A researcher has printed proof-of-concept (PoC) movies to exhibit how an attacker can remotely unlock the doorways of a Honda automobile, and even begin its engine.
The assault is feasible due to a vulnerability within the automotive producer’s distant keyless system (CVE-2022-27254) that seems to affect all Honda Civic (LX, EX, EX-L, Touring, Si, and Kind R) fashions between 2016 and 2020.
The difficulty is that the identical unencrypted radio frequency (RF) sign is shipped for instructions to unlock/lock doorways, open the boot, or begin the engine remotely, Ayyappan Rajesh, a scholar at College of Massachusetts Dartmouth, defined.
Due to that, an attacker in a man-in-the-middle place may snoop on the request after which use it to launch a replay assault.
Mainly, if the attacker is positioned close to a susceptible automobile, they will report the distant sign despatched by the automotive proprietor to wirelessly open and begin the automobile, and later carry out the identical motion by themselves.
[ READ: Vulnerabilities Expose Lexus, Toyota Cars to Hacker Attacks ]
The difficulty, nonetheless, is just not new. The truth is, researchers initially recognized the potential for such assaults in 2017, and a CVE identifier was issued in 2019 (tracked as CVE-2019-20626).
One researcher claims that, “a hacker can acquire full and limitless entry to locking, unlocking, controlling the home windows, opening the trunk, and beginning the engine of the goal automobile.”
The researcher claims that whereas CVE-2019-20626 was confirmed to affect numerous Honda automobile fashions, the automotive maker continued to make use of the susceptible system in manufacturing.
In accordance with the researcher, assaults could be prevented if customers chorus from utilizing their RF fobs and if Honda implements a “rolling code” system, the place a brand new code is generated every time the consumer presses the button on their fob, thus providing a safer authentication system.
[ READ: Connected Cars Could be a Threat to National Security, Group Claims ]
“Honda has not verified the data reported by this researcher and can’t verify if its autos are susceptible to the sort of assault. Honda has no plan to replace older autos presently,” a Honda spokesperson advised SecurityWeek.
“At the moment, it seems that the gadgets solely seem to work inside shut proximity or whereas bodily hooked up to the goal automobile, requiring native reception of radio alerts from the automobile proprietor’s key fob when the automobile is opened and began close by,” the spokesperson continued.
Honda additionally mentioned that even when an attacker employs this assault to unlock a automotive’s door and begin the engine remotely, they gained’t be capable to drive it away until “a legitimate key fob with a separate immobilizer chip is current within the automobile, decreasing the chance of a automobile theft.”
“There isn’t a indication that the reported vulnerability to door locks has resulted in a capability to really drive an Acura or Honda automobile,” the spokesperson concluded.
Associated: New Flaws Expose EVlink Electrical Automobile Charging Stations to Distant Hacking
Associated: Misconfigured CalAmp Server Enabled Automobile Takeover