wp-plugin-hostgator
domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init
action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home4/scienrds/scienceandnerds/wp-includes/functions.php on line 6114ol-scrapes
domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init
action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home4/scienrds/scienceandnerds/wp-includes/functions.php on line 6114Source: https:\/\/www.theverge.com\/2022\/7\/11\/23204663\/honda-remote-keyfob-hack-rolling-pwn-demonstration-security<\/a> Security researchers and The Drive<\/em>\u2019s Rob Stumpf have recently posted videos of themselves<\/a> unlocking and remotely starting several Honda vehicles using handheld radios, despite the company\u2019s insistence that the cars have security protections meant to stop attackers from doing that very thing. According to the researchers, this hack is made possible because of a vulnerability in the keyless entry system in many Hondas made between 2012 and 2022. They\u2019ve dubbed the vulnerability Rolling-PWN<\/a>.<\/p>\n The basic concept for Rolling-PWN is similar to attacks we\u2019ve seen before used against VWs and Teslas<\/a>, as well as other devices<\/a>; using radio equipment, someone records a legitimate radio signal from a key fob, then broadcasts it back to the car. It\u2019s called a replay attack, and if you\u2019re thinking that it should be possible to defend against this kind of attack with some sort of cryptography, you\u2019re right. In theory, many modern cars use what\u2019s called a rolling key system, basically making it so that each signal will only work once; you press the button to unlock your car, your car unlocks, and that exact signal shouldn\u2019t ever unlock your car again.<\/p>\n But as Jalopnik<\/em> points out<\/a>, not every recent Honda has that level of protection. Researchers have also found vulnerabilities where surprisingly recent Hondas (2016 to 2020 Civics, specifically) instead used an unencrypted signal that doesn\u2019t change<\/a>. And even those that do have rolling code systems \u2014 including the 2020 CR-V, Accord, and Odyssey, Honda tells Vice \u2014 may be vulnerable to the recently-uncovered attack. Rolling-PWN\u2019s website has videos of the hack being used to unlock those rolling code vehicles, and Stumpf was able to… well, pretty much pwn a 2021 Accord<\/a> with the exploit, turning on its engine remotely and then unlocking it.<\/p>\n Honda told The Drive<\/em> that the security systems it puts in its key fobs and cars \u201cwould not allow the vulnerability as represented in the report\u201d to be carried out. In other words, the company says the attack shouldn\u2019t be possible \u2014 but clearly, it is somehow. We\u2019ve asked the company for comment on The Drive<\/em>\u2019s demonstration, which was published on Monday, but it didn\u2019t immediately reply.<\/p>\n According to the Rolling-PWN website, the attack works because it\u2019s able to resynchronize the car\u2019s code counter, meaning that it\u2019ll accept old codes \u2014 basically, because the system is built to have some tolerances (so you can use your keyless entry even if the button gets pressed once or twice while you\u2019re away from the car, and so the car and remote stay in sync), its security system can be defeated. The site also claims that it affects \u201call Honda vehicles currently existing on the market,\u201d but admits that it\u2019s only actually been tested on a handful of model years. <\/p>\n Even more worryingly, the site suggests that other brands of cars are also affected, but is vague on the details. While that makes me nervously eye my Ford, it\u2019s actually probably a good thing \u2014 if the security researchers are following standard responsible disclosure procedures, they should be reaching out to automakers and giving them a chance to address the issue before details are made public. According to Jalopnik<\/em>, the researchers had reached out to Honda, but were told to file a report with customer service (which isn\u2019t really standard security practice).<\/p>\n<\/div>\n
\n
<\/br><\/code><\/p>\n