Slashdot Mirror
BlackBerry Denies QNX Was To Blame In Jeep Cherokee Hack
itwbennett writes: Last month, security researchers demonstrated how to circumnavigate the in-vehicle entertainment system of the Jeep Cherokee to take over the car itself, including control of the dashboard, steering mechanism, transmission, locks, and brakes. The more than 1.4 million vehicles being recalled all run the QNX Neutrino OS, which was supplied by BlackBerry subsidiary QNX Software Systems. But the flaw being exploited was not within the OS itself, BlackBerry said Monday in its blog.
So they sailed all the way around it?
Maybe they passed a Renault Tierra del Fuego?
Having a Blackberry for work, I would agree with Blackberry as QNX not being the problem. My Blackberry is not compatible with anything and doesn't run anything, so I would find it hard that someone could write an exploit and actually get it to run on a Blackberry OS.
It's pretty clear that Blackberry's right about the OS here. From TFA:
"The researchers themselves did not target QNX specifically, but rather the connectivity software that runs on top of QNX, called uConnect which, using cellular connections, offers Internet access, navigation, voice command capabilities and other features to drivers."
Circumnavigate?
Umm, no. That is not how that word is used. I think they meant "circumvent".
Just cruising through this digital world at 33 1/3 rpm...
If you want to automate your car to the point where the driver cannot control the vehicle under the worst of circumstances, then you've made a choice that uConnect, QNX, or anyone else is to blame. If you're going to automate vehicles, then you're going to pay the process when it fails.
I would think the OS shares SOME of the blame, simply because the OS sat there while some third party software exploit ran some unauthorized commands.
Amusingly, in while taking first year university courses in 1993, I placed second in a programming competition that was sponsored by OTI (now IBM) and QNX (now Blackberry).
First prize was a licensed copy of QNX, second prize was a 2400 baud modem. I think I got a better deal with the modem.
XML is a known as a key material required to create SMD: Software of Mass Destruction
It's pretty clear that Blackberry's right about the OS here. From TFA:
"The researchers themselves did not target QNX specifically, but rather the connectivity software that runs on top of QNX, called uConnect which, using cellular connections, offers Internet access, navigation, voice command capabilities and other features to drivers."
Exactly. It's no help that everyone is connected on the CAN-bus with little in way of security there...
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
Trolling. Somebody is pushing the story as either clickbait or fud.
I don't think that word means what you think it means.
An operating system could be the most secure OS in the world but it won't matter for anything if a buggy insecure application is running on top of it.
Disclaimer: I work in electrical architecture in the automotive industry, and I have started focusing on security.
Perhaps I am biased by my profession, but the issue here is not that the U-Connect system had malware. The issue is that the U-Connect system could cause the vital control systems in the vehicle to do nasty things. That is an architectural problem of the first order.
Bugs will always exist, and some are bound to be security vulnerabilities. This high-order bit is not that the system had bugs. The high-order bit is that a single vulnerability in an infotainment subsystem allowed for remote actuation of the vehicle's vital control systems. That is terrible!
Engineers who work on steering, brakes, transmission and other core systems in the car are much more experienced than those who code up an entertainment system. The core engineers cost more, use much stricter (therefore longer and more costly) processes and so on. It would be wasteful to throw all that experience, time and money into non-critical system that doesn't need it. Jeep, quite rightfully, did sensible thing there. But running all systems on shared core or bus was asking for trouble. And they got what they asked for.
Maybe next time they should try drive a pacemaker from an Android phone they also use to play games watch kitten videos, you know, to save the cost of the pacemaker's own microcontroller and battery. What can possibly go wrong?
Yeah, I was at the Defcon talk on Saturday, or was it Friday, it all blends together. It was because the designers ran everything as root and used D-Bus on port 6667 with no authentication and was accessible via the internet. Also, none of the software was signed in any way, allowing them to replace the firmware as they pleased.
Mostly agreed. They should be able to put Windows 95 with IE 3.0 on the entertainment/navigation system without ANY worry about compromising critical vehicle control/safety systems because they should be essentially (or actually) air-gapped. The worst that could be done in that case is putting up false GPS location or misleading messages on the display, or rickrolling the driver.
Anything less secure than that is ludicrous. If it's possible under any circumstance (no matter how unlikely) to remotely access vehicle control systems on a car that hasn't already been specially prepared/modified by someone with physical (under hood or at least in-cabin) access, then the engineers and system designers utterly failed to such an extent that they and the managers responsible for assigning them need to find work elsewhere, perhaps in the toy industry if not flipping burgers, or go back to Computers 101 and start over. Admittedly that should also be the fate of the idiots responsible for putting "metro" Windows Server 2012.
http://www.juliandunn.net/2006...
exec("/bin/sh", 0, CLONE_PERM) is all it would take to get you a root shell on the box.
Buck Feta. You know what to do.
Yep it is right up with Clinton Denies killing babies.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
I've been following this -- I thought -- pretty closely. There's a smoking gun. To answer the recall, they've got to actually do something. What's the "fix"? Yank out the radio? Does that fix it?
Seems to me that a lot of this stuff is going to get worse before it gets better due to "smart" features such as collision avoidance, remote start, an the like. There will likely be a management device with privileged access to the CAN bus. What measures are being put into to place to protect that trust?
To Copy from One is Plagiarism; To Copy from Many is Research.
they actually might have, but got overruled by management/marketing/accounting. It's definitely happened before in various companies/organizations, and it will happen again. Managers want stuff delivered fast, marketing wants flashy features, and bean counters want the lowest possible cost. Engineers saying "um, maybe we shouldn't do this" be damned. The wrong people are in charge these days. And if not even the _lawyers_ could shut down such a bad idea, that company has serious issues...
OK, sounds like uConnect is a trusted application? Who wrote uConnect? Seems like they're the ones' with some 'splainin' to do'...
To Copy from One is Plagiarism; To Copy from Many is Research.
QNX that I used way back when didn't have a native stack to compromise... It is just a scheduler, mutexes/semaphores, and a message pump. Not really much of anything to go wrong there.
OK, sounds like uConnect is a trusted application?
Not really. uConnect listened to a port on the built-in wifi hotspot and on the cellular internet connection, AND uConnect had no encryption, AND uConnect required NO authentication.
It's like running Tomcat as your webserver on linux, but leaving the Tomcat admin interface wide open to the public with no authentication.
It's certainly a big problem, but it has nothing to do with the underlying OS.
Who wrote uConnect?
Chrysler and/or Harmon Kardon.
A interesting (and terrifying) article on this subject: http://money.cnn.com/2014/06/0... It points out that in the 90's when the system was designed it wasn't a issue as it was a closed system. The CAN based system was never intended to be connected to anything. The ramifications of a wireless connected car with zero security should make everyone very concerned. It's just a matter of time before someone locks up your right front brake when you're doing 80 MPH. That the government is mandating this (RTA) is even worse.
Hardly they run D-BUS on QNX, it's more probable that they meant the CAN-bus.
thanks for the tip. Didn't think of Harmon Kardon as being the vendor for this, uh, app. NTSA seems to call them out explicitly in their complaint.
To Copy from One is Plagiarism; To Copy from Many is Research.
If you want to argue with the guys presenting it, feel free, but I tend to think you'll just come out looking like an idiot.
Did no one at QNX, BlackBerry or FCA ask the frickin question as to whether the Jeep was immune to wireless hacking.
It's no help that everyone is connected on the CAN-bus with little in way of security there...
Yep right there is your problem.
Two words.... Air Gap.
The engineer that designed this should be in jail.