At first glance, the humble tire pressure monitoring sensor (TPMS) might not seem like a flashy piece of standard equipment. TPMS pressure sensors in the U.S. were adopted after the Ford/Firestone tire scandal in the early 2000s and are supposed to help consumers see how much air is in their tires as well as provide early warning of loss of pressure.

A new report suggests TPMS sensors could also be used by bad actors to track a person’s vehicle potentially giving them a low-tech way of tracking their potential targets discretely.

Low-tech means no security

This is according to a new report from Spanish research firm IMDEA and their network division. IMDEA dived into researching this topic and discovered that many TPMS sensors are mounted inside the vehicle’s tires and send information to the car via wireless signals. That latter item includes IDs of the individual sensors to help the car discern information from the other three tires.

This process also has no security whatsoever with the IDs not only staying the same, but also not being encrypted in any way. This lack of encryption was proven in IMDEA’s tests with the firm not only getting off-the shelf radio receivers but also cheap Raspberry Pi computers to hook them up to for less than $100. The low budget setup produced some very troubling results with the gear being able to pick up the sensors from as far as 164 feet away and at speeds as high as 31 mph. They could even identify each individual tire and since the sheer distance eliminates the need for sight, the receivers could easily be hidden.

The team also revealed that during the 10 week study period, they were able to pick up and subsequently track over 20,000 vehicles. This information paints a bad picture when it comes to how bad actors could use the information if they employ a similar setup to pick up the information. This could include small time players like Pokemon scalpers (who have tracked and followed vehicles of vendors in the past with air tags) as well as serious criminals like burglars looking to break into a home and can use the information from the TPMS sensors to track vehicles to plan when to strike.

IMDEA is seeking legislation

IMDEA says the solution to this hidden problem is making and passing legislation that would force automakers to install security features into the TPMS sensors to make the signals harder to receive from beyond the car. This could include encryption features and software which would continuously change the IDs to make tracking a car by a bad actor even harder. The main drawback that would come from this is cost since re-engineering a TPMS sensor to include these features on top of its existing role as a pressure sensing tool would be very expensive.

In the meantime, the potential issues surrounding the security of TPMS sensors also paints a broader picture of the evolving technology field automakers have to deal with when it comes to making and securing future tech systems for automobiles.