A team of researchers from Star-V Lab discovered a new vulnerability in Honda cars that allow the cars to be unlocked or started remotely. The vulnerability, dubbed “Rolling-PWN”, has been tested on the popular Honda models Civic (2012 & 2022), X-RV (2018), C-RV (2020), Accord (2020), Odyssey (2020), Inspire (2021), Fit (2022), VE-1 (2022), and the Breeze (2022), though the researchers theorize the attack works on most Honda models. The attack exploits the rolling code mechanism that is used to verify the keyfob button presses and prevent man-in-the-middle replay attacks. Rolling codes are generated using a pseudorandom number generator algorithm that ensures each button press outputs a unique random string for authentication. Authentication also relies on a counter that prevents old codes from being used. The researchers discovered that the counter is “resynchronized” when multiple old codes were replayed in the correct sequence, resetting the counter back to the value of the old codes. This allows attackers to capture a series of valid consecutive codes and then replay them at any later point to unlock or start the car. If a car is started by the attacker, it cannot be driven as the keyfob must be in close proximity to the vehicle while it is running. While this has been tested and proven to work against Honda vehicles, the researchers believe other brands may be affected. Honda has denied this vulnerability, stating “the key fobs in the referenced vehicles are equipped with rolling code technology that would not allow the vulnerability as represented in the report.” The company also questions the legitimacy of the video by adding “in addition, the videos offered as evidence of the absence of rolling code do not include sufficient evidence to support the claims.” The issue has reportedly been verified by multiple independent journalists and researchers, contradicting Honda’s statements. If the issue is deemed valid by Honda, newer models may be able to receive a software update to fix the issue. Older models may prove more difficult to upgrade as they are not connected to the internet. CTIX analysts will continue to monitor the situation and will provide updates if any actions are required by Honda users.