5 ms·
I wrote another comment saying I couldn't reproduce but since this is on the front page, I do have a lot of questions for the authors of this CVE. Under their "
by devin 5y ago
I wrote another comment saying I couldn't reproduce but since this is on the front page, I do have a lot of questions for the authors of this CVE. Under their "prevention" section they say manufacturers should use rolling codes. This implies these FOBs don't use them, but per my previous understanding, they do.
Perhaps there is more to the setup of this CVE than they're talking about. Is it possible they're doing a rolljam attack + replay?
The CVE is really scant on details, so while I believe they did manage to get this to work, they don't really say how.
If rolling codes are implemented, it should be pretty simple with the right gear to prove it.
- emerongi 5y agoDefinitely hard to believe a 2020 Honda is not using rolling codes.
- olyjohn 5y agoPretty sure that even my garage door opener used rolling codes back in 1995...
- philliphaydon 5y agoI remember watching the news like 20 years ago about garage doors where thieves were buying universal door openers and driving down the roads pressing the buttons to find houses where it opened to rob them.
- danielheath 5y agoGarage door openers often last 15-20 years, so I wouldn’t be surprised if that were true, but a new system in 95 would definitely include them.
- colechristensen 5y agoSince there are various values attached to getting a CVE published, they just aren't always of the highest quality. Lots of "vulnerabilities" which are actually impossible to exploit or irrelevant in other ways in a real attack scenario, other low quality or misrepresented issues like we might be seeing here.
- belter 5y agoCVE-2022-27254 has a reference to this post, what is a strange recursion...
- belter 5y ago"...To better understand the impact of this vulnerability and Honda's plans to address the flaw, BleepingComputer reached out to Honda. Honda told us, multiple automakers use legacy technology for implementing remote lock-unlock functionality, and as such may be vulnerable to "determined and very technologically sophisticated thieves." "At this time, it appears that the devices only appear to work within close proximity or while physically attached to the target vehicle, requiring local reception of radio signals from the vehicle owner's key fob when the vehicle is opened and started nearby," a Honda spokesperson told BleepingComputer. Note, in their statement to us, Honda explicitly mentions it has not verified the information reported by the researchers and cannot confirm if Honda's vehicles are actually vulnerable to this type of attack. But should the vehicles be vulnerable, "Honda has no plan to update older vehicles at this time," the company tells BleepingComputer..." https://www.bleepingcomputer.com/news/security/honda-bug-lets-a-hacker-unlock-and-start-your-car-via-replay-attack/ https://www.bleepingcomputer.com/news/security/honda-bug-let...
- deleted 5y ago[deleted]
- MPSimmons 5y agoDid you see this page, by chance? https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patt...