Mastodawn

\~Rye~/ ┴┬┴┤( ͡° ͜ʖ├┬┴┬

Show of hands, who had TMPS (Tire Pressure Monitoring System) as a threat vector to privacy on their bingo card?

https://networks.imdea.org/your-cars-tire-sensors-could-be-used-to-track-you/

#tmps #infosec #privacy
#fuckcars

Your car’s tire sensors could be used to track you - IMDEA Networks

Researchers at IMDEA Networks Institute, together with European partners, have found that tire pressure sensors in modern cars can unintentionally expose drivers to tracking. Over a ten-week study, they collected signals from more than 20,000 vehicles, revealing a hidden privacy risk and highlighting the need for stronger security measures in future vehicle sensor systems. Most...

IMDEA Networks

Earthshine Mar 2

@rye lmao

@earthshine @rye So can your Bluetooth MAC address from the entertainment system.

It's definitely a threat to your wallet too. That system is an embedded gotcha of near $1000 waiting for you if you keep the car for a while.

Just find me a car with no cellular transceiver please.

Earthshine Mar 2

@rye ok reading this, it's just the obvious thing of them all having (nominally) unique radio ID codes to identify the sensor to the car. You could try to implement rolling codes, but these are devices that, as they are, need to keep operating for years on a single coin cell battery, can only be serviced with the tire dismounted, so any computationally expensive cryptography is going to come with a potentially significant increase in operating cost.

Earthshine Mar 2

@rye Ultimately those TPMS transmitters are only 4 of like a dozen or more different potentially identifying radio signals emanating from a modern car to be picket up by BLE sniffers etc. I've kinda given up on that fight years ago and think short of just never carrying any electronic devices with you, it's impossible to have privacy of movement now with how much info scraping adversaries (our threat model includes palantir and the government, now..) are doing to track everyone's every move.

Matt Hall Mar 2

Oh, god yes.

Coral (bleached era)Mar 2

@rye @earthshine *raises hand* but, u know, it’s a car with a licence plate…

Earthshine Mar 2

@coral @rye that, too

MissConstrue Mar 2

@coral @rye @earthshine My determination to keep my old pre-connected cars running, continues apace. Looking at everything the car companies have done to enshittify the driving experience, in a country where 80% of the country doesn’t have reliable public transportation is just infuriating. Cars aren’t a luxury here, the manufacturers have made sure they’re a necessity by lobbying against anything that could wean us off private ownership, and now that they’ve fully succeeded, they can make cars a subscription and tracking platform. Hooray, 21st century.

Space Catitude 🚀Mar 2

And here I had no idea that ignoring the warning light and letting those batteries die was a privacy win! 😤

@rye @davep I did, all the way back in 2019, actually …

https://x.com/alexbloor/status/1089137960396693505?s=46&t=tcbMbKH3ZsUqHRhyBQwIVQ

Bloor (Mastodon: @[email protected]) (@alexbloor) on X

Installed RTL_433 on my Pi. I live right next to a very busy roundabout with lots of cars on it all the time. Innnnteresting... Shit tons of TPMS readings. I had assumed this was all Bluetooth. But apparently, no, 433.

X (formerly Twitter)

Jonty Wareing Mar 3

@bloor @rye @davep Staggered that this is being presented as a new tracking vector given I poked at this 15+ years ago and the first sensors were released in *1986*

@jonty @bloor @rye @davep this is ancient news, why is it surfacing again now? Did some Wired AI “journalist” make a shocking discovery or something?

Henryk Plötz Mar 3

@bloor @rye @davep Around 2010/2011 there was the most awesome pair of papers by the University of Washington and the University of California at San Diego: https://www.autosec.org/publications.html

Though the papers are in "standard" dry tone, you can feel the fun the students had through the lines.

At one point they were reverse engineering the tire pressure sensors and remark that IDA Pro didn't know the processor architecture. So they wrote a plugin for a completely weird architecture. As a footnote.

diana 🏳️‍⚧️🦋🌱Mar 3

Time to make a cheap TPMS random generator. Or really get attention by recording TPMS sensors and rebroadcasting with low pressure...that could force privacy like the hashed rolling codes on garage door transmitters use...

jamesb (MW1CGG)Mar 3

@rye
I've been using it as a "wife is back home" warning system with rtl433 for years.