Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Honda Civics and the Evil Valet

juniperspring.org

Post reply on HN
Print view View original

91–100 of 105 posts

Re: Honda Civics and the Evil Valet

#91

Post by SoftTalker »

bri3d wrote: post #82
hahamaster wrote: post #49

I wish other car makers were as reasonable as Honda here. No "evil valet" with half a brain cell would waste time hacking the head unit if they have physical access to the car. They would simply hide a spying device somewhere in the car. Not to mention that people with Civics are never targets of three letter agencies.

I'm hoping this comment is a joke? It's kind of nonsensical. > I wish other car makers were as reasonable as Honda here. I doubt they did this on purpose. > No "evil valet" with half a brain cell would waste time hacking the head unit if they have physical access to the car. Keep in mind that head units usually also contain historic data; stuff like left-over synced phone contacts in SQLite databases, historic locati…

> ???

People who drive Civics are boring, normal people with boring, normal lives. Not of any interest to the NSA.

Re: Honda Civics and the Evil Valet

#92

Post by cardiffspaceman »

SoftTalker wrote: post #91
bri3d wrote: post #82

Earlier quoted context omitted.

I'm hoping this comment is a joke? It's kind of nonsensical. > I wish other car makers were as reasonable as Honda here. I doubt they did this on purpose. > No "evil valet" with half a brain cell would waste time hacking the head unit if they have physical access to the car. Keep in mind that head units usually also contain historic data; stuff like left-over synced phone contacts in SQLite databases, historic locati…

> ??? People who drive Civics are boring, normal people with boring, normal lives. Not of any interest to the NSA.

The question marks are because it’s practically a trope that the most interesting subjects disguise their importance by driving Civics and such.

Re: Honda Civics and the Evil Valet

#93

Post by saaaaaam »

drew870mitchell wrote: post #87
saaaaaam wrote: post #52

Earlier quoted context omitted.

Not sure if you’re being sarcastic/satirical or not. If you are, fine. But if you’re not - why would someone driving a civic not be a target of an intelligence agency? It’s one of the most common cars about there, so if you want to fade into the background it’s a perfect car. Also, lots of otherwise “normal” people - scientists, engineers, journalists, lawyers - likely drive Honda civics. A spying device hidden in th…

Whenever we get to talking about three letter agencies, i wish people spent more time thinking about their threat model. Is the TLA surveilling me because they're broadly interested in everybody? OK then, the return on investment isn't there to pull an evil maid attack on public randos. If the TLA is interested in you because of who you specifically are, the average individual can't begin to plug all the possible hol…

I wasn’t making any comment on whether cars should be hackable or not, simply that saying “people with Civics are never targets of three letter agencies” is a little silly.

Re: Honda Civics and the Evil Valet

#94

Post by bravetraveler »

SoftTalker wrote: post #91
bri3d wrote: post #82

Earlier quoted context omitted.

I'm hoping this comment is a joke? It's kind of nonsensical. > I wish other car makers were as reasonable as Honda here. I doubt they did this on purpose. > No "evil valet" with half a brain cell would waste time hacking the head unit if they have physical access to the car. Keep in mind that head units usually also contain historic data; stuff like left-over synced phone contacts in SQLite databases, historic locati…

> ??? People who drive Civics are boring, normal people with boring, normal lives. Not of any interest to the NSA.

That's what Civic-driving people who are of interest to The Agency would say :)

Re: Honda Civics and the Evil Valet

#95

Post by iugtmkbdfil834 »

I keep hoping that one of those hacks will eventually be available for Ford Lightning. There is a reason why Civics were a target for hacking ( relative low cost of failure ).

But we go back to the old question of: Why do I have to rely on hacks ( like with cellphones, tvs and so on )? Why am can't it be ready for heavy customization ootb ( and before you tell me that people do dangerous stuff on the roads -- have you driven around lately )?

Re: Honda Civics and the Evil Valet

#96

Post by ErroneousBosh »

cardiffspaceman wrote: post #92
SoftTalker wrote: post #91

Earlier quoted context omitted.

> ??? People who drive Civics are boring, normal people with boring, normal lives. Not of any interest to the NSA.

The question marks are because it’s practically a trope that the most interesting subjects disguise their importance by driving Civics and such.

Literally a plot point in Breaking Bad.

Re: Honda Civics and the Evil Valet

#97

Post by hparadiz »

Tribesman3875 wrote: post #81
hparadiz wrote: post #13

Earlier quoted context omitted.

The head units themselves are very dated and simply could not run recent versions of Android. I have a 2020 and I'm always eyeing up the after market units which are all better in every way.

its not about them being dated, or fast. Its the fact that the head unit will work in 10 years vs the aftermarket one probably dying in 2.

I don't think I've ever seen a head unit die. After market or otherwise. It's usually all those pesky moving parts in the front that go first.

Re: Honda Civics and the Evil Valet

#98

Post by bigfatkitten »

Spooky23 wrote: post #80
bigfatkitten wrote: post #34

Most (if not all) cars on the road are terrible in terms of the security of the infotainment system and other onboard electronics. What makes this even worse is the sensors they have onboard these days; the microphones, cameras, GNSS receivers, wifi and BT radios make them into mobile surveillance platforms. In March 2026, a bunch of controls were added to the Australian Government Information Security Manual[0] basi…

They’re fine. It’s a car radio, not a critical system. The people who are vulnerable to this type of attack have procedures and trusted equipment to conduct their business (or not). US police agencies have had rules like this for rental cars since OnStar came out. Most of the dangerous telematics information for the average person is offered for sale anyway.

No, they’re buying, renting and driving cars from the same places as everyone else.

Re: Honda Civics and the Evil Valet

#100

Post by bri3d »

jgalt212 wrote: post #75

I think Porsche (and related brands) also have this or a somewhat similar vulnerability. Owners use it to add Android Auto to a car that formerly only supported Apple Carplay.

That's VW AG "MIB" - a lot of these units had fixed per-infotainment-model root passwords and a shell service exposed over SSH or Telnet, so one could dump the flash memory directly from the board and crack the password hashes, then use some exposed network interface (on some, WiFi, on others, a USB Ethernet device would work) to get a shell.

Eventually a better vulnerability was discovered where the signature validator didn't work properly:

The vulnerability used there is explained here: https://github.com/jilleb/mib2-toolbox/issues/122 . It's a "classic" mistake in signature validation (iirc the Windows software licensing service had a similar vuln at some point) but is a lot less trivial than this one; basically, the signature validator would stop validating once validation succeeded, so it was possible to take a valid update manifest and just tack more instructions onto the end of it and it would happily run them (the validation would return True, and then the command-runner would happily iterate through everything it got).

There's also a vulnerability on the lower tier models that revolves around a logic error and a signed update which would copy unsigned files into a directory due to some issue with the path validation that I can't completely recall at this point, as used in https://github.com/olli991/mib-std2-pq-zr-toolbox .

Anyway, these were a lot more exciting from a vuln research standpoint than this one (the MIB head units are also _fascinating_; they are not standard Tegra Android devices but a morass of rare and exotic DSP hardware driven by QNX and a giant enterprise IBM Java applicatoin).

Post reply on HN