchers proactively warned a participant that their front tire pressure was low, demonstrating the system's ability to extract accurate pressure data without consent.

1. Manufacturer Differences: The demo distinctly highlighted the "chattiness" of Toyota's DTPMS (using the PMV vendor). Unlike other brands that generally transmit only when moving, Toyota vehicles were shown to transmit their ID and pressure every 15 minutes, even when parked. This, combined with higher transmit power, allowed detection of Toyotas up to 200 meters away, significantly increasing their susceptibility to long-range tracking compared to other brands (e.g., Renault, Hyundai) which adhere more closely to the "transmit-on-motion" principle.

Active Attacking Demonstration

1. Triggering False Warnings: Lizarribar demonstrated the ability to spoof a Renault DTPMS sensor. By reversing the protocol and using an SDR with transmit capabilities (like a HackRF Mini), the researchers crafted and sent messages with artificially low pressure readings.
2. Dashboard Alert: The spoofed signal was successfully received by the target Renault's ECU, which, lacking authentication, accepted the false data as legitimate. This immediately triggered a "Reifendruck Panne" (faulty tire pressure) warning on the vehicle's dashboard. The speaker noted that this also produced a "really annoying noise," highlighting the potential for driver distraction and discomfort.
3. Overloading the ECU: In a further elaboration, it was explained that an attacker could continuously transmit low-pressure messages, effectively "overloading the ECU" with false information every second, forcing it to constantly display warnings and potentially make the vehicle's behavior unpredictable or unsafe.

These demonstrations unequivocally prove that DTPMS systems are not merely theoretically vulnerable but can be practically exploited with readily available tools, leading to significant privacy and safety concerns for vehicle owners.

Defensive Implications

▶ Watch: Demonstrating passive monitoring: tracking vehicles using TPMS data (6:00)

The findings presented by Yago Lizarribar highlight a significant and largely unaddressed security flaw in a safety-critical automotive system. The defensive implications are stark, particularly given the widespread deployment of DTPMS.

1. For Existing DTPMS-Equipped Vehicles: No Easy Fix:

The most challenging implication is that for the millions of vehicles currently on the road with Direct TPMS, there is no practical software solution or user-side mitigation. The vehicle's ECU is designed to expect DTPMS messages in cleartext, without encryption or authentication. Retrofitting these security measures would require fundamental changes to both the hardware (sensors and ECU) and firmware, which is not feasible for existing vehicles. Owners of such cars are, unfortunately, exposed to these risks.

1. For Prospective Car Buyers:

Individuals considering purchasing a new vehicle are advised to inquire about the type of TPMS installed. Opting for a vehicle with Indirect TPMS, while less accurate, would circumvent the direct wireless vulnerabilities discussed, as it relies on existing vehicle sensors rather than dedicated, insecure wireless modules. If DTPMS is present, understanding the manufacturer's implementation (e.g., "chatty" vs. "motion-only" transmission) could inform a purchasing decision, though this information is not always readily available to consumers.

1. For Automotive Manufacturers and Suppliers:

This research serves as a critical warning and a call to action for the automotive industry:

• Implement Robust Security: The fundamental solution is to integrate encryption and authentication into DTPMS communication protocols. This would prevent passive monitoring and active spoofing by ensuring that only trusted, authenticated sensors can communicate with the ECU, and that all data is protected from eavesdropping.
• Adhere to Design Principles: Manufacturers like Toyota (and its PMV vendor) should revise their DTPMS implementations to transmit only when the vehicle is in motion, aligning with the original design intent of conserving battery life and reducing unnecessary RF emissions. Reducing transmit power where feasible would also limit the range of passive tracking.
• Leverage Research: While academic papers have proposed secure DTPMS designs for years, these solutions have yet to be adopted in commercial vehicles. Manufacturers must prioritize translating this research into real-world implementations.
• Cybersecurity Certification: Given that Europe now requires cybersecurity certificates for newly manufactured cars, DTPMS vulnerabilities should be explicitly addressed in these certifications, even if they are currently overlooked.

1. For Regulators and Standards Bodies:

Current automotive safety and security regulations must be updated to explicitly mandate cryptographic protection and authentication for all safety-critical wireless components, including DTPMS. The current proprietary-but-unsecured approach is no longer acceptable in an era of increasing cyber threats to vehicles.

1. For Defenders and Security Researchers:

The open-source tools provided by Lizarribar (TPMS analysis for passive monitoring and TPMS tools for spoofing) are invaluable for security researchers to replicate findings, test different DTPMS implementations, and develop new defensive strategies. Understanding these attack vectors is the first step towards advocating for and developing more secure systems.

In essence, while there's no magic bullet for current DTPMS cars, the future of vehicle safety demands a fundamental shift towards secure-by-design principles for all wireless components, starting with encryption and authentication for systems like DTPMS.

Key Takeaways

• Fundamental Insecurity: Direct TPMS (DTPMS) systems are inherently vulnerable to both passive monitoring and active spoofing due to a complete lack of encryption and authentication in their wireless communication protocols.
• Privacy Risks via Passive Tracking: Low-cost hardware (e.g., RTLSDR, Raspberry Pi) and open-source software (e.g., RTL 433) enable long-term passive monitoring of DTPMS signals, allowing attackers to track vehicles, deduce personal routines, and identify anomalous behaviors.
• Active Spoofing Capabilities: The ease of reversing proprietary DTPMS protocols permits attackers to craft and inject arbitrary pressure, temperature, and ID data, triggering false dashboard warnings (e.g., "faulty tire pressure") and potentially causing driver distraction or unsafe stops.
• Manufacturer Discrepancies: While all DTPMS are vulnerable, some manufacturers (e.g., Toyota via the PMV vendor) exacerbate the problem by transmitting DTPMS data every 15 minutes regardless of vehicle movement, and at higher power, making their vehicles significantly easier to track over longer distances.
• Growing Accessibility of Attacks: The rapid advancement and decreasing cost of Software-Defined Radios (SDRs) like HackRF Mini and Flipper Zero have drastically lowered the barrier to entry for performing both passive monitoring and active DTPMS attacks.
• Urgent Need for Secure Design: There is currently no practical defense for owners of existing DTPMS-equipped vehicles. Automotive manufacturers must prioritize implementing encryption and authentication in future DTPMS designs to protect vehicle safety and user privacy.

About the Speaker(s)

Yago Lizarribar is a dedicated researcher based in Switzerland. His work primarily focuses on the dynamic intersection of cybersecurity and artificial intelligence, encompassing areas such as machine learning and deep learning applied to security challenges. Lizarribar also has extensive experience in spectrum sensing networks and previously worked in the field of autonomous vehicles. The research presented in this talk on Tire Pressure Monitoring Systems specifically draws upon his expertise in both spectrum sensing networks and cybersecurity, demonstrating how these domains can converge to uncover critical vulnerabilities in modern automotive systems.