A security researcher reverse-engineering a 2021 Honda Civic says the car’s Android-based infotainment unit can accept software signed with a publicly known test key, potentially allowing a person with physical access to install arbitrary code through the vehicle’s USB update mechanism. The researcher calls the scenario “EvilValet,” reflecting the need to enter the cabin and reach the front USB port.
The finding emerged from a three-year personal project examining the Civic’s display-audio system. According to the researcher’s update, Honda distributes head-unit upgrades as signed Android Open Source Project update packages that are staged from a USB drive and applied through Android recovery. Although Honda added checks around the process and modified the recovery program, the signature-verification logic was reported to match the standard AOSP implementation.
The researcher found the known AOSP test key listed among the trusted keys on their head unit. They also examined a publicly available European software package, identified as MRC_EU_SW_v12_4.zip, and said it had been signed with that test key. If a correctly formatted drive carries a compatible package signed by the same key, the system accepts it, the researcher reported. That path could provide code execution without first obtaining conventional root access.
The described attack is local, not remote. It assumes that an attacker can enter the vehicle, use its USB port and prepare an update compatible with the specific head unit. A hypothetical target might leave a car with a valet and receive it back without noticing that the infotainment software had changed. The source does not demonstrate compromise of safety-critical driving systems or describe an attack conducted against an unsuspecting owner.
Important uncertainties remain. The researcher did not have every official Honda update or every head-unit variant and therefore could not confirm that all versions trust the same key. They also noted that third-party HondaHack software had previously been installed on their own unit, creating one possible explanation for the key’s presence there. The separately examined European update supports the broader hypothesis, but does not establish universal exposure.
To make further testing possible, the researcher released an early-stage tool called *ota-builder* for preparing update files accepted by the unit, as well as *apk-rebuilder*, which turns externally obtained Honda updates into a structured tree for analysis without redistributing Honda’s code. The work also documents version checks that can make updates fragile. A package built for the wrong software could trigger recovery loops or leave a device temporarily unusable.
The project’s next steps depend heavily on community testing across 10th-generation Civic variants. Until that mapping is broader and independently validated, the report is best understood as a credible physical-access weakness demonstrated in a limited research environment, not proof that every Civic infotainment system can be altered in the same way.
