Analyzing & Breaking QNX Exploit Mitigations and PRNGs For Embedded Systems

on YouTube ↗54m

" summary

Dissects QNX exploit mitigations and PRNGs, showing user-space /dev/random moves from a broken Yarrow variant to Heimdall Fortuna while a new kernel RNG draws mainly from cycle counters; kernel and user ASLR get only 7 bits (stack) and 12 bits (mmap) due to masking, with measured average ASLR min-entropy at 4.47 bits and stack canary min-entropy ~7.79 bits. QNet lacks auth allowing remote shadow reads, procfs and rdebug leak addresses, PDbug debugging exposes root access (Metasploit module exists), and a demo achieves root in 23 seconds to root. Patches exist but slow to reach devices.

AI-written summary · about

" chapters (46)

1. 0:00Intro
2. 2:11Automotive: BlackBerry Radar
3. 2:53Industrial: Nuclear HMI
4. 3:21Defense: Military Radios QNX Secures Major Design Win in Software Defined Radio
5. 3:33Medical: Surgical Robots
6. 3:59Many more critical systems
7. 4:19What's New?
8. 4:52QNX Microkernel Architecture
9. 5:41QNX IPC Message Passing
10. 6:11QNX Attack Surface
11. 7:19QNX Security History
12. 9:05Syscalls
13. 10:49QNX Boot Process Power on
14. 11:38QNX Firmware
15. 12:51QNX Memory Layout - Nemespace - Userspace Separation
16. 13:21QNX User Management
17. 14:41QNX Process Management
18. 16:32QNX Process Abilities Limitations
19. 17:45Breaking' Rootless Execution
20. 18:22Qnet (Native Networking / TDP)
21. 19:00Qnet Security
22. 21:36Qnet EOP Vulnerability (CVE-2017-3891)
23. 22:25QNX Debugging
24. 24:33PRNG Quality
25. 25:18QNX Security-Oriented PRNGs
26. 25:53QNX 7 /dev/random
27. 29:41QNX 7 Kernel PRNG
28. 31:24Exploit Mitigation Quality
29. 32:22QNX Exploit Mitigations
30. 33:11QNX DEP
31. 36:31QNX ASLR - map_find_va
32. 37:08QNX ASLR - stack_randomize
33. 38:07QNX 6 ASLR - Weak RNG
34. 39:53QNX 6 ASLR - Bruteforcing
35. 41:14QNX 6 ASLR - procfs Infoleak (CVE-2017-3892)
36. 42:41QNX 6 ASLR-LD DEBUG Infoleak (CVE-2017-9369)
37. 43:27QNX 7 ASLR - Changes
38. 44:54QNX Stack Canaries
39. 45:23QNX 6 SSP - Weak RNG
40. 46:13QNX 6 SSP - Kernelspace
41. 46:46QNX 7 SSP - Changes
42. 47:19Relocation Read-Only (RELRO) to do
43. 49:01QNX 6 Broken RELRO (CVE-2017-3893)
44. 50:08QNX 6 RELRO
45. 50:32Patches
46. 51:03Conclusions

" related talks

• 57mAttacking the Linux PRNG on AndroidSagi Kedmi · Black Hat Europe 2014
• 58mExploiting Linux and Pax ASLR's Weaknesses on 32-Bit and 64-Bit SystemsHector Marco-Gisbert, Ismael Ripoll · Black Hat Asia 2016
• 45mInside the Linux Kernel Random Number GeneratorJason A. Donenfeld · Linux Plumbers Conference 2022
• 51mExploiting Hardware Glitches And Side Channels In Perfect SoftwareHerbert Bos · OWASP Global AppSec Amsterdam 2019
• 01h 30mRandomBart Massey · Open Source Bridge 2014
• 24mCurrent State of Exploit Mitigations in the Linux KernelLucas Amorim · BSides Vancouver 2021
• 44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019Tong Lin, Luhai Chen · Linux Security Summit Europe 2019
• 14mlol im so random!Mark Wunsch · RailsConf 2016