PaperlayerView exact revision on arXiv

Source-linked AI summary

The hidden life of signals: Time-domain inferences and other privacy attacks on everyday devices

Larry Hernandez

arXiv:2609.27803v1cs.CR

TL;DR

Research has often examined wireless protocols individually, while interactions among devices, protocols, and user behavior remain understudied. This paper presents preliminary time-domain and protocol-specific analyses of composed signals, reporting that cross-protocol composition increases privacy leakage relative to single-protocol analysis.

  • Problem

    Privacy implications of interactions among widely deployed protocols such as Keeloq and TPMS, their metadata, and user behavior remain underexplored.

    Source: §1 · p. 1, §2 · p. 2

  • Method

    The paper presents preliminary research on protocol interactions and time-domain inference, including clustering and correlation analysis of captured RF signals.

    Source: Our contributions · p. 1, §3.1 · p. 2

  • Results

    The authors report that cross-protocol composition materially increases privacy leakage relative to single-protocol analysis.

    Source: Our contributions · p. 1

  • Takeaways & Limitations

    Protecting privacy in these settings requires attention to meaningful protocol metadata and, where feasible, defenses against payload timing analysis.

    Source: §5.1 · p. 6

    Establishing ground truth across residences, people, vehicles, and devices would require extensive, ongoing participant cooperation.

    Source: §5.3 · p. 6

Abstract

from arXiv · show

In privacy research on radiofrequency-based protocols, the dominant focus has remained on Bluetooth, WiFi, and Zigbee, while a broader and arguably more consequential attack surface has gone largely unnoticed: the privacy risks created by the composition of everyday wireless protocols. Widely deployed systems such as KeeLoq remotes, vehicle TPMS sensors, and other sub-GHz devices continuously emit metadata and timing structure that, when analyzed jointly rather than in isolation, enable powerful behavioral inference. This work-in-progress paper argues that privacy leakage in these environments is not merely a property of individual protocols, but an emergent property of their interaction, correlation, and composition across devices, spaces, and routines. The resulting attack surface arises both from protocol metadata that directly degrades privacy and from the latent relationships between devices and the ways users move among and interact with them over time. We present preliminary evidence that these composed signals expose underappreciated opportunities for inference and tracking, and we outline a research agenda for characterizing and mitigating this broader class of privacy failures.

1 Introduction

Privacy research has largely examined individual, familiar wireless protocols, while interactions among less-explored protocols and user behavior remain understudied. The paper presents preliminary work on how these relationships may reveal privacy-sensitive behavior and outlines further analysis and mitigation directions.

1 Introduction

  • Privacy defenses such as Wi-Fi MAC randomization and BLE privacy features address some tracking risks, while other de-anonymization methods can require specialized hardware and software.The paper notes that some timing and RF-characteristic attacks have been studied under laboratory-controlled conditions.Source: §1 · p. 1
  • Less-explored protocols such as Keeloq and TPMS contain metadata and design features that can expose behavior, device-use patterns, and other sensitive information.The paper identifies interactions between protocol characteristics and user behavior as a largely unexplored attack surface.Source: §1 · p. 1
  • The paper reports preliminary research on privacy risks from protocol composition, time-domain inference, and protocol-specific attacks.Its stated future directions include clustering and correlation to infer sensitive information and studying mitigation challenges.Source: Our contributions · p. 1
  • Prior work often studied protocols individually or stationary devices, overlooking interactions across wireless protocols and how users interact with their devices.The paper situates its contribution in exploring these relationships and their implications for user privacy.Source: Our contributions · pp. 1–2

2 Under-researched yet widely deployed RF protocols

The section describes privacy research centered on familiar 2.4 GHz protocols and argues that widely deployed sub-GHz systems remain less examined. It highlights metadata and timing patterns, including those associated with human-device interaction, as potential sources of sensitive inference.

2 Under-researched yet widely deployed RF protocols

  • The section contrasts sub-GHz protocols with Wi-Fi and Bluetooth research, whose attacks often rely on modulation-specific features or protocol-level identifiers.Prior Wi-Fi work cited includes passive radar, identifier leaks, and timing or payload-variance analysis.Source: §2 · p. 2
  • The section identifies overlooked Wi-Fi-to-Ethernet interactions through which access points may expose wired-device MAC addresses and network infrastructure.It describes passive observers as potentially able to infer wired network topology and device presence from these frames.Source: §2 · p. 2
  • Privacy implications at the intersection of human interaction and protocol characteristics remain largely unexplored for protocols including Zigbee, Thread, and Z-Wave.The section also notes that research on these protocols has focused on security vulnerabilities and mesh-network attacks.Source: §2 · p. 2
  • Sub-GHz protocols such as Keeloq and TPMS are massively deployed, difficult or impossible to patch, and may expose sensitive behavior through metadata and usage timing.The paper describes their combined timing patterns and protocol-specific metadata as a poorly understood attack surface.Source: §2 · p. 2
  • The privacy implications of LoRaWAN and SigFox remain unexplored as these protocols enter residential and commercial security markets.The section specifically mentions SigFox use in alarm systems for high-risk contested environments.Source: §2 · p. 2

3 Collection and analysis

The authors describe a portable, passive RF collection setup and an aggregate analysis of multi-year data from multiple locations. They report decoded-device measurements and explore how temporal patterns and identifiers can support grouping, while noting constraints on decoding accuracy and the scope of collection.

3.1 Experimental setup

  • The setup captured ISM-band signals including Keeloq and TPMS across 315–434 MHz, using SDRs, antennas, RF front-end components, software, and a time-series database.Collection took place at two locations selected for device density, diversity, and permissive passive-monitoring jurisdictions.Source: §3.1 · p. 2

3.2 Ethics and scope

  • The study collected broadcast RF emissions without interacting with individuals or linking signals to personal, household, or property identity.Analysis was performed after collection in aggregate and pseudonymous form, without attempts to deanonymize devices, users, or locations.Source: §3.2 · pp. 2–3

3.3 Data metrics

  • 116337 successfully decoded TPMS records included 11,984 sensor IDs and 547 vehicle associations inferred from sequential identifiers.The dataset contained over 1.6 million unique records beginning in August 2023; captured measurements were highly skewed and long-tailed, with TPMS and EV1527/PT2262-like remotes dominant. Tables 1 and 2 summarize top measurements and TPMS measurements by record count. Successful OOK/FSK decoding does not guarantee accurate data recovery without error correction, which matters for identifiers used in grouping and attribution.Source: §3.3 · p. 3, §3.3.1 · p. 3

3.3.1 Grouping and attribution.

  • TPMS grouping combined numerical identifiers, sequentiality, and RSSI, with temporal correlation based on identifiers providing the most reliable grouping.The authors report that two IDs were sufficient for meaningful grouping; Figure 1 gives an example RSSI correlation for a vehicle and four TPMS sensors with sequential IDs.Source: §3.3.1 · p. 3, Figure 1 · p. 3

3.4 Clustering analysis

  • The analysis applied K-Means and DBSCAN to time-domain signal features after exploratory statistical analysis and feature extraction.The authors also describe visualizing collected signal measurements by record volume, with a logarithmic horizontal axis and linear count labels.Source: §3.4 · p. 3

4 Preliminary results

Preliminary results show that timing and metadata across vehicle, remote, and household signals can reveal user routines and aspects of the surrounding environment. The analyses also expose limits in reliably attributing some decoded signals to specific devices.

4.1 Challenges in decoding

  • Encoding variance across EV1527 and PT2262 families can produce false positives, and rtl433 may misclassify EV1527 signals, making device attribution less reliable.The suggested mitigation uses confirmed signal examples and implicitly requires reverse engineering modulation and encoding schemes.Source: §4.1 · pp. 3–4

4.2 Time-domain inferences of vehicle and household signals

  • TPMS sensor groups showed reduced presence in summer and higher density in early morning and late afternoon, while transmission timing and frequency can indicate vehicle-use patterns.The heatmap covers TPMS sensor groups from August 2023 to January 2026; time-domain characteristics can support inference without payload decryption or protocol-specific knowledge.Source: §4.2 · pp. 4–5, Figure 2 · p. 5

4.3 Cross-protocol correlations and inferences

  • Keeloq button identifiers can reveal distinct perimeter access points and their use; correlations with vehicle and home-alarm signals can help construct a detailed picture of routines.Correlations across the same remote’s buttons can also reveal arrival and departure times, dwell time, and access patterns within a property.Source: §4.3 · p. 5

4.4 Case study: Keeloq and vehicle signals

  • Keeloq’s cleartext serial number and button identifier support transmitter grouping and behavior analysis, and collected activity overlapped in time with TPMS signals.The 28-bit serial number uniquely identifies the transmitter, while the button identifier distinguishes actions such as lock, unlock, and trunk release.Source: §4.4 · p. 5, Figure 3 · p. 5

4.5 Keeloq button clustering times

  • Keeloq button presses clustered in short intervals, suggesting linked actions such as unlocking a vehicle and opening a garage; Site A data showed temporal convergence with TPMS signals.Figure 4 covers unique remotes with a maximum of five minutes between button presses.Source: §4.5 · p. 5, Figure 4 · p. 6
  • Open motion-sensor data can help infer movement and interactions across devices, including room occupancy, vehicle-trunk use, and whether a gate remains open before another perimeter closes.The passage describes this for simple 433 MHz alarm sensors and says the inference may extend to MWave radar sensors, typically Zigbee.Source: §4.5 · p. 6

5 Discussion and future work

The discussion outlines future dataset, clustering, mitigation, and monitoring work, while emphasizing the practical limits of decoy transmissions and the difficulty of mitigating risks across long-lived devices and establishing ground truth.

5 Discussion and future work

  • Planned work includes expanding the dataset, refining clustering, exploring privacy mitigations, and investigating real-time monitoring and analysis.The authors also plan to improve signal capture and interference reduction using directional antennas, improved RF components, and software optimizations.Source: §5 · p. 6

5.1 What will not work

  • Decoy transmissions are unlikely to work well because they must mimic genuine signal timing and structure, yet compete for airtime and risk disrupting legitimate communications.The authors characterize ad hoc patchwork as ineffective and favor protocol redesign and privacy-preserving mechanisms, while noting redesign and adoption costs.Source: §5.1 · p. 6

5.2 Mitigation at scale and device obsolescence

  • Mitigating these risks at scale is difficult because vehicles and some IoT devices have long lifespans, limited update capabilities, and supply-chain and user-adoption barriers.Many such devices are not designed for post-deployment changes, and the replacement rate of garage-door, TPMS, and keyless-entry devices has not been adequately studied.Source: §5.2 · p. 6

5.3 Ground truth

  • Establishing ground truth would require a multi-residence, multi-person, multi-vehicle, multi-device ecosystem with people documenting every relevant interaction.The discussion calls this cooperation challenge arguably unsurmountable and separately emphasizes reproducibility, fair-use data access, and ethical assessment.Source: §5.3 · p. 6

A.1 TPMS dataset metrics

Table 2 lists top TPMS signals by successfully decoded record count.

A.1 TPMS dataset metrics

  • Table 2 covers TPMS signals.The table is titled as the top signals.Source: Table 2 · p. 8
  • The table ranks signals by successfully decoded record count.The count concerns successfully decoded records.Source: Table 2 · p. 8
  • The listed TPMS signals use FSK.The caption identifies the signal modulation as FSK.Source: Table 2 · p. 8

A.2 Microchip HCS301 payload structure

Table 3 describes the HCS301 transmitted-word structure as 66 data bits transmitted least-significant bit first.

A.2 Microchip HCS301 payload structure

  • Table 3 describes the HCS301 transmitted word.Its caption identifies the word as containing 66 data bits.Source: Table 3 · p. 8
  • The HCS301 transmitted word contains 66 data bits.Source: Table 3 · p. 8
  • The 66 data bits are transmitted LSb first.Source: Table 3 · p. 8

A.3 TPMS payload structures

Table 5 presents a 9-byte Renault TPMS payload format.

A.3 TPMS payload structures

A.4 RF block diagrams

The experimental RF front end receives the 315 MHz and 433 MHz ISM bands simultaneously using band-specific filters, an LNA, and two receivers. Alternative designs use a single receiver, including an upconversion option that avoids frequency hopping but sacrifices band discrimination.

A.4 RF block diagrams

  • The experimental setup uses dual-band coupling, band-specific filters, an LNA, and two receivers for simultaneous reception at 315 MHz and 433 MHz.Most 433 MHz signals are centered at 433.92 MHz; the passage notes that most SDR platforms can detect the peak and adjust.Source: §A.4 · p. 8, Figure 5 · p. 9
  • A single-SDR alternative uses dual-band preselection.Source: Figure 6 · p. 9
  • Another single-receiver design uses one 433 MHz antenna, a bandpass filter, and an LNA immediately after the filter.Source: Figure 7 · p. 9
  • Upconverting 315 MHz signals to 433 MHz lets a single SDR avoid frequency hopping, at the cost of band discrimination.Source: Figure 8 · p. 9
Loading 2609.27803v1…