A security flaw related to Honda’s keyless entry systems could leave all of the automaker’s vehicle models released since 2012 vulnerable to outside hackers, according to claims by a pair of security researchers and multiple reports this week.
The so-called “Rolling-Pwn” attack allows hackers to remotely steal codes linked to Honda owners’ key fobs, according to a pair of Star-V Lab security researchers identified by the names Kevin2600 and Wesley Li.
The hackers can use the stolen data to remotely unlock doors and even start car engines, according to the researchers.
“This weakness allows anyone to permanently open the car door or even start the car engine from a long distance,” the researchers said in a blog post detailing their findings.
“We found it in a vulnerable version of the rolling codes mechanism, which is implemented in huge amounts of Honda vehicles,” they added.
The researchers said they tested the vulnerability on the 10 most popular available Honda car models released over the last decade. They also included videos demonstrating the method and its results.
“Therefore, we strongly believe the vulnerability affects all Honda vehicles currently existing on the market,” they added.
The Drive independently confirmed the researchers’ findings by testing the “Rolling-Pwn” attack on a 2021 Honda Accord and a software-defined radio.
A Honda spokesperson confirmed the flaw in a statement to The Post and said it impacted “certain vehicles,” but did not provide further comment on how extensive the problem was.
“We can confirm researcher claims that it is possible to employ sophisticated tools and technical know-how to mimic Remote Keyless commands and gain access to certain vehicles or ours,” the Honda spokesperson said.
“However, while it is technically possible, we want to reassure our customers that this particular kind of attack, which requires continuous close-proximity signal capture of multiple sequential RF transmissions, cannot be used to drive the vehicle away,” the spokesperson added. “Furthermore, Honda regularly improves security features as new models are introduced that would thwart this and similar approaches.”
Honda had earlier downplayed the flaw in a statement to Vice, calling it “old news.“
