Security Like the 80s: How I Stole Your RF
Ayyapan Rajesh details CVE-2022-27254, demonstrating how unencrypted fixed rolling codes in Honda remote keyless entry systems allow replay and vehicle theft.
Summary
The Illusion of Security in Modern Wireless Keys
While remote keyless entry (RKE) systems offer immense convenience, many automotive manufacturers continue to deploy insecure wireless protocols lacking cryptographic integrity.
Discovering Fixed Rolling Codes (CVE-2022-27254)
Ayyapan Rajesh explains the discovery of a critical vulnerability in Honda RKE implementations where radio frequency counter synchronization is absent or non-enforced.
Executing Replay and Vehicle Takeover Attacks
The author demonstrates capturing sub-GHz key fob RF transmissions over the air and replaying the unencrypted signal to unlock doors, pop trunks, and start vehicle engines.
Cryptographic Modernization for Automotive RF
The presentation calls for universal adoption of challenge-response mutual authentication and secure rolling code algorithms across consumer vehicles.
Related talks
Car Hacking Village·26 min
Yago Lizarribar
Reveals how unencrypted RF broadcasts from direct Tire Pressure Monitoring Systems (TPMS) enable vehicle tracking and custom message injection to spoof ECUs.
Main Stage·44 min
Ben Gardiner
Ben Gardiner demonstrates using Software Defined Radios (SDR) to transmit and decode SAE J2497 (PLC4TRUCKS) signals over the air, spoofing heavy vehicle trailer brakes.
Auto Hacking Village·13 min
Using the Yard Stick One sub-1GHz wireless transceiver to capture, analyze, and replay signals from automotive key fobs.