Rolling-PWN vulnerability affects all Honda vehicles

Isn't it potentially a replay attack the poster is describing?

In a simple form it seems like this: The attack is you have a briefcase that contains specific RF transceiving components in it. You turn the brief case on in a hidden place, leave it, it records data, you come back to it later, and then press a button(s) that replays those RF signals.

Perhaps, there's some very weak cars that don't even need a replay, but are vulnerable to a master key, or bruteforce, or something else.

25 years ago, a (then) friend had a nice car, bought it new. IIRC it was a BMW. He was hypervigilent about its condition. One night some thieves broke into his car and did some damage. Replacing the window wasn't a worry -- that can be replaced good as new, but they had put some dings in the hood somehow.

He was worried that insurance wouldn't replace the hood but would just pay someone to try to knock them back into shape, which was unacceptable to him. So he went and bashed up the hood himself with a bat. The insurance claims guy came out to inspect it and said: we'll replace the window and we'll have a shop hammer out out the damage in the hood.

Served him right.

It's not like keys for pin tumbler locks are very secure either.

I think the main drawback of wireless unlocking is that hacking it is less conspicuous. If you have a device that can unlock a car in 10 times the time it takes with the legitimate key that looks suspicious if you spend that time holding an object to a keyhole, it's completely unnoticeable if you stand a couple meters away on a parking lot doing it wirelessly. Even worse with a method that works on 10% of cars: with a physical keyhole you go from car to car, looking very suspicious, with a wireless device you just stand there and go to the first car that unlocks.

That would be hard-coded on the vehicle side, but this looks more like a simply signal jammer that is described in this attack. They simple jam the RKE Lock command when you're leaving your car, you don't pay attention to the light signalization for the successful Lock and move on. They come and still anything valuable from the inside.

While it won't be true for all and can often be configured, many keyless entry systems nowadays lock the doors once key leaves vicinity of the car whether you remember to lock the doors or not.

how do you put a real time clock into a key fob that can actually keep time?

I would argue that both problems are real. Yes, Honda’s resynchronization system is very weak, and a good system would require the owner to actually repeatedly press the button to resync and/or should only ever resync forward. But one-way protocols are also inherently vulnerable to long-range replay attacks if the owner can be convinced to push the bottom near the attacker even if they’re far from the car, and this is not really excusable for a device costing at least $10 (retail) talking to a car that costs thousands of dollars. A microcontroller with a bidirectional radio is cheap. Heck, an NFC device communicating using backscatter modulation that works with no battery is cheap enough for this application. You can find them in disposable subway tickets!

What is a bidirectional fob doing resyncing at all? There is absolutely no need for any sort of state in a bidirectional if any reasonable protocol is used. The fob should not even need writable nonvolatile memory.

Your example involves two-way communication. These cheap key fobs are one-way. It’s more like:

(Press button) “hey, I’m the fob!”

(Press button) “hey, I’m the fob!”

There’s no communication back from the car because these systems are physically incapable of it.

Also, without some elaboration, your example is vulnerable to a replay attack too, but it’s not conceptually hard to fix. A simple arrangement that probably works (but would want a proof!) is:

“Hey, I’m fob #123” “Hey fob #123, I’m the car. The challenge is abc. Answer after 5ms.” “Hey car, HMAC(‘abc’, our secret) = ‘xyz’)”

And the car answers and also checks that the answer was received no more than 5.0000001 ms later. There are more clever variants of this sort of thing in the literature, and I don’t think cars use them because the manufacturers don’t seem to care. (The main problem with the scheme above that I’m immediately aware of is that it requires very good timing. If the microcontroller in the fob takes nearly 5ms to calculate the MAC and the goal is 100ns of allowable latency (100 ms is about 100 light-feet), then the timing precision needed is 20 ppm. Getting precision that good on a cheap key fob may be challenging. For that matter, getting that level of precision in the car, which may be rather hot, may cost more than the manufacturer wants to pay. More clever schemes don’t need this kind of precision. Also, my silly scheme has the fob broadcasting its identity every time a button is pressed, which isn’t great.)

So someone can pick a lock on your door and hotwire your car and steal it. But with this attack they can only get access to the car. Hotwiring if there is an immobilizer is not possible.

The lack of an immobilizer is why the 1997 Honda Civic was one of the most stolen cars ever

I absolutely don't blame them either, I wish more people showed how absolutely insecure most modern systems are.

I'm was simply writing my comment out of worry for their safety, nothing else.

> What would the illegal part be in this instance?

I don't know exactly what country they're located in, but I'm assuming that filming yourself unlocking random peoples car in the wild can be classified as breaking into something, especially if a corporation would like to hide a story and have government contacts they can engage in the silencing.

I don't see anything wrong with what they did, they went above and beyond to test Honda's systems for Honda, in exchange for nothing. But I do worry about courts not being as technically adept as me, and not seeing it like this.

Honda makes great, reliable cars but they don’t give a shit about software or stuff like this.

Consider their refusal to fix their head units - https://didhondafixtheclocks.com/

Yeah I suppose that's one way to do it. I go for the combo of having a garage and driving a manual, which is itself a theft prevention device in the US these days

I also used to start the car in neutral, which doesn't work on new cars

This effect only helps future car buyers, it doesn’t make the owners of vulnerable vehicles any safer or compensate them in any way.

>The result? Sales dropped for those cars, no one wants to pay 50% more for insurance, and manufacturers quickly worked to fix the issue.

In all cases the margins were razor thin. Poorly equipped cars were stolen marginally more and likewise cost a trivial amount more to insure.

But personal new car buying is 500% driven by consumers using emotion driven logic to magnify tiny differences so sales dropped, somewhat, maybe. It's hard to separate this from the variable of older products and cheaper products generally selling less well than the new hotness. Column locks went on to become standard as OEMs refreshed product lines and did mid-life facelifts.

Same thing happened when EMV was first rolled out. There was replay attack fraud, but the cardholder was blamed for it. But once you get enough complaints, it forces insurance and gov oversight into action as you describe. Article from Brian Krebs on EMV implementation issues back in 2014 timeframe for example: https://krebsonsecurity.com/2012/09/researchers-chip-and-pin...

Nope, it's still just a bucket of bolts kept running but just barely. It's now got a paperclip under the hood to keep the rad fan on and a couple of functional nickels under the dash as part of the breaking system.

Can confirm.

Source: Aforementioned 2000 CRV stolen once (Chicago =D) AND RECOVERED. Totally still working just dinged up a bit. They left it parked in front of a hydrant with the doors and windows open! Insurance totaled it, but said I could keep it.

That's the story of why I still have and drive a 22 year old, 5-speed, 2000 CRV. Hard to sell with the 'rebuilt' title, still runs great though. Dented up like a truck, but only has 135k miles. It's a keeper. My 'city' car.

Subaru really sold a car without a remote locking key/fob in 2018?? Almost every Subaru ever in the past 10 years has a key with remote lock/unlock functionality just like the one in the Rolling-PWN example linked above. In North America you'd have to try really hard to buy the cheapest new car you could find to get a dumb key, and even then it probably has remote central locking and potential vulnerabilities to replay attacks.

Your chance of getting a new car any time in the last decade that has no remote central locking and no potential replay attack surface is very, very low - this attack vector has been proven in many car key fobs for a long time.