11 ms·

Rolling-PWN vulnerability affects all Honda vehicles

156 points by panarky 4y ago

sokoloff 4y ago
“Affects all Honda vehicles [from model year 2012 and up]”.
ncmncm 4y ago
I guess all older cars' doors have a similar vulnerability. But starting the engine, too, is more fun.
- bregma 4y ago
  We have dubbed that door vulnerability "cp4t hangar" and the ignition vulnerability "5crew 6r1ver" and have registered them in the common vulnerability database for credit and publicity purposes.
londons_explore 4y ago
My car was broken into with this technique :-(. You can buy (on the usual dodgy places) a briefcase with a multi-car unlocker which will unlock lots of different cars if turned on in a car park, allowing you to then empty out the contents of any car that does then unlock. And since there is no smashed window, insurance won't pay out either.
- Axien 4y ago
  The technique described is a replay vulnerability. The attacker must record you unlocking your vehicle. What you describe sounds different, but even more scary.
  - eugenekolo 4y ago
    Isn't it potentially a replay attack the poster is describing? In a simple form it seems like this: The attack is you have a briefcase that contains specific RF transceiving components in it. You turn the brief case on in a hidden place, leave it, it records data, you come back to it later, and then press a button(s) that replays those RF signals. Perhaps, there's some very weak cars that don't even need a replay, but are vulnerable to a master key, or bruteforce, or something else.
- snarfy 4y ago
  What? Fuck insurance. I would smash my own window then.
  - tasty_freeze 4y ago
    25 years ago, a (then) friend had a nice car, bought it new. IIRC it was a BMW. He was hypervigilent about its condition. One night some thieves broke into his car and did some damage. Replacing the window wasn't a worry -- that can be replaced good as new, but they had put some dings in the hood somehow. He was worried that insurance wouldn't replace the hood but would just pay someone to try to knock them back into shape, which was unacceptable to him. So he went and bashed up the hood himself with a bat. The insurance claims guy came out to inspect it and said: we'll replace the window and we'll have a shop hammer out out the damage in the hood. Served him right.
- jeroenhd 4y ago
  Replay attacks like these won't work for what happened to you, most likely the manufacturer of your car opted for an insecure unlocking protocol (i.e. a static key programmed into the remote) that's easily brute forceable. These were common for ages, and I don't understand why (especially technical) people trusted wireless unlocking technology. Modern systems have some form of protection against brute force and replay attacks but personally I don't trust them.
  - wongarsu 4y ago
    It's not like keys for pin tumbler locks are very secure either. I think the main drawback of wireless unlocking is that hacking it is less conspicuous. If you have a device that can unlock a car in 10 times the time it takes with the legitimate key that looks suspicious if you spend that time holding an object to a keyhole, it's completely unnoticeable if you stand a couple meters away on a parking lot doing it wirelessly. Even worse with a method that works on 10% of cars: with a physical keyhole you go from car to car, looking very suspicious, with a wireless device you just stand there and go to the first car that unlocks.
    - jeroenhd 4y ago
      Picking a car lock without setting off a loud alarm is a huge hassle and with the right setup it'll probably leave marks of entry at least. I've seen enough LPL videos that I trust physical car locks as much as I do house locks. I agree with the inconspicuousness of wireless hacking, but I wouldn't even call it the main drawback: the main drawback is that many insurance companies won't pay a dime if there are no signs of entry at all. Break a window, steal an entertainment system, and the original owner probably gets some money for window repair and a new part. Do the same thing digitally and the insurance company will probably tell you to pound sand.
  - wallaBBB 4y ago
    That would be hard-coded on the vehicle side, but this looks more like a simply signal jammer that is described in this attack. They simple jam the RKE Lock command when you're leaving your car, you don't pay attention to the light signalization for the successful Lock and move on. They come and still anything valuable from the inside.
- 99_00 4y ago
  How do you know that you didn't just leave the door unlocked?
  - giobox 4y ago
    While it won't be true for all and can often be configured, many keyless entry systems nowadays lock the doors once key leaves vicinity of the car whether you remember to lock the doors or not.
- deleted 4y ago
  [deleted]
- Johnny555 4y ago
  And since there is no smashed window, insurance won't pay out either. If you have comprehensive insurance (which is what would cover a stolen car), they'll pay whether or not it was broken into, you left the keys in it, or even if you left the engine running while unattended. https://www.progressive.com/answers/car-theft-with-keys-in-car/ https://www.progressive.com/answers/car-theft-with-keys-in-c... As long as you have comprehensive coverage, you can file a claim if your car is stolen while left running. Comprehensive can still pay to replace your vehicle if it's stolen while your keys are inside it or if you left it running. Car insurance won't pay for any personal effects stolen from the car, that would be covered by homeowners insurance, but as long as you have a police report, they'll cover it. I had a bicycle stolen from my (unlocked) car while parked in a garage -- homeowners insurance just asked for the police report, then sent me a check for the bike. They d
Fnoord 4y ago
I bet it works similar to the garage door opening hack (opensesame by Samy Kamkar) and utilizes De Brujin Sequence. You don't need a briefcase for such. A small Raspberry Pi with a Yard Stick One is suffice.
- buescher 4y ago
  opensesame is clever, but it only works on fixed code schemes decoded with a shift register or equivalent. This vulnerability affects rolling code schemes.
mabbo 4y ago
My car is the first on the list, a 2012 Honda Civic. Thankfully I've been doing a lot of research lately on buying a new car and whichever EV I want is only a 6-24 month waiting list. (But truthfully, my car sits barely used in a secure underground garage 99% of the time- I'm not very worried)
capableweb 4y ago
It's unclear if the authors actually responsibly disclosed this, although they did make some attempts at contacting Honda, it's unclear how long they waited for a reply. > What does Honda think about this Rolling-PWN Bug? > We have searched through the Honda official website, but we can not find any contact info for report Vulnerability. Seems Honda motor DOES NOT have a department to deal with security related issue for their products. And a person who works at HONDA has told us "The best way to report the Honda vulnerability is to contact customer service". Therefore, we filed a report to Honda Customer service, but we have not get any reply yet. > In addition, we found an article from Bleeping-Computer (https://www.bleepingcomputer.com/news/security/honda-bug-lets-a-hacker-unlock-and-start-your-car-via-replay-attack https://www.bleepingcomputer.com/news/security/honda-bug-let...), which Seems that Honda does not care about security issues anyway :( Hope the authors are either anonymous enough or in a jurisdiction they can't be sued for making this public.
- Fnoord 4y ago
  Looks like they published various videos of them exploiting the vulnerability in public space. Supposedly, OSINT techniques could at least uncover these locations.
- iancarroll 4y ago
  Is the obligation to find a security disclosure contact really on an individual researcher who already did free work for them, or is it on Honda to make it easy? I do not blame them at all. If corporations deprioritize security, that doesn’t mean we should shift responsibility onto individuals.
  - capableweb 4y ago
    I absolutely don't blame them either, I wish more people showed how absolutely insecure most modern systems are. I'm was simply writing my comment out of worry for their safety, nothing else.
- jeroenhd 4y ago
  What would the illegal part be in this instance? They're not illegally accessing Honda's services, which is what most security researchers can end up sued about. This is a local replay attack using the researcher's own hardware. I don't see why they would possibly need to inform Honda first. Responsible disclosure for issues like these is more of a curtousy to show good intent and to protect people by allowing the manufacturer to roll out patches. Honda doesn't seem interested in protecting their customers and they seem unwilling to get into contact with these people, so if it's true that they tried to contact Honda, that's enough of a curtousy for me, at least.
greatgib 4y ago
"Honda has no plan to update older vehicles at this time" Could this be legal? What would happen if your car is stolen because of that? Under french law, I think that it would be a "hidden defect" that the manufacturer has to cover for.
- capableweb 4y ago
  That's from earlier this year (CVE-2022-27254), hopefully they changed their mind as of late (however, seems unlikely). If not after that incident became public, maybe by now when even more vulnerabilities are becoming public.
Karliss 4y ago
Is there a link to more detailed technical description? From the description it almost sounds like validation for counter synchronization is separate from validation for command execution and it doesn't take into account requirement of counter in the message being bigger than counter in last valid message. Thus allowing to rollback the counter and making previously recorder messages valid again.
- capableweb 4y ago
  > 9: Is there more technical information about Rolling-PWN? > You can follow the author on Twitter [@kevin2600] (https://twitter.com/kevin2600 https://twitter.com/kevin2600). However, we will not be releasing any tools required to go out and steal the affected vehicles. At a later stage, we will release technical information in order to encourage more researchers to get involved in the car security research.
PLG88 4y ago
One can only hope that it's these sort of events which slowly pushes to having more legislation and responsibility to the provider of digital services (i.e., Honda) if things go wrong (e.g., goods inside or even vehicle stolen). While I am 99% sure the politicians will write crappy legislation, over time it should become better and ensure that the purveyor of compromised SW is responsible for their sloppy work. It took decades but seatbelts, crash tests etc etc made us all massively safer when driving and we probably need the same minimum across some digital services.
- b112 4y ago
  One thing. The system can auto correct. For example, one person claims that such a vulnerability means that the insurance company won't pay, for it leaves no smashed windows if you are robbed. However, all it takes is one person going to court, publicizing it enough, and winning against the insurance company. What happens? The insurance company, naturally, starts to increase rates for owners of that brand of car. It has to pay out more often, for that car has a weakness, and this is the result. This has happened before, with cars that didn't have physical steering wheel ignition locks, back in the 80s. The result? Sales dropped for those cars, no one wants to pay 50% more for insurance, and manufacturers quickly worked to fix the issue. It's a sad thing though, to see a relentless stare at the daily, short term bottom line, without thought to other factors, and long term profit. Way to drive away customers, and crash a reputation! Brands to steer clear of, to be sure!
  - tatersolid 4y ago
    This effect only helps future car buyers, it doesn’t make the owners of vulnerable vehicles any safer or compensate them in any way.
    - b112 4y ago
      Of course not. It is not like car makers retrofitted old cars with physical ignition locks on the 80s, either. I wonder, would this also be a physical retrofit? There could be hardware limitations to change here.
coffeeoverflow 4y ago
CVE-2021-46145 The keyfob subsystem in Honda Civic 2012 vehicles allows a replay attack for unlocking. This is related to a non-expiring rolling code and counter resynchronization. Not a new threat https://s34s0n.github.io/2019/07/18/Jam-and-Replay-Attacks-on-Vehicular-Keyless-Entry-Systems/ https://s34s0n.github.io/2019/07/18/Jam-and-Replay-Attacks-o...
deleted 4y ago
[deleted]
TacticalCoder 4y ago
> A rolling code system in keyless entry systems is to prevent replay attack. More specifically: rolling codes are used to prevent replay attack while allowing the remote fob to be only a transmitter, not a receiver, which saves on costs. If there was bi-directional communication there are obviously better ways to secure the fob/car (like regular challenge/response).
philipov 4y ago
Do we say that someone affected by this vulnerability got PWNed?
threemux 4y ago
I have a 2013 Honda Civic Si (USA) and it does not have a keyless start system (you have to put the key into the ignition to start it). Also, like any manual car I've driven, you have to press the clutch in or it won't start. To unlock, a button on the keyfob must be pressed. As far as I can tell, this means my car is not affected but I'm not sure. If it's not, then the statement that it affects all Hondas after 2012 is incorrect.
- luma 4y ago
  Having a car that nobody wants to steal is an effective theft prevention strategy
  - threemux 4y ago
    Yeah I suppose that's one way to do it. I go for the combo of having a garage and driving a manual, which is itself a theft prevention device in the US these days
- causi 4y ago
  Also, like any manual car I've driven, you have to press the clutch in or it won't start. This is such an infuriating trend in modern cars, especially hybrids. I can never tell when the damn thing is done starting up so at least ten percent of the time I take my foot off too early and it just goes "Try again, bitch."
  - aidenn0 4y ago
    I also used to start the car in neutral, which doesn't work on new cars
- wallaBBB 4y ago
  Dude RKE is not the keyless you think, your probably thinking of passive keyless. This is pressing your LOCK/UNLOCK button, and if you have buttons on your FOB than you have this issue.
jakub_g 4y ago
Question for folks who are knowledgable in the subject: Which car manufacturers have good security when it comes to those wireless keys? Are there any? I feel like most of those things are either designed by regular developers who lack the hacker mindset; or maybe they do have it, but product management cuts corners to have better 'ease of use' etc.
- kube-system 4y ago
  Car manufacturers don't even make the wireless key systems, they buy them from Mitsuibishi/Siemens/Alps, etc
mariojv 4y ago
Does anyone know if it's actually common for these vulns to be exploited by thieves? I've heard of people using amplification attacks where they simply amplify the key fob from a distance (https://cbsaustin.com/news/local/car-thieves-are-hacking-key-fobs-to-quickly-and-quietly-steal-vehicles https://cbsaustin.com/news/local/car-thieves-are-hacking-key...), but using a replay exploit like this seems like it's a lot less common. Lately the big thing locally (south central Texas) has been catalytic converter thefts more than stealing anything inside the car though.
amluto 4y ago
Fundamentally, a cryptographic system that allows a key fob to authenticate itself with one-way communication to a car and does not require a real-time clock in the key fob is hard and maybe impossible to get right. One can certainly do better than what Honda did, but anything that checks all the boxes one would like needs some way to prevent replay even over many keypresses with no successful unlocks, and that needs either something visible to the car to change when the owner presses the button 100 times far away from the car (e.g. the time) or needs a form of communication in which the key isn’t simply broadcasting bearer tokens to the world.
- rasz 4y ago
  IR receiver in the key fob? Requiring you to stand in front of the car to sync.
- mrex 4y ago
  Really, is TOTP too much to ask when they are charging $300-$500 for a single replacement key anyway?
  - pstrateman 4y ago
    how do you put a real time clock into a key fob that can actually keep time?
    - mrex 4y ago
      RSA SecureID has been doing this for decades and decades. They use a not-tremendously-accurate battery backed quartz RTC with some drift compensation built into the server side. There are a ton of other options though. Atomic clock signals are broadcast nationwide in the US. GPS, Glonass, etc. signals broadcast the time. Cellular networks broadcast the time.
    - buescher 4y ago
      If you can synchronize the clocks in the car and the key fob, it doesn't matter if you know the delta to UTC or not.
atomize 4y ago
Is my 2000 CRV going to be safe?!? Bah, 2012-Current. *Misleading headline.
- kube-system 4y ago
  Older Hondas are notorious for being able to be stolen by putting a screwdriver in the key cylinder and giving it a swift whack with a hammer. They don't assign those CVEs though.
  - atomize 4y ago
    Can confirm. Source: Aforementioned 2000 CRV stolen once (Chicago =D) AND RECOVERED. Totally still working just dinged up a bit. They left it parked in front of a hydrant with the doors and windows open! Insurance totaled it, but said I could keep it. That's the story of why I still have and drive a 22 year old, 5-speed, 2000 CRV. Hard to sell with the 'rebuilt' title, still runs great though. Dented up like a truck, but only has 135k miles. It's a keeper. My 'city' car.
99_00 4y ago
Congratulations to the team. I wish theives would use sophisticated methods like this. Instead I have to pay the decutable for broken car windows or replace it out of pocket. If a thief is caught stealing (unlikely) the consequences are minimal. So little insensitive to use sophisticated methods. Of course there are those that want undetected access to a vehicle for reasons other than stealing. But I'm not worried about that personally because I'm not important enough to be targeted. Keep shedding light on these issues.
randcraw 4y ago
BTW, my 2019 Honda 'vehicle' config menu lets me enable/disable remote start. It's been possible forever to unlock most cars by replay. I care a lot more about the crim driving it away. This news implies only that an enabled remote start can be compromised, not that every so-equipped Honda less than 10 years old is at risk. Just de-config your remote start.
- kube-system 4y ago
  Compromising an OEM remote starter is not really a big problem anyway. The vehicle still will not allow you to shift out of park, and any modern system will only start the vehicle a limited number of times for a limited duration. They're inherently designed for unattended operation.
buescher 4y ago
> After each keyfob button pressed the rolling codes synchronizing counter is increased. However, the vehicle receiver will accept a sliding window of codes, to avoid accidental key pressed by design. By sending the commands in a consecutive sequence to the Honda vehicles, it will be resynchronizing the counter. Once counter resynced, commands from the previous cycle of the counter worked again. Therefore, those commands can be used later to unlock the car at will. Could the counter and clock resynchronization schemes in RFC 6238 "TOTP: Time-Based One-Time Password Algorithm" and RFC 4226 "HOTP: An HMAC-Based One-Time Password Algorithm" have similar bugs? In implementation if not in principle?
Fatnino 4y ago
"all" Honda vehicles. I'll have you know I drive a Honda and it's not vulnerable to this attack. 2000 Honda civic
- suprjami 4y ago
  I bet you've also got 3 Spoon engines, and just came into Harry's and ordered 3 T66 turbos with NOS and a Motec System Exhaust.
  - Fatnino 4y ago
    Nope, it's still just a bucket of bolts kept running but just barely. It's now got a paperclip under the hood to keep the rad fan on and a couple of functional nickels under the dash as part of the breaking system.
    - twojacobtwo 4y ago
      I think it was a reference from The Fast and the Furious.
jeffbee 4y ago
HN two days ago helped me identify a random electronic dingus in my Honda as a dealer-installed remote entry and remote start thing from a brand called "Karr" which is in all likelihood a complete piece of junk, security-wise. I'm not even going to get worked up over OEM implementation details if dealers are installing backdoors.
UncleOxidant 4y ago
Not my '98 Civic. Then again, pretty much any Honda key from that era can open up any Honda from that era - so it's not like Honda has ever been very concerned about security.
meatmanek 4y ago
Another recent Honda keyfob vulnerability: https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patt...
- wallaBBB 4y ago
  That one claims (without sufficient proof) that Honda does not implement rolling code in the fobs, completely opposite of this article that implies a wrong re-synchronization strategy implemented on the vehicle side.
TheMagicHorsey 4y ago
As someone whose car windows were broken 7 times in 13 months in San Francisco, I hope all the criminals get this device. I never have anything in my car, and the idiots doing the smash and grabs could reduce both our headaches by just investing in this thing.
worik 4y ago
What is your chance of getting a modern car that does not have this sort of thing? I do not want any wireless connections to my car, unless I add them
- kojeovo 4y ago
  My '18 Subaru doesn't FWIW. Stick shift is a bit of a deterrent too
  - giobox 4y ago
    Subaru really sold a car without a remote locking key/fob in 2018?? Almost every Subaru ever in the past 10 years has a key with remote lock/unlock functionality just like the one in the Rolling-PWN example linked above. In North America you'd have to try really hard to buy the cheapest new car you could find to get a dumb key, and even then it probably has remote central locking and potential vulnerabilities to replay attacks. Your chance of getting a new car any time in the last decade that has no remote central locking and no potential replay attack surface is very, very low - this attack vector has been proven in many car key fobs for a long time.
    - kojeovo 4y ago
      Facepalm, I misunderstood. Thought it was the keyless start specifically. Mine needs the physical key to start it but can be unlocked remotely. So they can get in, but not drive it off I suppose.

156 points by panarky 4y ago

sokoloff 4y ago

“Affects all Honda vehicles [from model year 2012 and up]”.

ncmncm 4y ago

I guess all older cars' doors have a similar vulnerability. But starting the engine, too, is more fun.

bregma 4y ago
We have dubbed that door vulnerability "cp4t hangar" and the ignition vulnerability "5crew 6r1ver" and have registered them in the common vulnerability database for credit and publicity purposes.

londons_explore 4y ago

My car was broken into with this technique :-(. You can buy (on the usual dodgy places) a briefcase with a multi-car unlocker which will unlock lots of different cars if turned on in a car park, allowing you to then empty out the contents of any car that does then unlock. And since there is no smashed window, insurance won't pay out either.

Axien 4y ago
The technique described is a replay vulnerability. The attacker must record you unlocking your vehicle. What you describe sounds different, but even more scary.
- eugenekolo 4y ago
  Isn't it potentially a replay attack the poster is describing? In a simple form it seems like this: The attack is you have a briefcase that contains specific RF transceiving components in it. You turn the brief case on in a hidden place, leave it, it records data, you come back to it later, and then press a button(s) that replays those RF signals. Perhaps, there's some very weak cars that don't even need a replay, but are vulnerable to a master key, or bruteforce, or something else.
snarfy 4y ago
What? Fuck insurance. I would smash my own window then.
- tasty_freeze 4y ago
  25 years ago, a (then) friend had a nice car, bought it new. IIRC it was a BMW. He was hypervigilent about its condition. One night some thieves broke into his car and did some damage. Replacing the window wasn't a worry -- that can be replaced good as new, but they had put some dings in the hood somehow. He was worried that insurance wouldn't replace the hood but would just pay someone to try to knock them back into shape, which was unacceptable to him. So he went and bashed up the hood himself with a bat. The insurance claims guy came out to inspect it and said: we'll replace the window and we'll have a shop hammer out out the damage in the hood. Served him right.
jeroenhd 4y ago
Replay attacks like these won't work for what happened to you, most likely the manufacturer of your car opted for an insecure unlocking protocol (i.e. a static key programmed into the remote) that's easily brute forceable. These were common for ages, and I don't understand why (especially technical) people trusted wireless unlocking technology. Modern systems have some form of protection against brute force and replay attacks but personally I don't trust them.
- wongarsu 4y ago
  It's not like keys for pin tumbler locks are very secure either. I think the main drawback of wireless unlocking is that hacking it is less conspicuous. If you have a device that can unlock a car in 10 times the time it takes with the legitimate key that looks suspicious if you spend that time holding an object to a keyhole, it's completely unnoticeable if you stand a couple meters away on a parking lot doing it wirelessly. Even worse with a method that works on 10% of cars: with a physical keyhole you go from car to car, looking very suspicious, with a wireless device you just stand there and go to the first car that unlocks.
  - jeroenhd 4y ago
    Picking a car lock without setting off a loud alarm is a huge hassle and with the right setup it'll probably leave marks of entry at least. I've seen enough LPL videos that I trust physical car locks as much as I do house locks. I agree with the inconspicuousness of wireless hacking, but I wouldn't even call it the main drawback: the main drawback is that many insurance companies won't pay a dime if there are no signs of entry at all. Break a window, steal an entertainment system, and the original owner probably gets some money for window repair and a new part. Do the same thing digitally and the insurance company will probably tell you to pound sand.
- wallaBBB 4y ago
  That would be hard-coded on the vehicle side, but this looks more like a simply signal jammer that is described in this attack. They simple jam the RKE Lock command when you're leaving your car, you don't pay attention to the light signalization for the successful Lock and move on. They come and still anything valuable from the inside.
99_00 4y ago
How do you know that you didn't just leave the door unlocked?
- giobox 4y ago
  While it won't be true for all and can often be configured, many keyless entry systems nowadays lock the doors once key leaves vicinity of the car whether you remember to lock the doors or not.
deleted 4y ago
[deleted]
Johnny555 4y ago
And since there is no smashed window, insurance won't pay out either. If you have comprehensive insurance (which is what would cover a stolen car), they'll pay whether or not it was broken into, you left the keys in it, or even if you left the engine running while unattended. https://www.progressive.com/answers/car-theft-with-keys-in-car/ https://www.progressive.com/answers/car-theft-with-keys-in-c... As long as you have comprehensive coverage, you can file a claim if your car is stolen while left running. Comprehensive can still pay to replace your vehicle if it's stolen while your keys are inside it or if you left it running. Car insurance won't pay for any personal effects stolen from the car, that would be covered by homeowners insurance, but as long as you have a police report, they'll cover it. I had a bicycle stolen from my (unlocked) car while parked in a garage -- homeowners insurance just asked for the police report, then sent me a check for the bike. They d

Fnoord 4y ago

I bet it works similar to the garage door opening hack (opensesame by Samy Kamkar) and utilizes De Brujin Sequence. You don't need a briefcase for such. A small Raspberry Pi with a Yard Stick One is suffice.

buescher 4y ago
opensesame is clever, but it only works on fixed code schemes decoded with a shift register or equivalent. This vulnerability affects rolling code schemes.

mabbo 4y ago

My car is the first on the list, a 2012 Honda Civic. Thankfully I've been doing a lot of research lately on buying a new car and whichever EV I want is only a 6-24 month waiting list. (But truthfully, my car sits barely used in a secure underground garage 99% of the time- I'm not very worried)

capableweb 4y ago

It's unclear if the authors actually responsibly disclosed this, although they did make some attempts at contacting Honda, it's unclear how long they waited for a reply. > What does Honda think about this Rolling-PWN Bug? > We have searched through the Honda official website, but we can not find any contact info for report Vulnerability. Seems Honda motor DOES NOT have a department to deal with security related issue for their products. And a person who works at HONDA has told us "The best way to report the Honda vulnerability is to contact customer service". Therefore, we filed a report to Honda Customer service, but we have not get any reply yet. > In addition, we found an article from Bleeping-Computer (https://www.bleepingcomputer.com/news/security/honda-bug-lets-a-hacker-unlock-and-start-your-car-via-replay-attack https://www.bleepingcomputer.com/news/security/honda-bug-let...), which Seems that Honda does not care about security issues anyway :( Hope the authors are either anonymous enough or in a jurisdiction they can't be sued for making this public.

Fnoord 4y ago
Looks like they published various videos of them exploiting the vulnerability in public space. Supposedly, OSINT techniques could at least uncover these locations.
iancarroll 4y ago
Is the obligation to find a security disclosure contact really on an individual researcher who already did free work for them, or is it on Honda to make it easy? I do not blame them at all. If corporations deprioritize security, that doesn’t mean we should shift responsibility onto individuals.
- capableweb 4y ago
  I absolutely don't blame them either, I wish more people showed how absolutely insecure most modern systems are. I'm was simply writing my comment out of worry for their safety, nothing else.
jeroenhd 4y ago
What would the illegal part be in this instance? They're not illegally accessing Honda's services, which is what most security researchers can end up sued about. This is a local replay attack using the researcher's own hardware. I don't see why they would possibly need to inform Honda first. Responsible disclosure for issues like these is more of a curtousy to show good intent and to protect people by allowing the manufacturer to roll out patches. Honda doesn't seem interested in protecting their customers and they seem unwilling to get into contact with these people, so if it's true that they tried to contact Honda, that's enough of a curtousy for me, at least.

greatgib 4y ago

"Honda has no plan to update older vehicles at this time" Could this be legal? What would happen if your car is stolen because of that? Under french law, I think that it would be a "hidden defect" that the manufacturer has to cover for.

capableweb 4y ago
That's from earlier this year (CVE-2022-27254), hopefully they changed their mind as of late (however, seems unlikely). If not after that incident became public, maybe by now when even more vulnerabilities are becoming public.

Karliss 4y ago

Is there a link to more detailed technical description? From the description it almost sounds like validation for counter synchronization is separate from validation for command execution and it doesn't take into account requirement of counter in the message being bigger than counter in last valid message. Thus allowing to rollback the counter and making previously recorder messages valid again.

capableweb 4y ago
> 9: Is there more technical information about Rolling-PWN? > You can follow the author on Twitter [@kevin2600] (https://twitter.com/kevin2600 https://twitter.com/kevin2600). However, we will not be releasing any tools required to go out and steal the affected vehicles. At a later stage, we will release technical information in order to encourage more researchers to get involved in the car security research.

PLG88 4y ago

One can only hope that it's these sort of events which slowly pushes to having more legislation and responsibility to the provider of digital services (i.e., Honda) if things go wrong (e.g., goods inside or even vehicle stolen). While I am 99% sure the politicians will write crappy legislation, over time it should become better and ensure that the purveyor of compromised SW is responsible for their sloppy work. It took decades but seatbelts, crash tests etc etc made us all massively safer when driving and we probably need the same minimum across some digital services.

b112 4y ago
One thing. The system can auto correct. For example, one person claims that such a vulnerability means that the insurance company won't pay, for it leaves no smashed windows if you are robbed. However, all it takes is one person going to court, publicizing it enough, and winning against the insurance company. What happens? The insurance company, naturally, starts to increase rates for owners of that brand of car. It has to pay out more often, for that car has a weakness, and this is the result. This has happened before, with cars that didn't have physical steering wheel ignition locks, back in the 80s. The result? Sales dropped for those cars, no one wants to pay 50% more for insurance, and manufacturers quickly worked to fix the issue. It's a sad thing though, to see a relentless stare at the daily, short term bottom line, without thought to other factors, and long term profit. Way to drive away customers, and crash a reputation! Brands to steer clear of, to be sure!
- tatersolid 4y ago
  This effect only helps future car buyers, it doesn’t make the owners of vulnerable vehicles any safer or compensate them in any way.
  - b112 4y ago
    Of course not. It is not like car makers retrofitted old cars with physical ignition locks on the 80s, either. I wonder, would this also be a physical retrofit? There could be hardware limitations to change here.

coffeeoverflow 4y ago

CVE-2021-46145 The keyfob subsystem in Honda Civic 2012 vehicles allows a replay attack for unlocking. This is related to a non-expiring rolling code and counter resynchronization. Not a new threat https://s34s0n.github.io/2019/07/18/Jam-and-Replay-Attacks-on-Vehicular-Keyless-Entry-Systems/ https://s34s0n.github.io/2019/07/18/Jam-and-Replay-Attacks-o...

deleted 4y ago

[deleted]

TacticalCoder 4y ago

> A rolling code system in keyless entry systems is to prevent replay attack. More specifically: rolling codes are used to prevent replay attack while allowing the remote fob to be only a transmitter, not a receiver, which saves on costs. If there was bi-directional communication there are obviously better ways to secure the fob/car (like regular challenge/response).

philipov 4y ago

Do we say that someone affected by this vulnerability got PWNed?

threemux 4y ago

I have a 2013 Honda Civic Si (USA) and it does not have a keyless start system (you have to put the key into the ignition to start it). Also, like any manual car I've driven, you have to press the clutch in or it won't start. To unlock, a button on the keyfob must be pressed. As far as I can tell, this means my car is not affected but I'm not sure. If it's not, then the statement that it affects all Hondas after 2012 is incorrect.

luma 4y ago
Having a car that nobody wants to steal is an effective theft prevention strategy
- threemux 4y ago
  Yeah I suppose that's one way to do it. I go for the combo of having a garage and driving a manual, which is itself a theft prevention device in the US these days
causi 4y ago
Also, like any manual car I've driven, you have to press the clutch in or it won't start. This is such an infuriating trend in modern cars, especially hybrids. I can never tell when the damn thing is done starting up so at least ten percent of the time I take my foot off too early and it just goes "Try again, bitch."
- aidenn0 4y ago
  I also used to start the car in neutral, which doesn't work on new cars
wallaBBB 4y ago
Dude RKE is not the keyless you think, your probably thinking of passive keyless. This is pressing your LOCK/UNLOCK button, and if you have buttons on your FOB than you have this issue.

jakub_g 4y ago

Question for folks who are knowledgable in the subject: Which car manufacturers have good security when it comes to those wireless keys? Are there any? I feel like most of those things are either designed by regular developers who lack the hacker mindset; or maybe they do have it, but product management cuts corners to have better 'ease of use' etc.

kube-system 4y ago
Car manufacturers don't even make the wireless key systems, they buy them from Mitsuibishi/Siemens/Alps, etc

mariojv 4y ago

Does anyone know if it's actually common for these vulns to be exploited by thieves? I've heard of people using amplification attacks where they simply amplify the key fob from a distance (https://cbsaustin.com/news/local/car-thieves-are-hacking-key-fobs-to-quickly-and-quietly-steal-vehicles https://cbsaustin.com/news/local/car-thieves-are-hacking-key...), but using a replay exploit like this seems like it's a lot less common. Lately the big thing locally (south central Texas) has been catalytic converter thefts more than stealing anything inside the car though.

amluto 4y ago

Fundamentally, a cryptographic system that allows a key fob to authenticate itself with one-way communication to a car and does not require a real-time clock in the key fob is hard and maybe impossible to get right. One can certainly do better than what Honda did, but anything that checks all the boxes one would like needs some way to prevent replay even over many keypresses with no successful unlocks, and that needs either something visible to the car to change when the owner presses the button 100 times far away from the car (e.g. the time) or needs a form of communication in which the key isn’t simply broadcasting bearer tokens to the world.

rasz 4y ago
IR receiver in the key fob? Requiring you to stand in front of the car to sync.
mrex 4y ago
Really, is TOTP too much to ask when they are charging $300-$500 for a single replacement key anyway?
- pstrateman 4y ago
  how do you put a real time clock into a key fob that can actually keep time?
  - mrex 4y ago
    RSA SecureID has been doing this for decades and decades. They use a not-tremendously-accurate battery backed quartz RTC with some drift compensation built into the server side. There are a ton of other options though. Atomic clock signals are broadcast nationwide in the US. GPS, Glonass, etc. signals broadcast the time. Cellular networks broadcast the time.
  - buescher 4y ago
    If you can synchronize the clocks in the car and the key fob, it doesn't matter if you know the delta to UTC or not.

atomize 4y ago

Is my 2000 CRV going to be safe?!? Bah, 2012-Current. *Misleading headline.

kube-system 4y ago
Older Hondas are notorious for being able to be stolen by putting a screwdriver in the key cylinder and giving it a swift whack with a hammer. They don't assign those CVEs though.
- atomize 4y ago
  Can confirm. Source: Aforementioned 2000 CRV stolen once (Chicago =D) AND RECOVERED. Totally still working just dinged up a bit. They left it parked in front of a hydrant with the doors and windows open! Insurance totaled it, but said I could keep it. That's the story of why I still have and drive a 22 year old, 5-speed, 2000 CRV. Hard to sell with the 'rebuilt' title, still runs great though. Dented up like a truck, but only has 135k miles. It's a keeper. My 'city' car.

99_00 4y ago

Congratulations to the team. I wish theives would use sophisticated methods like this. Instead I have to pay the decutable for broken car windows or replace it out of pocket. If a thief is caught stealing (unlikely) the consequences are minimal. So little insensitive to use sophisticated methods. Of course there are those that want undetected access to a vehicle for reasons other than stealing. But I'm not worried about that personally because I'm not important enough to be targeted. Keep shedding light on these issues.

randcraw 4y ago

BTW, my 2019 Honda 'vehicle' config menu lets me enable/disable remote start. It's been possible forever to unlock most cars by replay. I care a lot more about the crim driving it away. This news implies only that an enabled remote start can be compromised, not that every so-equipped Honda less than 10 years old is at risk. Just de-config your remote start.

kube-system 4y ago
Compromising an OEM remote starter is not really a big problem anyway. The vehicle still will not allow you to shift out of park, and any modern system will only start the vehicle a limited number of times for a limited duration. They're inherently designed for unattended operation.

buescher 4y ago

> After each keyfob button pressed the rolling codes synchronizing counter is increased. However, the vehicle receiver will accept a sliding window of codes, to avoid accidental key pressed by design. By sending the commands in a consecutive sequence to the Honda vehicles, it will be resynchronizing the counter. Once counter resynced, commands from the previous cycle of the counter worked again. Therefore, those commands can be used later to unlock the car at will. Could the counter and clock resynchronization schemes in RFC 6238 "TOTP: Time-Based One-Time Password Algorithm" and RFC 4226 "HOTP: An HMAC-Based One-Time Password Algorithm" have similar bugs? In implementation if not in principle?

Fatnino 4y ago

"all" Honda vehicles. I'll have you know I drive a Honda and it's not vulnerable to this attack. 2000 Honda civic

suprjami 4y ago
I bet you've also got 3 Spoon engines, and just came into Harry's and ordered 3 T66 turbos with NOS and a Motec System Exhaust.
- Fatnino 4y ago
  Nope, it's still just a bucket of bolts kept running but just barely. It's now got a paperclip under the hood to keep the rad fan on and a couple of functional nickels under the dash as part of the breaking system.
  - twojacobtwo 4y ago
    I think it was a reference from The Fast and the Furious.

jeffbee 4y ago

HN two days ago helped me identify a random electronic dingus in my Honda as a dealer-installed remote entry and remote start thing from a brand called "Karr" which is in all likelihood a complete piece of junk, security-wise. I'm not even going to get worked up over OEM implementation details if dealers are installing backdoors.

UncleOxidant 4y ago

Not my '98 Civic. Then again, pretty much any Honda key from that era can open up any Honda from that era - so it's not like Honda has ever been very concerned about security.

meatmanek 4y ago

Another recent Honda keyfob vulnerability: https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patt...

wallaBBB 4y ago
That one claims (without sufficient proof) that Honda does not implement rolling code in the fobs, completely opposite of this article that implies a wrong re-synchronization strategy implemented on the vehicle side.

TheMagicHorsey 4y ago

As someone whose car windows were broken 7 times in 13 months in San Francisco, I hope all the criminals get this device. I never have anything in my car, and the idiots doing the smash and grabs could reduce both our headaches by just investing in this thing.

worik 4y ago

What is your chance of getting a modern car that does not have this sort of thing? I do not want any wireless connections to my car, unless I add them

kojeovo 4y ago
My '18 Subaru doesn't FWIW. Stick shift is a bit of a deterrent too
- giobox 4y ago
  Subaru really sold a car without a remote locking key/fob in 2018?? Almost every Subaru ever in the past 10 years has a key with remote lock/unlock functionality just like the one in the Rolling-PWN example linked above. In North America you'd have to try really hard to buy the cheapest new car you could find to get a dumb key, and even then it probably has remote central locking and potential vulnerabilities to replay attacks. Your chance of getting a new car any time in the last decade that has no remote central locking and no potential replay attack surface is very, very low - this attack vector has been proven in many car key fobs for a long time.
  - kojeovo 4y ago
    Facepalm, I misunderstood. Thought it was the keyless start specifically. Mine needs the physical key to start it but can be unlocked remotely. So they can get in, but not drive it off I suppose.