Hello, my Merry en 🐭🧩

I want to give you the automotive vulnerability CVE-2022-27254 . 🚗

It affects some models of Honda and Acura cars.

In it, an attacker can gain full and unrestricted access to lock, unlock, control windows, open the trunk, and start the engine of the target vehicle

The attack is this: the attacker intercepts radio frequency signals from your key fob, and re-sends them to gain control of the system without your car key.

Read more CVE-2022-27254, is a MitM attack or, more specifically, a replay attack in which an attacker intercepts RF signals normally sent from a remote key fob to your car.
Then re-sends them to unlock the car at will.
Simply capturing the signal sent from the FOB is enough to gain some control over the vehicle, lol😶‍🌫️.
If a target locks their car, all it takes is getting their signal and saving it to be able to replay the same command and get an appropriate response from the car.

Honda told us that several automakers are using outdated technology to implement remote locking and unlocking features, and therefore may be vulnerable to "determined and very technically advanced thieves."

"Currently, the devices seem to work only in close proximity or are physically attached to the target vehicle, requiring local reception of radio signals from the vehicle owner's key fob when the vehicle is opened and started nearby."

Note that in its statement, Honda explicitly mentions that it has not verified the information provided by the researchers and cannot confirm whether Honda vehicles are indeed vulnerable to this type of attack.

And as you can understand they're not too keen on fixing it. 

And that's it, be careful with your autos. 🚘

Here are some useful links to various poc and articles about this vulnerability

Link
Link
Link
Link
Link

Thanks for reading❤️
And remember: The baby the Duchess is rocking is actually a piggy 🐷
#car #attacks #cve #exploit #news