Connect with us

Hi, what are you looking for?


IoT Security

Researchers Hack Remote Keyless System of Honda Vehicles

A researcher has published proof-of-concept (PoC) videos to demonstrate how an attacker can remotely unlock the doors of a Honda vehicle, or even start its engine.

A researcher has published proof-of-concept (PoC) videos to demonstrate how an attacker can remotely unlock the doors of a Honda vehicle, or even start its engine.

The attack is possible because of a vulnerability in the car manufacturer’s remote keyless system (CVE-2022-27254) that appears to impact all Honda Civic (LX, EX, EX-L, Touring, Si, and Type R) models between 2016 and 2020.

The issue is that the same unencrypted radio frequency (RF) signal is sent for commands to unlock/lock doors, open the boot, or start the engine remotely, Ayyappan Rajesh, a student at University of Massachusetts Dartmouth, explained.

Because of that, an attacker in a man-in-the-middle position could eavesdrop on the request and then use it to launch a replay attack.

Basically, if the attacker is located near a vulnerable vehicle, they can record the remote signal sent by the car owner to wirelessly open and start the vehicle, and later perform the same action by themselves.

[ READ: Vulnerabilities Expose Lexus, Toyota Cars to Hacker Attacks ]

The issue, however, is not new. In fact, researchers initially identified the possibility of such attacks in 2017, and a CVE identifier was issued in 2019 (tracked as CVE-2019-20626).

Advertisement. Scroll to continue reading.

One researcher claims that, “a hacker can gain complete and unlimited access to locking, unlocking, controlling the windows, opening the trunk, and starting the engine of the target vehicle.”

The researcher claims that while CVE-2019-20626 was proven to impact various Honda vehicle models, the car maker continued to use the vulnerable system in production.

According to the researcher, attacks can be prevented if users refrain from using their RF fobs and if Honda implements a “rolling code” system, where a new code is generated each time the user presses the button on their fob, thus offering a more secure authentication system.

[ READ: Connected Cars Could be a Threat to National Security, Group Claims ]

“Honda has not verified the information reported by this researcher and cannot confirm if its vehicles are vulnerable to this type of attack. Honda has no plan to update older vehicles at this time,” a Honda spokesperson told SecurityWeek.

“At this time, it appears that the devices only appear to work within close proximity or while physically attached to the target vehicle, requiring local reception of radio signals from the vehicle owner’s key fob when the vehicle is opened and started nearby,” the spokesperson continued.

Honda also said that even if an attacker employs this attack to unlock a car’s door and start the engine remotely, they won’t be able to drive it away unless “a valid key fob with a separate immobilizer chip is present in the vehicle, reducing the likelihood of a vehicle theft.”

“There is no indication that the reported vulnerability to door locks has resulted in an ability to actually drive an Acura or Honda vehicle,” the spokesperson concluded.

Related: New Flaws Expose EVlink Electric Vehicle Charging Stations to Remote Hacking

Related: Misconfigured CalAmp Server Enabled Vehicle Takeover

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

IoT Security

A vulnerability affecting Dahua cameras and video recorders can be exploited by threat actors to modify a device’s system time.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

IoT Security

Today’s growing attack surface is dominated by non-traditional endpoints.

IoT Security

An innocent-looking portable speaker can hide a hacking device that launches CAN injection attacks, which have been used to steal cars.

IoT Security

Vulnerabilities in electric vehicle charging management systems can be exploited for DoS attacks and to steal energy or sensitive information.

Cybersecurity Funding

Internet of Things (IoT) and Industrial IoT security provider Shield-IoT this week announced that it has closed a $7.4 million Series A funding round,...

IoT Security

Chinese video surveillance company Hikvision has patched a critical vulnerability in some of its wireless bridge products. The flaw can lead to remote CCTV...