Honda Civics and the Evil Valet (juniperspring.org)

Article summary

The article discusses the reverse engineering of a 2021 Honda Civic's headunit, which is based on Android 4.2.2. The author discovered that the headunit can be updated via USB using a signed AOSP update file, and that the publicly-known AOSP test key is used for signing. This allows for arbitrary code execution on the headunit with physical access to the front USB port. The author has developed tools to prepare and flash custom update files.

Main themes

• Car hacking
• Android security
• Reverse engineering
• Infotainment systems
• Vehicle security

What commenters say

• The headunit's security vulnerability is a significant concern, as it allows for arbitrary code execution with physical access to the USB port.
• The use of the publicly-known AOSP test key for signing updates is a major oversight and a sign of incompetence.
• The security risk posed by the vulnerability is mitigated by the fact that it requires physical access to the vehicle, and that most people are not actively trying to be malicious.
• The lack of security measures in the headunit is not necessarily a bad thing, as it may be a deliberate design choice to allow for more openness and customizability.
• The vulnerability could be part of a larger attack chain, particularly in scenarios involving rental cars or Apple Carplay exploits.
• The focus on security can sometimes be overly restrictive, and a balance needs to be struck between security and usability.
• The use of unit tests and functional documentation can be an effective way to ensure that code is well-documented and maintainable, without the need for separate documentation.
• The fact that the headunit is based on an old version of Android is a limitation, but it also means that it may be more difficult to exploit than more modern systems.