The vulnerabilities affect cars made between 2012 and 2022.
Every time you press a button on the key fob, a pseudo-random number generator sends a semi-random code to the car, telling it to, say, unlock the doors or open the garage door. The car then checks that code against a list of valid codes and, if it is legitimate, carries out the command. Previous codes are also supposed to become invalid so that attackers cannot reuse them.
Here is the catch: there is another set of codes intended for use when the key fob is out of the car’s range. In the case of Honda cars, hackers intercept and record these invalid codes. They use them to resynchronise the number generator, which later allows them to steal the car.
The researchers named the vulnerability RollingPWN and said that all cars made by Honda between 2012 and 2022 are affected.
The experts successfully tested the attack on the 10 most popular Honda models from 2012 to 2022, including:
- Honda Civic 2012
- Honda X-RV 2018
- Honda C-RV 2020
- Honda Accord 2020
- Honda Odyssey 2020
- Honda Inspire 2021
- Honda Fit 2022
- Honda Civic 2022
- Honda VE-1 2022
- Honda Breeze 2022
Despite all the accusations and evidence, Honda denies that RollingPWN exists.
The specialists also noted that traces of an attack exploiting the vulnerability cannot be detected, because it leaves no entries in the logs. To avoid falling victim to such an attack, the researchers recommend updating the key fob’s vulnerable firmware and, as a precaution, keeping it in a Faraday cage. If you have already fallen victim to RollingPWN, you should go to a dealership immediately and have the key fob reset.
It is worth recalling that Honda is not the only carmaker suffering from hackers. This year researchers found numerous vulnerabilities in Tesla electric cars. Vulnerabilities in the Bluetooth LE protocol and in Tesla key cards allowed attackers to get inside the car and start the motor.
Read more (in Russian): https://www.securitylab.ru/news/532738.php?ref=123