TPMS Flaw in Toyota, Mercedes, and Other Major Brands Enables Covert Vehicle Tracking

Tire pressure monitoring systems (TPMS) in popular brands like Toyota, Mercedes, and many others quietly broadcast radio signals that can be turned into a powerful vehicle‑tracking tool.

New research shows that these routine safety messages can be harvested at scale, allowing anyone with cheap hardware to map where cars go, when they move, and even infer who might be driving.

Modern cars use direct TPMS sensors inside each wheel that wirelessly send tire pressure and temperature data to the car’s electronic control unit.

In many Toyota, Mercedes, Renault, Hyundai, and other models, these sensors transmit unencrypted messages at 315 or 433 MHz that include a fixed, unique identifier that rarely, if ever, changes.

Because the messages are in clear text, any nearby receiver can capture them without needing to interact with the vehicle.

Researchers from IMDEA Networks and partners deployed a network of five low‑cost software‑defined radios along nearby roads and parking areas for ten weeks.

With equipment costing around 100 dollars per receiver, they collected more than six million TPMS messages from over 20,000 vehicles, including 12 cars whose tire IDs they could verify.

They showed that TPMS signals can be received at distances over 50 meters, often through walls and without line of sight, making it easy to hide receivers in buildings or roadside infrastructure.

What Attackers Can Learn

Each tire in a car sends messages periodically while the vehicle is moving, and in some brands even while parked.

By establishing such a network of spectrum devices over a city, malicious users could track cars and infer behavioral patterns.

By correlating the four tire IDs that “appear” together within short time windows, the team could reliably group them into a unique car “fingerprint.”

Using similarity metrics such as the Jaccard index, they could match tire IDs to vehicles and reconstruct driving and parking patterns over weeks.

From these patterns, an observer could infer sensitive details such as:

• Daily work schedules and remote‑work days, based on when a car appears and disappears at a location.
• Lunch breaks, evening classes, or business trips, visible as out‑of‑routine movements in the timeline.
• Whether a car belongs to an internal employee, contractor, or occasional visitor, based on frequency and duration of stays.

The pressure values themselves also leak information: higher pressures can indicate heavier vehicles or loaded trucks, revealing approximate vehicle type and cargo state.

Combined with cameras or knowledge of a home address, a stalker or data broker could link a TPMS ID to a specific person, then track that individual anywhere receivers are deployed.

The study notes that major manufacturers including Toyota, Renault, Hyundai, and Mercedes commonly use direct TPMS designs that follow this vulnerable pattern of unencrypted wireless beacons with fixed IDs.

In many cases, sensors continue to transmit even when the car is parked, extending the tracking window for attackers.

Unlike smartphones, drivers cannot simply “turn off” TPMS: the system is legally mandated in regions such as the US and EU, and disabling it triggers warning lights or inspection failures.

No significant bias in signal reception based on vehicle orientation, indicating that while directional determination may not be feasible, the relatively low signal attenuation by the vehicle body enables consistent message capture regardless of the transmitter’s position.

Global regulations like UN Regulation No. 155 require carmakers to implement a cybersecurity management system, but current rules do not explicitly address TPMS privacy or mandate encryption for these radio messages.

As a result, hundreds of millions of vehicles on the road today are silently broadcasting trackable identifiers with no clear compliance pressure on manufacturers to fix the issue.

Hard to Detect, Hard to Stop

TPMS transmissions are sparse and the likelihood of capturing all 4 sensors from a car passing by a road decreases with
the vehicle’s speed.

TPMS‑based tracking is particularly dangerous because it is:

• Passive: receivers only listen, so victims get no alerts and logs show nothing.
• Cheap and scalable: a small city could be covered using dozens of 100‑dollar radio nodes and free decoding software.
• Persistent: sensor IDs are hardware‑coded and long‑lived, so the same “fingerprint” follows the car for years.

There are currently no practical defenses for drivers beyond replacing sensors or entire wheels, which is costly and still does not guarantee privacy if the new IDs are harvested again.

Researchers argue that carmakers must adopt encrypted, rotating identifiers for TPMS and that regulators should explicitly cover these systems in automotive cybersecurity standards.

Until then, tire pressure systems in Toyota, Mercedes, and many other major brands remain an invisible, always‑on tracking channel that most drivers never agreed to networks.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.