Excerpt: Security researcher demonstrates that Honda Civic headunits accept unsigned code via USB through publicly known Android test keys, enabling arbitrary code execution.
A security researcher demonstrated that the infotainment system in 2021 Honda Civic vehicles accepts software updates signed with publicly known Android Open Source Project (AOSP) test keys, enabling arbitrary code execution through physical USB access. The technique, dubbed “EvilValet,” was published June 13 and cited in VicOne’s Q2 2026 Situational Awareness Report as a notable automotive security finding.
The researcher, writing on JuniperSpring, discovered that Honda’s headunit update process relies on the stock AOSP verification logic and leaves the publicly known AOSP test key in the res/keys directory. This means anyone with physical access to the vehicle’s front USB port can prepare a USB drive with a properly formatted update signed with the test key and install arbitrary software on the headunit.
“An attacker has arbitrary code execution on the headunit via the update path,” the researcher explained. The attack requires no conventional root access — no su binary with setuid is needed.
The researcher compared the scenario to an “evil maid” attack, reimagined for automotive contexts. “Imagine a journalist drives to a hotel and leaves their car with the valet,” they wrote. “The valet, who works for a three-letter agency, installs an update via USB. When the car is returned, the journalist doesn’t know the headunit has been modified.”
Honda’s European software update file MRC_EU_SW_v12_4.zip was confirmed to be test key signed, suggesting the issue may extend across multiple regional variants and model years. The researcher also published an open-source tool called ota-builder that automates the preparation of signed update files.
The implications go beyond surveillance. A compromised headunit could potentially serve as a pivot point into the vehicle’s internal networks, affecting CAN bus systems or other safety-critical components. No official Honda response has been published at the time of reporting.
