Honda Civics and the Evil Valet

Thanks so much for your analysis. This kind of investigation and exposure of lazy work is the reason I love hacker news.

> AOSP

Android Open Source Project

for those outside the bubble!

A number of other cars' infotainment systems are also based on ASOP. I remember downloading updates for my Hyundai which were also essentially Android images

Isn't NC the absolute lowest in the sensitivity system?

Because it's not open for modification by the general public? (emphasis general, not just technically minded people)

Manufacturers need to pick a lane - either fully open, and then people who need it can harden their own stuff (and at least be aware of the tradeoff), or fully closed and secure.

This in-between where cars are invasive privacy nightmares that spy on you at all driving hours, and are insecure nightmares that will give up that data to anyone remotely invested, is the worst case scenario, obviously.

We can definitely see that on windows with the recent bitlocker exploit. I wonder if any new cases will be solved, or people imprisoned because of hardware in storage that can now be unlocked.

It's definitely better to not keep data locally if it's going to be seized, because of varying laws that can coerce unlocking, but in the U.S., it should be safe to refuse to give up passwords.

On the technical side, Google and Apple have changed the game with numerous improvements to physical security and GrapheneOS takes it even further building on their foundation reducing attack surface and adding good features. Particularly with Auto reboot[1] becoming widely adopted, your conclusion can be modified on phones.

[2]:

>This (https://osservatorionessuno.org/blog/2026/05/demystifying-ph...) is an article by an Italian non-profit that provides an introductive technical overview to forensic phone unlocking exploit kits used by governments and law enforcement, most notably Cellebrite.

>This post provides an overview on how disk encryption works on Android, common attack vectors used by forensic tools to brute force or extract a device, their countermeasures against popular security features like automatic reboot in iOS and how you can protect yourself against such tools, including several mentions about GrapheneOS.

[1] https://grapheneos.org/features#auto-reboot

[2] https://discuss.grapheneos.org/d/35728-demystifying-phone-un...

I once came across a similar "solution". The signing algorithm was directly executed from the update package. How would we otherwise be able to update the signature algorithm? Worst part was that it was correct at some point. It was an introduced regression because of a signature change due to " post-quantum safe" signatures now being required by the security team.

I'm surprised someone named BobbyTables2 wouldn't go straight for the proper way to check email PGP signatures...

It's not good that they allow anyone that happens to be in your car briefly root access. It'd be live having an always-on laptop in your office with a open shell on it.

They should have provided some mechanism for the real owner to approve updates if the updates aren't all trusted by default.

Not sure if you’re being sarcastic/satirical or not. If you are, fine.

But if you’re not - why would someone driving a civic not be a target of an intelligence agency? It’s one of the most common cars about there, so if you want to fade into the background it’s a perfect car. Also, lots of otherwise “normal” people - scientists, engineers, journalists, lawyers - likely drive Honda civics.

A spying device hidden in the car may be found. Something installed directly within the car’s firmware is somewhat less likely to be found.

You think there isn’t some boring scientist or engineer with classified access who doesn’t drive a boring civic to work?

If you have physical access to a car and want to phone home, may I recommend leaving a gps tracking device under the floormat.

It works on more brands of cars too than just one gen of honda civics, and probably quicker to install.

I'd rather see unit tests as documentation.

The test can show intended use, show interesting corner cases, and I know it is up to date because it is constantly running and passing.

I think that is a huge underrated benefit of adding a lot more testing.

If I think a developer is going to ask a question of how something works, or about a corner case, isn't that deserving of a test, so they can just see proof of the answer to their question immediately rather than trying to re-derive it?

The Honda-e had one of the best aquarium simulation software, 90s style. It was sold from 2020 but still.

You could, but if this unit is anything like it is in my CR-V, and its most likely the same, it's an ancient slow OMAP processor and 4GB of RAM (IIRC).

Edit: Looks like a Tegra 3 in this one, but my bet is meager RAM.

Yes, but it'll still be using their kernel so not all functionality from lineage might work.

Yeah jealous he even got to name an attack surface. Damn.

I think the evil valet risk isn't real, but this could be part of a chain-of-attack in some scenarios, mainly rental cars.

Like, sure, if you're just going to use it to spy on the user, you could also rent a rental car and leave a recording device under the floormat, or hidden behind the head unit, or whatever.

But if you have an Apple Carplay exploit, where someone tethering their phone to the car can be compromised, renting a car and flashing a malicious OS to exploit the phones of people who come after you could maybe be a real attack. It's kinda hard to get people to otherwise connect to a malicious infotainment system with carplay, so if you have an exploit that requires that, this could be part of it...

Except actually, no, if you have a carplay exploit, just rent the car, and rewire the USB port to go through a flipper zero or whatever and don't bother reflashing the car's software, that's just as easy.

... So yeah, I guess I agree with you, even in the rental car scenario, where this seems like it would be worst, your attacker might as well just hide something in the car instead of flashing the software.

No, this is a false dichotomy. It's not either "open to anyone" or "secure from anyone". There are various ways to ensure that only the owner can unlock the software, eg requiring a waiting period before unlocking.