Loading story…
Researchers from IMDEA Networks Institute and European partners reported that many vehicles’ direct Tire Pressure Monitoring System (dTPMS) sensors broadcast unencrypted radio messages containing persistent unique identifiers, enabling passive tracking of cars over time. Using low-cost software-defined radio receivers (about $100 each), the team collected 6+ million TPMS messages from 20,000+ vehicles over roughly 10 weeks, with reception reported at 50–55 meters and even without line-of-sight; the broadcasts occur automatically while driving (and, for some brands, periodically while parked), giving drivers no indication the signals can be intercepted.
The reporting highlights that dTPMS messages can include pressure/temperature/battery data plus a 24–32-bit ID transmitted in cleartext over 315/433 MHz (with protocols/modulations such as ASK/FSK), and that the lack of encryption and ID rotation creates a stable “fingerprint” that can be correlated across locations. The researchers demonstrated scaling the approach with multiple receivers (e.g., RTL-SDR on Raspberry Pi) and commodity tooling such as rtl_433 with data pipelines (e.g., MQTT/InfluxDB), and described methods to associate the four tire IDs to a single vehicle to increase confidence in repeated detections; coverage included major brands cited in reporting such as Toyota, Renault, Hyundai, and Mercedes, while noting that some manufacturers use different approaches (e.g., indirect TPMS) that change the exposure profile.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
The researchers publicly warned that TPMS safety systems can function as persistent tracking beacons because encryption and identifier rotation are commonly absent, while regulations such as UN Regulation No. 155 do not explicitly cover TPMS. They recommended mitigations including encrypting broadcasts, rotating identifiers, reducing beaconing behavior, and updating vehicle security rules to include TPMS protections.
Analyzing the collected data, the researchers showed that many direct TPMS sensors in vehicles from brands including Toyota, Renault, Hyundai, and Mercedes broadcast cleartext telemetry and long-lived unique identifiers. By correlating the four tire sensors on a vehicle, they demonstrated reliable passive re-identification and inference of routines such as arrivals, departures, and presence or absence patterns.
Researchers from IMDEA Networks and European partner institutions deployed a small network of low-cost software-defined radio receivers near roads and parking areas for 10 weeks, collecting more than 6 million TPMS transmissions from about 20,000 vehicles. The field study showed that direct TPMS signals could be captured at scale from over 50 meters away, including some non-line-of-sight scenarios.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehackread.com
Open sourcehelpnetsecurity.com
Open sourcedarkreading.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple disclosures highlighted privacy and safety risks stemming from insecure data handling in connected devices and services. A server-side storage weakness in **DJI Romo robot vacuums** allowed a researcher to obtain access tokens for more than **6,700** other vacuums and view sensitive user data such as **home floor plans**, **live video feeds**, and **microphone input**; reporting indicated some issues were patched, but residual risk remained (e.g., the ability to stream video without a security PIN). Separately, the game *Dungeon Crusher* exposed user information after a **misconfigured Elasticsearch** instance leaked **24.5 million** in-game chat records and purchase-related data, including **IP addresses**, **email addresses**, and **partial payment card details**, creating downstream risk for fraud and targeted phishing. Academic research also demonstrated how everyday systems can leak exploitable signals or be manipulated in the physical world. UC Irvine researchers presented **FlyTrap**, a physical-world attack against **autonomous target-tracking drones** in which AI-generated umbrella patterns can cause drones to approach an attacker closely enough to be captured or crashed, raising concerns for deployments in surveillance and security contexts. IMDEA Networks and partners showed that **Tire Pressure Monitoring System (TPMS)** sensors broadcast a fixed **unique ID** in cleartext radio signals, enabling low-cost receiver networks to track vehicles over time without line-of-sight, based on signals collected from **20,000+ vehicles** during a multi-week study.
Jun 29, 2026
A Northeastern University and Consumer Reports study of 21 connected vehicles spanning 19 brands and 30 companion apps found widespread communications with third-party advertising, tracking, analytics, and technology domains. Researchers observed traffic during driving and idle tests, using DNS requests, TLS Server Name Indication, timing, and transfer volumes to identify destinations despite encryption. Nineteen of 21 vehicles contacted at least one third party over Wi-Fi; Tesla’s Model 3 contacted 34 advertising, tracking, and analytics domains and 37 infotainment-app domains, while Alphabet domains were the most frequently observed, including `doubleclick.net` and `googlesyndication.com`. The observed sharing could expose or link VINs, precise location, names, email addresses, vehicle identity, and travel patterns to advertising or data-broker profiles. Seven companion apps transmitted sensitive identifiers to tracking-associated third parties, and consumers may face substantial feature loss if they decline connected-services terms; Tesla warned refusal could reduce functionality or make a vehicle inoperable. Following disclosure of the findings, Honda said it directed Amplitude to delete received location data and stopped sending location data to that vendor.
Oct 2, 2026
Researchers from the Georgia Institute of Technology have uncovered significant security flaws in Tile's popular Bluetooth location trackers, raising concerns about user privacy and the potential for malicious tracking. The investigation revealed that each Tile device broadcasts an unencrypted, static MAC address along with a unique identifier, making it possible for any nearby Bluetooth-enabled device or radio-frequency antenna to intercept these signals. Unlike competing trackers that use temporary, rotating IDs to obscure the device's identity, Tile's approach leaves the MAC address unchanged, which allows for persistent tracking of the device and, by extension, its owner. The researchers also found that while Tile does rotate its unique ID, the method used is weak and can be easily circumvented, enabling continuous monitoring. Data collected by nearby devices is sent to Life360's servers without encryption, and the researchers believe this information may be stored in cleartext, further compounding privacy risks. This design flaw means that an attacker only needs to capture a single broadcast from a Tile device to fingerprint and track it indefinitely. The scale of the issue is significant, with approximately 88 million Tile trackers in use worldwide, amplifying the potential impact. The vulnerabilities are not mitigated by the safeguards Tile introduced in 2023, which were intended to prevent misuse by owners but do not address third-party tracking via Bluetooth sniffers. Such sniffers are widely available and commonly used in retail environments and smart-home setups, making the exploitation of these flaws trivial for both individuals and organizations. The researchers warn that these weaknesses could be exploited by stalkers, thieves, or other malicious actors to follow individuals without their knowledge. The lack of encryption in both the device broadcasts and the communication with Life360's infrastructure means that sensitive location data could be intercepted or misused in the event of a breach. The findings highlight a broader issue in the rapidly growing Bluetooth tracker market, where security and privacy considerations have not kept pace with adoption. The researchers emphasize that the current implementation allows for mass surveillance if Tile trackers are caught in large-scale scans. They also note that other tracker systems use more robust encryption and key management to protect user privacy, underscoring Tile's lag in adopting industry best practices. The exposure of static MAC addresses and weak ID rotation not only facilitates stalking but also opens the door to broader privacy violations and potential data breaches. The researchers' warnings serve as a call to action for both manufacturers and users to prioritize security in the design and use of location-tracking devices. Life360, the parent company of Tile, has not yet announced any immediate remediation steps in response to these findings. The incident underscores the importance of rigorous security assessments for consumer IoT devices, especially those with the potential to impact personal safety and privacy on a large scale.
Jun 29, 2026