Honda Civic Headunit's USB Update Path Enables 'EvilValet' Attack

Three years after first publishing his reverse-engineering work on the head unit of a 2021 Honda Civic, developer Eric McDonald has posted a project update describing a fully working update path into the infotainment system — and a vulnerability he calls "EvilValet".

Keys to the kingdom

Honda supports updating the head unit over USB. The drive carries a signed AOSP update file that is staged and applied through Android recovery, and Honda added its own checks around the process. According to the write-up, those checks are undone by a simple mistake: the publicly known AOSP test key was left in res/keys, and even though Honda modified the recovery binary, the verify_file signature logic matches stock AOSP.

The consequence is that anyone who can format a USB drive and sign it with that test key can install whatever they want on the head unit without conventional root access. Physical access to the front-most USB port is enough for arbitrary code execution through the update path.

An evil maid attack, in the car

McDonald frames this as an "evil maid" attack moved from the hotel room to the cabin of a car. A journalist leaves a vehicle with a valet; the valet, working for a three-letter agency, installs an update over USB; the car comes back with a modified head unit and nothing visibly changed.

He has also released ota-builder, an early-stage tool that prepares update files the head unit will accept — enough, in principle, to install a setuid su binary and root the device. He notes one caveat: he has strong reason to believe all updates are signed with the AOSP test key, but has no access to every official file or head unit variant, and HondaHack was installed on his own unit. A publicly available EU update file, downloaded from a forum and never modified by him, is nonetheless test-key signed.

Tooling over documentation

The second half of the update covers apk-rebuilder, which takes a Civic update file and produces a clean tree of output files — resolved resources, reconstructed .smali code, repacked APKs, an extracted ramdisk — automating work a reverse engineer would otherwise do by hand. Because actual Honda source code cannot be published, the project ships a function that turns an update file into .smali code and image assets instead.

Other open threads include a table of known display-audio versions, an experimental ARMv7 toolchain that matches the vendor compiler version and build flags, custom themes that would require surgically editing Mitsubishi's fork of the AOSP framework, and an aidl-rebuilder that maps AIDL interfaces and could enable custom apps such as virtual speedometers. McDonald says most of the investigation he intended is done and he will likely move on to other projects, though pull requests remain welcome.