Inferring car movement patterns from passive TPMS measurements | Hacker News Reader

Inferring car movement patterns from passive TPMS measurements

dspace.networks.imdea.org

60 pointswisdomseaker16 comments

I built a demo of this back when I worked at Qualcomm in Seattle; match this with WiFi beacons and you can trace a person fairly well. It's been over a decade, but at the time both iOS and Android would send pings fairly frequently to all known WiFi networks looking to see if they should switch to a faster one. With your device ID, list of SSIDs you know, and your TPMS data, a person can learn a lot about you.

Like, where do you work? Where do you stay (Hotel SSIDs)? Who are your friends (other people's home SSIDs)?

And this is what I exhaustively tell people who insist that [tech company] is listening. My reply boils down to, "Why would they need to when you already send them everything in writing?"

Phones randomize hardware addresses now, so this doesn't work. Although there are better, not-so-publicly-known, ways to do it anyway.

Pretty sure at least every newish GM car broadcasts wifi and probably doesn't MAC address rotate so there's that...

If you capture cellular control frequencies you get msisdns for free.

I have an RTL SDR setup in a retail business receiving temperatures from sensors around the property. Besides the neighbors' weather stations I see a lot of TPMS coming, presumably, from the parking lot. I see the same cars regularly. I could definitely correlate them with the POS terminals and identify individual customers.

Most places where this would be legal there are probably much more effective ways to do it at the POS, even non-biometrically. Although yes you might consider usng TPMS as part of an ensemble.

Maybe a buying trip north of the border might suit some U.S. folks alarmed by the TPMS blabbermouth data. Although Canadian-spec new vehicles usually have TPMS monitoring, it is not mandated, so some vehicles will display a dashboard icon or menu warning if no TPMS signal is seen, while others will just ignore the issue. Given that many Canadian consumers have dedicated sets of winter and summer tires/wheels, this is sensible to not require TPMS systems. Caveat emptor: I have no idea whether recertifying a new Canadian vehicle for the U.S. (i.e. changing kph speedo to mph, etc) involves flashing such different software.

I live in the Midwest and have a car with TPMS and winter and all season tires and it's a $10 thing to tell the car to pair with tires when I swap them. Most mechanics have these too as they service wheels so it's not an issue really. Yeah it messes with the tracking but my car also has wifi I can't turn off without ripping out OnStar.

In the context of the OP the TPMS sensors are culprits, and on U.S. cars the software requires that TPMS modules be present. I've read about Ford owners in the U.S. using FORSCAN to disable the TPMS software components and then removing the TPMS modules from the tires. No idea if this is still possible of if similar solutions are workable for other manufacturers. Having said that, I mentioned Canadian-spec vehicles that don't have TPMS enabled in the first place.

A lot of new cars use tire rotation to detect a low tire now. So no need for TPMS sensors unless you need precise pressure data for some reason. Its much cheaper to do it this way so I suspect most TPMS sensors will be going away soon anyways.

You aren't gonna infer much from the passive tire rotation calculation based TPMS that the "designed to a price point" cars tend to use these days.

But I guess you don't really care about tracking people who drive cheap cars, for they have less surplus resources for you to convince them to part with so they're less of a priority to track...

With sufficient pressure resolution and monitoring, one could probably match movement patterns to road maps and know everything.

How are modern car manufacturers like Lucid, Tesla, Porsche etc.. EV companies doing it?

Thought this was going to be about reading the road like the groove on a record player. Apparently it is about cleartext radio signals and vehicle-specific identifiers.

s/movement/location/

Reply on news.ycombinator.com