Skip to content

touch-ups for style and added link #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
attritionorg wants to merge 1 commit into
base: main
Choose a base branch
from
Open

touch-ups for style and added link #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 7 additions & 13 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,10 @@ https://user-images.githubusercontent.com/43358273/127954308-5519436a-d980-420d-

*"Can you believe that a low-quality garage door has better security than a Honda?"*

*"Unoriginal-Rice-Patty" is my personal title for the Replay-based attack on Honda and Acura vehicles*
*"Honda" in Japanese translates to "Original Rice Patty". While a cute fact, this attack is not cute and not original, hence the name*
*"Unoriginal-Rice-Patty" is my personal title for the Replay-based attack on Honda and Acura vehicles.*
*"Honda" in Japanese translates to "Original Rice Patty". While a cute fact, this attack is not cute and not original, hence the name.*

*This is for educational purposes only. I am in NO WAY liable for any actions executed by means of the contents within this repository. PLEASE use responsibly.*
*This is for educational purposes only. I am in *NO WAY* liable for any actions executed by means of the contents within this repository. *PLEASE* use responsibly.*

This attack seems to affect EVERY Honda/Acura vehicle with remote/wireless radio entry. Honda does *NOT* ever institue a rolling code system and *ONLY* manufactures systems with static codes meaning there is NO layer of security.

Expand All @@ -20,15 +20,14 @@ A hacker can gain complete and unlimited access to locking, unlocking, controlli
Simply capturing the signal sent from a FOB is enough to gain at least *some* control of the vehicle. If the target locks their vehicle, all it takes is
receiving it and saving it for me to gain the ability to replay the same command and have the vehicle respond accordingly.

Recording the "unlock" command from the target and replaying (this works on most if not all of Honda's produced FOBs) will allow me to unlock the vehicle whenever I'd like to, and it doesn't stop there *at all*
On top of being able to start the vehicle's *ENGINE* *Whenever I wished* through recording the "remote start", it seems possible to actually (through Honda's "Smart Key" which uses FSK) demodulate any command, edit it, and retransmit in order to make the target vehicle do whatever you wish.
Recording the "unlock" command from the target and replaying (this works on most if not all of Honda's produced FOBs) will allow me to unlock the vehicle whenever I'd like to, and it doesn't stop there *at all*. On top of being able to start the vehicle's *ENGINE* *Whenever I wished* through recording the "remote start", it seems possible to actually (through Honda's "Smart Key" which uses FSK) demodulate any command, edit it, and retransmit in order to make the target vehicle do whatever you wish.

For Example:
Recording a "lock" command and flipping the following bits:

```653-656, 667-668, 677-680, 683-684, 823-826, 837-838, 847-850, 853-854```

will tell the vehicle to unlock (These numbers include the preamble)
will tell the vehicle to unlock (These numbers include the preamble).

I discovered this while analyzing the codes with my published Python script, "DiffBits" which is based on Samy Kamkars Perl script of the same name.

Expand Down Expand Up @@ -60,15 +59,10 @@ what action the vehicle must perform.


## The Interesting Part
Honda seemingly ignored CVE-2019-20626 (cited above in the list of confirmed, affected vehicles). They continued to implement 0 security measures against
this very simple "replay/replay and edit" attack. This CVE interestingly only cites one vehicle and I only discovered this much later in my pursuit for
research. Honda will not respond to me, or seemingly anyone attempting to report this security MAJOR flaw.
Honda seemingly ignored [CVE-2019-20626](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20626) (cited above in the list of confirmed, affected vehicles). They continued to implement 0 security measures against this very simple "replay/replay and edit" attack. This CVE interestingly only cites one vehicle and I only discovered this much later in my pursuit for research. Honda will not respond to me, or seemingly anyone attempting to report this security MAJOR flaw.

## How Honda Can Fix This
Honda must implement a "rolling code" system into their vehicles' list of security measures. Rolling code systems have been around since 1995 and
work very well against hackers. Honda has seemingly never implemented this security measure, leaving them very far behind in the race toward a secure
technological future. As far as I can tell, this isn't easily "patchable". Honda can begin to implement security measures in future vehicles, however
it doesn't seem likely that they will go back and fix this security issue in older models.
Honda must implement a "rolling code" system into their vehicles' list of security measures. Rolling code systems have been around since 1995 and work very well against hackers. Honda has seemingly never implemented this security measure, leaving them very far behind in the race toward a secure technological future. As far as I can tell, this isn't easily "patchable". Honda can begin to implement security measures in future vehicles, however it doesn't seem likely that they will go back and fix this security issue in older models.

## Epilogue
I am very interested in community feedback! Feel free to contact me with more research, information, or questions!