As a cybersecurity writer, I’m more aware than the average person of the security risks with any connected device. So when I sat in my new car for the first time and saw all the different ways it linked to my phone or my home WiFi, more than a few red flags went up. I know that as cars get smarter, they become more susceptible to hackers who are searching for any potential vulnerability. One of the most recently announced attack vectors is the key fob for recent model Honda vehicles.

Vehicle vulnerabilities

Most IoT or smart devices were never designed with cybersecurity in mind, but vehicles take that lack of security to a higher level, with piecemeal technologies developed by third-party companies. The same risks found in any connected device are found in a smart car. Threat actors have the opportunity to do almost anything, from stealing personal data to manipulating any of the different systems and sensors in the vehicle. But the most popular attack vector, at least for now, is the wireless key fob.

Tesla cars have made news recently due to several different key-fob-related exploits. For example, a teenager found a vulnerability in an app that controls some basic functions like unlocking the vehicles or flashing the headlights. Meanwhile, a European researcher discovered Tesla’s near field communication (NFC) card that’s used like a key fob can easily be exploited by hackers, all because Tesla provides a 130-second window between unlocking the car and starting the engine.

While Tesla vulnerabilities may get high-profile attention, key fob vulnerabilities are found in vehicles more commonly found in public parking lots, in neighborhood driveways and as part of corporate vehicle fleets.

Rolling-PWN

The key fob attack impacting Honda vehicles is known as the Rolling-PWN. Rolling codes are used to avoid replay attacks, which are man-in-the-middle attacks that are intercepted and re-transmitted as if they are authentic codes. The attack exploits a vulnerability in authentication code transmitted wirelessly between the fob and the vehicle. Whenever the fob button is pressed, there is an increase in rolling codes that are synchronizing. Honda vehicles don’t need the exact codes — instead, the rolling codes fall into a window of codes.

“By sending the commands in a consecutive sequence to the Honda vehicles, it will be resynchronizing the counter. Once [the] counter resynced, commands from the previous cycle of the counter worked again. Therefore, those commands can be used later to unlock the car at will,” according to GitHub.

Even though this vulnerability became news over the summer of 2022, the vulnerability was found in 2012 Honda cars and should be assumed to affect every Honda on the market today.  Whoever has access to these codes has permanent access to unlock the car doors and possibly start the vehicle.
Today, Rolling-PWN appears to only target Honda vehicles, but, like any type of cyberattack, expect any system that uses this type of rolling code technology to be at risk.

Problem of encryption

Key fobs have evolved over the past two decades beyond when their primary purpose was to unlock doors. Depending on the brand and model of the vehicle, the fob offers controls for almost everything – opening windows, remotely starting the engine and defrosting the windshield, just for starters. Many fobs are connected with a smartphone app.

Although the fobs are encrypted, they tend to use symmetric encryption or a single key used by both the device sending the message and the device receiving it. The problem with symmetric encryption is that it can be easily intercepted.

Asymmetric encryption, which uses both a public and a private key, is a much more secure method of code transmission. But as Alan Grau explained in an Electronic Design article, “it can easily use 100X more CPU cycles than symmetric encryption.” It’s too much for systems to handle in a timely manner, so manufacturers default to symmetric encryption and take the risk of the codes being intercepted.

Keeping vehicles safe

Company-owned vehicles aren’t usually under the oversight of CIOs and CISOs, but as more smart vehicles enter the corporate fleet, the cyber risks need to be addressed. While a CISO can’t change the type of encryption used on a key fob, they can take steps to protect the vehicles from cyberattacks.

Specifically for Rolling-PWN, GitHub stated, “the recommended mitigation strategy is to upgrade the vulnerable BCM firmware through Over-the-Air (OTA) Updates if feasible.” Currently, Honda is not conducting a recall on their cars or key fobs to remediate the vulnerability.

Beyond that, smart cars need to be addressed just as any other connected computer system. That includes following basic security practices, such as regular software updates on both the vehicle and any devices connected to the vehicle. That includes WiFi. And because cars need regular maintenance and repairs, only trusted third parties should be allowed access to the vehicle and its hardware. Including – and maybe especially – the key fobs.

More from Risk Management

What to know about new generative AI tools for criminals

3 min read - Large language model (LLM)-based generative AI chatbots like OpenAI’s ChatGPT took the world by storm this year. ChatGPT became mainstream by making the power of artificial intelligence accessible to millions.The move inspired other companies (which had been working on comparable AI in labs for years) to introduce their own public LLM services, and thousands of tools based on these LLMs have emerged.Unfortunately, malicious hackers moved quickly to exploit these new AI resources, using ChatGPT itself to polish and produce phishing…

The Growing Risks of Shadow IT and SaaS Sprawl

4 min read - In today's fast-paced digital landscape, there is no shortage of apps and Software-as-a-Service (SaaS) solutions tailored to meet the diverse needs of businesses across different industries. This incredible array of options has revolutionized how we work, providing cost-effective and user-friendly tools that streamline tasks and boost productivity. However, this ever-expanding application ecosystem comes with its challenges: namely, shadow IT and SaaS sprawl. According to a recent study by Entrust, 77% of IT professionals are concerned about shadow IT becoming a…

Are you ready to build your organization’s digital trust?

4 min read - As organizations continue their digital transformation journey, they need to be able to trust that their digital assets are secure. That’s not easy in today’s environment, as the numbers and sophistication of cyberattacks increase and organizations face challenges from remote work and insider behavior. Digital trust can make your organization’s digital transformation stronger. A lack of digital trust can do irreparable harm. However, according to ISACA’s State of Digital Trust 2023 report, too many organizations struggle to define and implement…

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging. We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically. For this reason, 75% of organizations…