Hackers could open the doors and start the car remotely on almost all Honda models. A keyless remote entry system is often installed in modern vehicles, allowing effortless access to the car.

A keyless remote entry system allows you to unlock or start the vehicle remotely via a mobile device. Recently, a security professional conducted a test to assess the resistance level of an RKE system currently in use.

Based on the results of this analysis, it found that all Honda vehicles that have been manufactured between the years 2012 and 2022 have a Rolling-PWN attack vulnerability.

Any hacker could exploit this vulnerability from afar to open the car door permanently or, in the worst case, even start the car’s engine as well.
Fault profile
CVE ID: CVE-2021-46145
Description: The remote control subsystem in 2012 Honda Civic vehicles allows a repeat attack to unlock. The related variable code that does not expire and a counter resynchronization.

Base score: 5.3
Severity: MEDIUM
Technical analysis

A software-defined radio allows an attacker to capture the code that the car owner uses to unlock the vehicle by exploiting a vulnerability in the software-defined radio.

The hacker could also open the car by reproducing the process upto 30 meters can be observed in some cases, it is possible to attack from that distance.

Below, we have mentioned all the vulnerable Honda models tested:

2012 Honda Civic
2018 Honda X-RV
2020 Honda C-RV
2020 Honda Accord
Honda Odyssey 2020
2021 Honda Inspire
Honda Fit 2022

INTRODUCTION
Modern vehicles are often equipped with a remote keyless entry system. These RKE systems allow unlocking or starting the car remotely. The goal of our research was to evaluate the resistance of a modern-day RKE system. Our study disclosed a Rolling-PWN attack vulnerability affects all Honda vehicles currently existing on the market (From the Year 2012 up to the Year 2022). This weakness allows anyone permanently opens the car door or even start the car engine from a long-distance away.

The Rolling-PWD bug is a severe vulnerability. We found it in a vulnerable version of the mechanism of the rolling code, which was implemented in a huge amount of Honda vehicles. A rolling code system in keyless entry systems is to prevent replay attacks; after each keyfob button is pressed, the rolling codes synchronizing counter increases. However er, the vehicle receiver will accept a sliding window of codes to avoid accidentally being key pressed by design. Sending the commands in a consecutive sequence to the Honda vehicles will resynchronize the counter. Once the counter is resynced, commands from the previous cycle of the counter are reworked again. Therefore, those commands can be used later to unlock the car.

Credit. Pablo Palacios
shorturl.at/cdrwZ