Search results

it all depends. It’s the same situation if you wanna steal data at a coffee shop. If it’s encrypted, it’s a no go. If it’s not, then it’s possible the certificate is only for Wi-Fi updates and stuff. If you wanted to install an APK, you’d need… wait… we have a list of authorized certs already...

So, came up with a new idea. After studying a bit in college, I learned how to spoof certificates and hashes (hash collisions). Problem is, I need an APK that has an accepted certificate to copy it and make the head unit think it’s legit… maybe I could ask some friends in the Honda group...

If it’s not hacked OEM, I don’t want it

Okay, I think I have something that may work. Using the System Update option and connecting to your own Wi-Fi, you can change the DNS for the software update server to go to a local server hosting a Linux Server for an exploit regarding the WebView browser. If we can force the head unit to go to...

I am back! I have done some research, and I think in order to actually exploit a vulnerability on the device, either an ADB tcpip needs to be opened (which can only be done with the vendor keys), being on the same wifi network as the device (which might be able to be done with the software...

1. Just a thought… is the head unit separate from the info cluster? 2. I haven’t tried any of the exploits I found yet, but I’m planning on it 3. Is there a way to modify the info cluster?

I haven’t ruled out the idea, but most threads are not up to date with the new security methods that Honda and Panasonic have put in place. Since the Android version is 8.1.0, I think we exploit some vulnerabilities out there.

Does anyone have any experience with exploiting vulnerabilities for Android? The version on the HU is 8.1.0. If we can find a vulnerability, we can exploit it to either execute code, or to bypass certain things, or to escalate privileges.

Might be the old CLI version of HondaHack. But what we can try to do is use cheeky workarounds, like using a steganography attack to force the system to execute code out of a photo, since we can upload images to use as wallpaper.

Shot in the dark, I'm going to try to use the Dirtyc0w exploit to gain escalated privileges.

Also, side note, I googled what came up on the device manager when in ADB mode, and it seems this system is running a Qualcomm Snapdragon 820.

You wouldn’t happen to have the link, would you? Also, the only option I saw was OEM Bootloader Unlocking. I couldn’t find a way to boot straight into the bootloader. Will the HU run a startup.sh file on a USB automatically on reboot?

Maybe there is even a button combination to access the normal Android recovery environments. After all, there has to be a reason the system reboot option is hidden so deep in the hidden settings, and there is NO way they sacrificed the little amount of comfort they had with their tools for...

You think we could use the system reboot option in one of the hidden menus to force the HU to boot into recovery/bootloader/fastboot upon bootup?

Here’s what we got so far. You need a computer, the Android SDK Platform Tools (ADB), a USB A Male to USB A Male cable, and a powered USB Hub. 1. Hold HOME + POWER + PREVIOUS until you hear a boop sound 2. Hold BACK + POWER + NEXT until you hear a boop sound 3. Open the USB Mode menu 4. Change...

okay, so, it is picking up, but we need vendor keys.

OKOKOKOKOK! I used a powered USB hub, and I’m seeing a device while it’s in ADB mode! TIME TO TRY THE ADB DRIVERS ON FOR SIZE!

New idea. Just tried my keyboard. I ordered a powered USB hub to see if that works, but the keyboard doesn’t work. What if we used the System Updates option and change the DNS to point to a local modified version of the update, or use a USB to load a modified version of the update file with...

Crazy thought… what if we connected a peripheral to the USB? Since Android can use peripherals, maybe we can trick the head unit into going to the main menu screen or use a shortcut to go to settings

HOLD UP HOLD UP HOLD UP!! In the Developer Options settings, inside Default Apps, and inside “Opening Links”, the Swype app is set to “Open www.swype.com” MEANING if you change the DNS for swype.com, you can redirect it to another website!