Honda Bug Let Attackers Unlock and Start the Car

Honda and Acura have recently been found to have a vulnerability that allows an attacker to remote start the engine and unlock your car from a nearby distance using a ‘replay attack.’

It involves taking control of the remote keyless entry system of your car by capturing RF signals sent from your key fob to it. Some Honda owners may be able to protect themselves against this attack, according to researchers. 

Older Honda models remain unfixed in most instances, according to researchers. And this vulnerability has been discovered by computer scientists:-

• Ayyappan Rajesh
• Blake Berry

Wireless Unlocking to keyless Engine Start

An adversary can remotely unlock and start some Honda and Acura car models using a vulnerability disclosed by several researchers. Here the cybersecurity analysts tracked the vulnerability as:-

• CVE-2022-27254: PoC for vulnerability in Honda’s Remote Keyless System.

It’s a MitM attack in which an attacker intercepts the RF signals from a remote key fob to manipulate the signals, and at last, re-sends the signals to unlock the car at a later time.

Moreover, the researchers filmed a video showing the flaw’s remote engine start functionality. However, the exploit code has not yet been shared, nor have technical details or proof-of-concept details been provided.

Models Affected

The vehicles affected by this vulnerability primarily include the models from 2016-2020:-

• Honda Civic LX
• Honda Civic EX
• Honda Civic EX-L
• Honda Civic Touring
• Honda Civic Si
• Honda Civic Type R
• Acura TSX
• Accord V6 Touring Sedan
• Honda Civic Hatchback

In the event of a successful exploit, the captured commands could also be manipulated and re-transmitted in order to achieve a completely different result.

Tools Used

Here below we have also mentioned all the tools that are used:-

• FCCID.io
• HackRF One
• Gqrx
• GNURadio

Recommendations

Here below we have mentioned all the mitigations recommended by the experts.

For manufacturers:-

• Manufacturing companies must implement rolling codes, often called hopping codes.

For consumers:-

• Key fobs should be protected with Faraday pouches.
• Consider utilizing the PKE rather than the RKE because of the proximity needed to clone/read the signal.
• To mitigate this attack, you can reset your key fob at the dealership if you believe you have been impacted.