Honda Civics And Installing Software With Android Test Keys

As more and more of the ‘smart’ infotainment systems in cars begin to age out of support, it becomes increasingly more relevant to figure out how to do something with that lump of computer-and-display sitting prominently in the dashboard.

Here [Eric McDonald]’s reverse-engineering of the 2012-era Android-based infotainment system in a 2021 Honda Civic is an interesting case study, with recently the discovery made that the head unit of these infotainment systems can be updated via USB by using standard Android Open Source Project (AOSP) test keys as these were left on the file system.

This is a nice update to his initial reverse-engineering back in the innocent days of 2023, when such a facepalm-worthy exploit seemed unimaginable, but then the ‘s’ in ‘infotainment’ has always stood for ‘security’. In this exploit that [Eric] calls the EvilValet attack, it means that anyone with physical access to the USB port inside the car can theoretically run arbitrary code signed with these test keys, as documented in the GitHub project.

So far this rather foolish security issue has only been confirmed on [Eric]’s 2021 Honda Civic, but considering how those – often third-party – infotainment systems tend to get reused and recycled across generations and car variants, it’s quite possible that more Android-based infotainment systems have this vulnerability.

This exploit is obviously a double-edged sword, as on one hand it’s great that an owner of one of these cars can now basically do whatever they want with said infotainment system, but on the other hand it means that anyone who slides into your car with a USB stick can do the same.