10th Gen Honda Civic Headunit Security Vulnerability: EvilValet

Arbitrary Code Execution via AOSP Test Keys

10th Gen Honda Civic headunits are vulnerable to arbitrary code execution because Honda used publicly known AOSP (Android Open Source Project) test keys to sign firmware updates. This allows anyone with physical access to the vehicle's front USB port to install unauthorized software without requiring root access or su binaries.

Research conducted by Eric McDonald reveals that while Honda implements specific checks for USB updates, the underlying signature verification logic in the modified recovery binary matches stock AOSP. Because the publicly known AOSP test keys remain in res/keys, any update file signed with these keys is accepted by the system. This vulnerability was confirmed not only on a 2021 Civic but also via the analysis of a publicly available EU software update file (MRC_EU_SW_v12_4.zip), which also carries the AOSP test-key signature.

The "EvilValet" Attack Vector

The vulnerability enables an "evil maid" style attack, termed "EvilValet" due to the physical access required within a vehicle cabin. An attacker—such as a valet or a technician—could insert a specially formatted USB drive into the headunit to install a malicious update. Once the update is applied, the headunit is modified without the owner's knowledge, providing the attacker with persistent arbitrary code execution.

To facilitate the exploration of this vulnerability and the customization of these devices, the researcher has released several tools:

  • ota-builder: A tool to prepare update files that the headunit will accept, potentially allowing users to install an su binary with setuid to root the device.
  • apk-rebuilder: A utility that automates the reverse engineering of Honda update files by resolving resources, reconstructing .smali code, and extracting the ramdisk.
  • apk-renderer: A tool used for exploring custom themes, though the researcher notes that the Mitsubishi-forked AOSP framework makes custom themes difficult to implement due to hardcoded resource IDs.
  • aidl-rebuilder: An experimental tool to map AIDL interfaces, which could enable the creation of custom applications like virtual speedometers.

Technical Constraints and Risks

Updating the headunit is a fragile process that relies heavily on specific version numbers. While these version numbers can be spoofed to run unsigned code, the user must know the exact versions the headunit expects to avoid recovery loops or "softbricking" the device.

Furthermore, the researcher has shifted away from maintaining traditional reference documentation in favor of providing deterministic tools. The strategy is to allow users to use Large Language Models (LLMs) to query the reconstructed code directly, treating the headunit code as the single source of truth rather than relying on documentation that may become outdated.

Community Perspectives and Industry Context

The discovery has sparked a debate between those who view the vulnerability as a critical security flaw and those who see it as a win for hardware ownership and right-to-repair.

Some community members argue that the risk is minimal, noting that a sophisticated attacker would likely use hardware implants rather than a USB update:

"No 'evil valet' with half a brain cell would waste time hacking the head unit if they have physical access to the car. They would simply hide a spying device somewhere in the car."

Others highlight a broader trend of poor security in automotive infotainment systems. One contributor pointed to the Australian Government Information Security Manual (updated March 2026), which instructs government personnel not to connect sensitive devices to vehicle infotainment systems due to surveillance risks. Similar vulnerabilities have been reported in other brands; for instance, some Hyundai head units reportedly used an RSA key that was easily discoverable via a web search.

From a right-to-repair perspective, the ability to modify the headunit is seen as a way to prolong the life of the hardware, preventing owners from replacing factory units with lower-quality third-party Android tablets.

Sources