As more and more of the ‘smart’ infotainment systems in cars begin to age out of support, it becomes increasingly more relevant to figure out how to do something with that lump of computer-and-display sitting prominently in the dashboard.
Here [Eric McDonald]’s reverse-engineering of the 2012-era Android-based infotainment system in a 2021 Honda Civic is an interesting case study, with recently the discovery made that the head unit of these infotainment systems can be updated via USB by using standard Android Open Source Project (AOSP) test keys as these were left on the file system.
This is a nice update to his initial reverse-engineering back in the innocent days of 2023, when such a facepalm-worthy exploit seemed unimaginable, but then the ‘s’ in ‘infotainment’ has always stood for ‘security’. In this exploit that [Eric] calls the EvilValet attack, it means that anyone with physical access to the USB port inside the car can theoretically run arbitrary code signed with these test keys, as documented in the GitHub project.
So far this rather foolish security issue has only been confirmed on [Eric]’s 2021 Honda Civic, but considering how those – often third-party – infotainment systems tend to get reused and recycled across generations and car variants, it’s quite possible that more Android-based infotainment systems have this vulnerability.
This exploit is obviously a double-edged sword, as on one hand it’s great that an owner of one of these cars can now basically do whatever they want with said infotainment system, but on the other hand it means that anyone who slides into your car with a USB stick can do the same.
One of my most amusing realizations about how this world works is what Honda Civics taught me about “brand maturation.” When a cheapo brand like the Honda Civic is introduced, young people buy it, fall in love, and become loyal customers. They get richer too, and want bigger cars that burn more gasoline. Honda dutifully changed the Civic to suit. It is no longer a cheapo little car for broke young people, something I discovered in my late 30s when I went to buy my fourth or fifth Civic. Now you have to buy a Honda Fit for that product, though of course some day there will be a Honda Fit SUV.
I’m in my mid 40s, have a great job and am more than capable of buying a more expensive car. I still drive my 09 fit which is about to approach 300k miles. It gets me where I am going reliably with no payment and relatively good gas mileage. Meanwhile the money I could pay for a ‘better’ car goes towards building the retirement fund with which I hope to one day buy some time to hack on my own projects before I die.
I actually like cars. But I am convinced that people spend way too much on them. It’s a brainwashed culture thing.
I totally agree; a car is just a tool for me. if i can strap a sheet of plywood to a roof rack, my Subaru has more utility that a pickup truck with a tiny bed designed for weeny country wanna-bes whose idea of rural living is spending all weekend mowing a five acre yard. i only buy used. my best score so far was a $14K used Chevy Bolt for which i got a BRAND NEW battery after everyone lost their minds about them bursting into flames and there was a recall.
Didn’t they stop selling the Honda Fit, at least in the US?
As a current Civic driver, they no longer produce anything that I’d be willing to buy. Honda has rested on their laurels far too long.
but I’m betting you feel there are plenty of appealing options from kia, right? LOL.
These day you can’t even buy the Honda Fit in the US. The “replacement” is the Honda HR-V. Honda appears to have abandoned the idea of a cheap “starter” car in the US.
oh well, evidently they know less about brands growing up with generations than i thought
Many car companies do what you’re talking about (look at the evolution of the ford thunderbird, for instance) but I think auto sales in the US is an example of regulatory capture and hostile infrastructure, such that car companies now offer starter cars at $40k+ because they know kids need a car and the current crop of affordable cars aren’t sold in the US. There’s little downward competition.
the result of high prices of starter cars is that kids end up in beaters, as they should! nothing teaches self reliance quite like an unreliable car! i didn’t get my first reliable car (a 1998 Honda Civic, as it happens) until I was in my mid 30s
Hey I like my 2020 HR-V. Get’s me from point A to point B.
People just buy a cheap base model civic. No one wants a fit anymore, they all get the same/similar gas mileage anyway
But talking to the Honda dealer they say there is still a strong demand for the Fit even when it is not being sold in the US – every two months or so I get a letter wanting to trade in my low mileage Fit – but Honda no longer makes a car that fits my needs. The HRV was migrated to the Civic chassis and the ability to fold up the back seats went away along with the cargo capacity – idiots at Honda
You can thank lobbyists for “bigger cars that burn more gas”. They were able to write perverse emissions regulations that specifically allow larger cars to be more inefficient so US car companies don’t have to make fuel efficient vehicles.
Sadly, the Honda Fit was discontinued in the States. Which is too bad, because I love mine.
Don’t get ne started on how honda has lost the plot. The after market scene does more for the brand than Honda has since the 90s.
They just don’t understand how to capture the high net worth individual.
Their EV experiment has been a disaster on scale with Ferrari’s when it comes to mis understanding the brand perception.
They checked out in the mid 00’s and started sliding down hill from there into an SUV company that also makes some cars.
Fun fact: there already is a “Fit SUV”. In Europe they called this car the Jazz, and there’s a Honda Jazz Crosstar for purchase at least in the UK.
Oh yes, bring this issue to light.
So the next generation is locked down better and can no longer be updated making the car a paperweight as soon as it’s paid off.
Wholesale IN-Correct and frankly awful take.
Bring this issue to light so you can have frickin’ USB-C ports on your precious iphone.
Having worked in the automotive industry I will let you know that most car manufacturers don’t make any of the infotainment systems, but instead buy those systems by companies such Valeo or Conti.
Essentially these systems all have the same hardware, and only the side facing the user is customised.
It is not unlikely that the exploit will work across brands.
Now if only employees at those companies will accidentally release the source code or do other things that might make these things actually stay useful for customers.
You would think so, but this one was created by Mitsubishi, and it’s the same in 5th Gen CR-Vs and other 2016-2021 Hondas.
The 2022+ head units are something else entirely, and unlike the Mitsubishi units they have telematics for OTA updates, central scrutinization, and delayed enshittification.
Seems like you just need to disable the USB port to make it safe, which only takes cutting one of the two data lines. Alternatively re-route the USB to one of those AirPlay/Android Auto wireless dongles (assuming the head unit isn’t already wireless compatible) and then you kill two birds with one stone.
Sounds like someone should just produce a USB key image that exploits the vulnerability in order to delete the dev key from the system, thus closing the vulnerability. If you are a normal user who doesn’t need root access, you just plug in the usb stick to patch yourself.
Or you just mode the OS so you can do whatever you want and swap the keys for your own keys so that you and only you can continue to update the system as needed but no one else can get it with a simple usb device.
This is why I still prefer just a 2-din hole for aftermarket player. Was shopping for a car. Subaru has awful huge and slow “ipad” with touchscreen hvac. Toyota and other cars have aftermarket ugly looking tablets that distract the driver. 5-8 years cars will have outdated infotainment systems. Same as TV’s. I think I will just end up buying some old car with no sensors and bright displays.
Often the factory unit is in a double-DIN slot, but there’s a plastic fascia which hides this. If you search, you might well find an adaptor kit allowing you to fit a standard after-market head unit.
(eg https://incartec.co.uk/product/Mazda-MX-5-2005-2009-Single-Double-DIN-stereo-upgrade-fitting-kit-WITHOUT-SWC-FK-262)