Overview
- IMDEA Networks and European partners passively collected over 6 million TPMS transmissions from more than 20,000 vehicles in a 10‑week measurement campaign.
- Each tire sensor broadcasts a fixed, unencrypted identifier that enables reliable reidentification of individual vehicles.
- Radio signals were captured through walls and from moving cars at distances beyond 50 meters using low‑cost equipment.
- Correlating signals from all four tires let the team reconstruct arrivals, departures, and recurring schedules, with pressure data hinting at vehicle type or load.
- The work will be presented at IEEE WONS 2026, and the authors say current vehicle cybersecurity rules do not explicitly address TPMS vulnerabilities.