Security and Privacy Vulnerabilities of In-Car Wireless Networks: A Tire Pressure Monitoring System Case Study

Tire Pressure Monitoring Systems represent, to the best of our knowledge, the first in-car wireless network mandated for every new automobile. The security and privacy implications of such incar wireless sensor networks are not fully understood— in particular, it is unclear whether the metal car body sufficiently shields these low-power transceivers from eavesdropping and outside interference. To address these questions, this paper presents a privacy and security evaluation of two tire pressure monitoring systems using both laboratory experiments with isolated tire pressure sensor modules and experiments with a complete vehicle system. We find that the sensor messages can be sniffed and decoded up to 40m from a passing vehicle with a basic low-noise amplifier and the openly available GNU radio platform. The proprietary protocols contain a static 32 bit identifier, and can be relatively easily reverse-engineered. In addition, a sensor message can be triggered through a wireless activation signal. This raises location privacy risks because vehicles could potentially be tracked through these identifiers and drivers do not have any option to disable the system. Furthermore, current protocols do not employ authentication mechanisms and vehicle implementation do not appear to perform basic input validation or filtering of messages. This allows straightforward spoofing of sensor messages. One of our experiments demonstrates this by triggering the tire pressure warning message in a moving vehicle through a spoofed message from another nearby vehicle. The paper concludes with a set of recommendations and a key management protocol that could significantly improve privacy and security of the tire pressure monitoring system and other forthcoming in-car wireless sensor networks.