When Your Car's Tires Start Tracking You: A Week of Privacy Nightmares and Platform Failures

Page content

When Your Car’s Tires Start Tracking You: A Week of Privacy Nightmares and Platform Failures

You know that feeling when you realize the security threats we’ve been warning about for years are finally coming home to roost? This week gave us a perfect storm of examples, from Facebook’s massive outage to the discovery that your car’s tire pressure sensors are basically broadcasting your location to anyone who cares to listen.

Let me walk you through what happened and why it should matter to all of us in the security community.

Your Car is a Rolling Privacy Violation

The most unsettling story this week came from researchers who discovered that tire pressure monitoring systems (TPMS) are leaking sensitive tracking data. These aren’t some exotic luxury car features we’re talking about – TPMS sensors have been mandatory in the US since 2008.

Here’s the problem: these sensors broadcast unique identifiers that can be picked up by anyone with the right equipment. Think about it – your car is essentially announcing its presence everywhere it goes, creating a detailed map of your daily routines. School pickup, grocery store, that doctor’s appointment you’d rather keep private – it’s all potentially trackable.

What makes this particularly frustrating is that it’s such a predictable oversight. We’ve seen this pattern over and over again with IoT devices: engineers focus on the primary function (monitoring tire pressure) while completely ignoring the privacy implications of the data transmission method.

When Big Tech Goes Dark

Speaking of predictable problems, Facebook experienced another worldwide outage that left users staring at “accounts unavailable” messages. While outages happen, they serve as a stark reminder of how dependent we’ve become on centralized platforms.

From a security perspective, these outages often reveal interesting attack patterns. Threat actors know that during major platform disruptions, people get desperate and click on things they normally wouldn’t. We always see a spike in phishing attempts claiming to “restore your Facebook access” or similar social engineering tactics.

AI Makes Everyone a Threat Actor

The most concerning long-term trend highlighted this week comes from Cloudflare’s threat report, which shows how AI tools are democratizing sophisticated cyber attacks. This isn’t theoretical anymore – we’re seeing attackers who previously lacked the technical skills to craft convincing phishing emails or create believable social engineering content now producing professional-grade attacks at scale.

The deepfake component is particularly troubling. We used to be able to tell our users “if the CEO calls asking for wire transfers, verify through another channel.” Now we need to assume that voice and video calls can be spoofed convincingly enough to fool even security-aware employees.

Critical Infrastructure Under Fire

Two stories this week highlighted ongoing vulnerabilities in systems that keep our physical world running. First, there’s an ongoing dispute between Honeywell and a researcher over building controller vulnerabilities affecting thousands of internet-exposed IQ4 building management systems.

These kinds of disagreements between vendors and researchers always make me nervous. When there’s a public dispute about vulnerability impact, it usually means the vendor is downplaying real risks that could affect critical infrastructure.

Meanwhile, security researchers are tracking active bruteforce campaigns targeting CrushFTP systems. CrushFTP has been a favorite target lately, with multiple serious vulnerabilities discovered over the past year, including template injection flaws and authentication bypasses that basically hand over admin access.

What This Means for Our Daily Work

These stories might seem disconnected, but they illustrate a common theme: the security challenges we face are becoming more diverse and harder to predict. We’re not just dealing with traditional network security anymore.

Our threat models need to account for everything from the cars in our parking lots potentially leaking location data to AI-powered attacks that can fool even experienced security professionals. The attack surface keeps expanding faster than our ability to secure it.

For those of us doing security architecture, this week reinforces the importance of privacy-by-design principles. The TPMS tracking issue could have been prevented with basic anonymization techniques, but those protections weren’t built in from the start.

We also need to get better at helping our organizations prepare for AI-enhanced social engineering. Traditional security awareness training that focuses on spotting obvious phishing attempts won’t cut it when attackers can generate personalized, contextually relevant content that passes most of our current detection methods.

The infrastructure vulnerabilities remind us that security isn’t just about protecting data – it’s about keeping the physical systems that run our world safe from disruption.

Sources