Slashdot Mirror
BlackBerry Denies QNX Was To Blame In Jeep Cherokee Hack
itwbennett writes: Last month, security researchers demonstrated how to circumnavigate the in-vehicle entertainment system of the Jeep Cherokee to take over the car itself, including control of the dashboard, steering mechanism, transmission, locks, and brakes. The more than 1.4 million vehicles being recalled all run the QNX Neutrino OS, which was supplied by BlackBerry subsidiary QNX Software Systems. But the flaw being exploited was not within the OS itself, BlackBerry said Monday in its blog.
Having a Blackberry for work, I would agree with Blackberry as QNX not being the problem. My Blackberry is not compatible with anything and doesn't run anything, so I would find it hard that someone could write an exploit and actually get it to run on a Blackberry OS.
It's pretty clear that Blackberry's right about the OS here. From TFA:
"The researchers themselves did not target QNX specifically, but rather the connectivity software that runs on top of QNX, called uConnect which, using cellular connections, offers Internet access, navigation, voice command capabilities and other features to drivers."
Circumnavigate?
Umm, no. That is not how that word is used. I think they meant "circumvent".
Just cruising through this digital world at 33 1/3 rpm...
We need a catchy media name for this spate of car hacks that have inundated us this last week or so.
Of all the XYZ-gate names contrived for controversies since watergate, "Circumnavigate" is the first one I actually like.
The Circumnavigate Controversy of 2015, costing Chrysler Millions of USD and Tesla Thousands (in bug bounties)!!
If you want to automate your car to the point where the driver cannot control the vehicle under the worst of circumstances, then you've made a choice that uConnect, QNX, or anyone else is to blame. If you're going to automate vehicles, then you're going to pay the process when it fails.
But surely nobody expects the editors to do any, you know, editing.
That would be preposterous.
Lost at C:>. Found at C.
Amusingly, in while taking first year university courses in 1993, I placed second in a programming competition that was sponsored by OTI (now IBM) and QNX (now Blackberry).
First prize was a licensed copy of QNX, second prize was a 2400 baud modem. I think I got a better deal with the modem.
XML is a known as a key material required to create SMD: Software of Mass Destruction
It's pretty clear that Blackberry's right about the OS here. From TFA:
"The researchers themselves did not target QNX specifically, but rather the connectivity software that runs on top of QNX, called uConnect which, using cellular connections, offers Internet access, navigation, voice command capabilities and other features to drivers."
Exactly. It's no help that everyone is connected on the CAN-bus with little in way of security there...
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
Maybe - maybe not. When the "engineers" set this thing up, they probably established permissions. I'm not all that familiar with QNX, but I believe it actually has a security model. If the rules were written to permit this peripheral to do that, and another peripheral to do thus, then the OS can't be blamed for the results of those permissives rules.
Kinda like Android. Linux is a pretty robust, reliable, and secure operating system. So, the "engineers" put Linux on a phone, then wrote a bunch of silly-assed rules, and granted permissions to apps to do whatever they want. Security sucks - but it's not Linux' fault that it sucks.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Trolling. Somebody is pushing the story as either clickbait or fud.
QNX, at least when I used it 10 years ago, is a real-time unix-like OS. It runs basically no services by default... it is as bare-bones as it gets. We used it to control a vision system. You CAN load it up with as much extra gunk as you like - even X11. It is possible that the flaw was in a Blackberry-supplied component - but the OS itself is whatever you want to make it.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
I don't think that word means what you think it means.
Please, this is an embedded OS, not computer (or pocket computer masquerading as a phone). There should not "apps" in an embedded OS. The entertainment system must be architected as a whole and the car must be architected as a whole. Given this is a life/safety critical device there must be a hard separation between the nice to have things like the radio and critical systems like the brakes. Especially if you have a system that has open ports, OTA upgrades or even are connected. The executives, engineers and marketers need to face significant criminal liability for such breaches of trust when offering a life/safety device to the public. Even though I am not a PE this type of situation does argue for licensing.
An operating system could be the most secure OS in the world but it won't matter for anything if a buggy insecure application is running on top of it.
Disclaimer: I work in electrical architecture in the automotive industry, and I have started focusing on security.
Perhaps I am biased by my profession, but the issue here is not that the U-Connect system had malware. The issue is that the U-Connect system could cause the vital control systems in the vehicle to do nasty things. That is an architectural problem of the first order.
Bugs will always exist, and some are bound to be security vulnerabilities. This high-order bit is not that the system had bugs. The high-order bit is that a single vulnerability in an infotainment subsystem allowed for remote actuation of the vehicle's vital control systems. That is terrible!
Engineers who work on steering, brakes, transmission and other core systems in the car are much more experienced than those who code up an entertainment system. The core engineers cost more, use much stricter (therefore longer and more costly) processes and so on. It would be wasteful to throw all that experience, time and money into non-critical system that doesn't need it. Jeep, quite rightfully, did sensible thing there. But running all systems on shared core or bus was asking for trouble. And they got what they asked for.
Maybe next time they should try drive a pacemaker from an Android phone they also use to play games watch kitten videos, you know, to save the cost of the pacemaker's own microcontroller and battery. What can possibly go wrong?
This! Although at the time I said, well wasn't that easy, BMW was able to perform a FW download to my car while it was sitting in the parking lot at work. I didn't even know it was happening until I saw a news article on it. I'm sure BMW and the other car makers are trying to be careful (I hope that's true) and this all sounds neat until something like this comes along and them you go "what if...". Yes it scares the crap out of me too.
Yeah, I was at the Defcon talk on Saturday, or was it Friday, it all blends together. It was because the designers ran everything as root and used D-Bus on port 6667 with no authentication and was accessible via the internet. Also, none of the software was signed in any way, allowing them to replace the firmware as they pleased.
They clearly meant "circumcise".
Yep it is right up with Clinton Denies killing babies.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
I've been following this -- I thought -- pretty closely. There's a smoking gun. To answer the recall, they've got to actually do something. What's the "fix"? Yank out the radio? Does that fix it?
Seems to me that a lot of this stuff is going to get worse before it gets better due to "smart" features such as collision avoidance, remote start, an the like. There will likely be a management device with privileged access to the CAN bus. What measures are being put into to place to protect that trust?
To Copy from One is Plagiarism; To Copy from Many is Research.
OK, sounds like uConnect is a trusted application? Who wrote uConnect? Seems like they're the ones' with some 'splainin' to do'...
To Copy from One is Plagiarism; To Copy from Many is Research.
OK, sounds like uConnect is a trusted application?
Not really. uConnect listened to a port on the built-in wifi hotspot and on the cellular internet connection, AND uConnect had no encryption, AND uConnect required NO authentication.
It's like running Tomcat as your webserver on linux, but leaving the Tomcat admin interface wide open to the public with no authentication.
It's certainly a big problem, but it has nothing to do with the underlying OS.
Who wrote uConnect?
Chrysler and/or Harmon Kardon.
A interesting (and terrifying) article on this subject: http://money.cnn.com/2014/06/0... It points out that in the 90's when the system was designed it wasn't a issue as it was a closed system. The CAN based system was never intended to be connected to anything. The ramifications of a wireless connected car with zero security should make everyone very concerned. It's just a matter of time before someone locks up your right front brake when you're doing 80 MPH. That the government is mandating this (RTA) is even worse.
But it will get blamed for it. The Windows NT kernel has a very sophisticated security model, and look how well the rest of Windows builds on that.
Red to red, black to black. Switch it on, but stand well back.
Congratulations on your mastery the dictionary. Perhaps you could put those skills to work teaching the submitter how to use the word properly.
The hackers didn't go around or bypass or circumnavigate the entertainment system. They hacked the entertainment system and used it to bypass other security measures. If they had not gone through the entertainment system, they would not have been able to compromise the vehicle's communication network.
thanks for the tip. Didn't think of Harmon Kardon as being the vendor for this, uh, app. NTSA seems to call them out explicitly in their complaint.
To Copy from One is Plagiarism; To Copy from Many is Research.
Did no one at QNX, BlackBerry or FCA ask the frickin question as to whether the Jeep was immune to wireless hacking.
That would help the three people that read the summary and maybe stop the one person from clicking through to the article. It's not a bug - it's a feature.
"So long and thanks for all the fish."
BMW is excellent at this - so far. I can not fault them - yet. I will be displeased when they screw up. I am nearly certain that they will BUT it is BMW so I expect it to be repaired quickly and professionally when they do make an error. I am, obviously, a fan of BMW. In fact, my new (and first "bespoke") BMW is due in on Thursday. I ordered a very nice custom 640Li. I drove the test model at the dealer and nearly just bought that so that I could take it home and molest it in private. The dealer was not impressed when I tried to get into the trunk naked and smeared in chocolate sauce.
"So long and thanks for all the fish."