C3Subtitles: 34c3: Taking a scalpel to QNX
back

Taking a scalpel to QNX

Analyzing & Breaking Exploit Mitigations and Secure Random Number Generators on QNX 6.6 and 7.0

If you suspend your transcription on amara.org, please add a timestamp below to indicate how far you progressed! This will help others to resume your work!

Please do not press “publish” on amara.org to save your progress, use “save draft” instead. Only press “publish” when you're done with quality control.

Video duration
00:46:18
Language
English
Abstract
In this talk we will present a deep-dive analysis of the anatomy of QNX: a proprietary, real-time operating system aimed at the embedded market used in many sensitive and critical systems, particularly within the automotive industry.

We will present the first reverse-engineering and analysis of the exploit mitigations, secure random number generators and memory management internals of QNX versions up to and including 6.6 and the brand new 64-bit QNX 7.0 (released in March 2017) and uncover a variety of design issues and vulnerabilities.

QNX is a proprietary, closed-source, Unix-like real-time operating system aimed at the embedded market. It is found in everything from BlackBerry products, carrier-grade routers and medical devices to military radios, UAVs and nuclear powerplants. On top of that, it dominates the automotive market and is found in millions of cars.

While some prior security research has discussed QNX, mainly as a byproduct of BlackBerry mobile research, there is no prior work on QNX exploit mitigations or its secure random number generators.

This talk seeks to close that gap by presenting the first reverse-engineering and analysis of the exploit mitigations, secure random number generators and memory management internals of QNX. We dissect the NX / DEP, ASLR, Stack Cookies and RELRO mitigations as well as the /dev/random and kernel PRNGs.

We subsequently uncover a variety of design issues and vulnerabilities in these mitigations and PRNGs, which have significant implications for the exploitability of memory corruption vulnerabilities on QNX as well as the strength of its cryptographic ecosystem. Finally, we provide information on available patches and hardening measures available to defenders seeking to harden their QNX-based systems against the discussed issues.

Talk ID
8730
Event:
34c3
Day
2
Room
Saal Borg
Start
7:45 p.m.
Duration
01:00:00
Track
Security
Type of
lecture
Speaker
Jos Wetzels
Ali Abbasi
0.0% Checking done0.0%
0.0% Syncing done0.0%
0.0% Transcribing done0.0%
100.0% Nothing done yet100.0%

English: Transcribed until

Last revision: 11 months, 3 weeks ago