4. What this talk is about:
• An introduction to QNX RTOS
• Where Would You Expect To Find QNX
• QNX in Numbers
• More About QNX
• How it Looks
• QNX Network Services
• QNX Qnet protocol
• Exploiting QNX Weaknesses Remotley & Locally (<- demo )
5. What is QNX (Neutrino):
• Multiuser & Multitask Mission Critical RTOS;
• Developed by QNX Software, later acquired by
Research in Motion, Now BlackBerry;
• Targets are mostly embedded systems;
• Microkernel driven;
• This means:
• Every failure prone component lives outside
of kernelspace
• Components, such as Drivers, Protocol
Stacks, Filesystems, Applications;
6. What is QNX Neutrino (cont):
• Runs on Multiple Arch’s: ARM,MIPS, PowerPC, x86,
etc;
• Not Linux nor Unix;
• POSIX standard (1003.1-2001 POSIX.1)
7. What is QNX Neutrino (cont):
Source: http://www.qnx.com/
8. Where Would You Expect To Find QNX:
“QNX is used in systems where the cost of failure
is very high“
Dan Dodge (QNX CEO)
9. Where Would You Expect To Find QNX (cont):
• Medical Equipment;
• Industrial Robots;
• Professional DVR’s;
• Storage Appliances;
• Network Equipment; <- Cisco CRS-1
• RAID Controllers;
• Spacecraft & Aircraft;
• Nuclear Power Plants;
10. Where Would You Expect To Find QNX (cont):
• Blackberry PlayBook, Z10, Z30, Q5, Q10, etc;
• Luxury & High-end Cars (Porshe, Bentley, Lexus,
Mercedes, etc;
• University Students “Quite Expensive" NAS;
• Many Others.
11. QNX in Numbers:
• Shodanhq:
• 2 QNX hosts;
• Internet Census:
• ~ 74 Internet Exposed hosts;
• No Nuclear Power Plants, though
• Private/Local networks?
12. More About QNX:
• Photon (GUI)
• Uses Neutrino messages in order to create
highly responsive user experience;
• Made of the following components:
• Photon server;
• graphics subsystem manager and hardware
driver;
• font support;
• input support;
• user applications;
13. More About QNX (cont):
• Multimedia
• “Media Player Plugins”
• Plays/Decodes:
• MPEG-1, MPEG-2, MPEG-2.5, MP3, WAV,
AIFF
• Widgets Library;
• Etc.
15. More About QNX (cont):
“By adding extra code to a digital music file,
they were able to turn a song burned to CD into a
Trojan horse. When played on the car's stereo,
this song could alter the firmware of the car's
stereo system, giving attackers an entry point to
change other components on the car”
Remember “Media Player Plugins” ?
19. QNX Network Services (Usually Default):
• Telnet
• Allows root login, if you know the password
• Unprivileged joe account? Try ./KissMyHash
(later on demo)
• FTP
• Does not allow root login. You’re able to
travel “/”, again, if you know the password.
• QCONN
• Kind of remote debug/profiling bridge for
IDE’s
• Allows root login, even if you don’t know the
password
20. QNX Qnet Protocol
• Transparent Distributed Processing Platform;
• Groups QNX systems or CPU’s (nodes) into na
integrated network;
• A QNX node can access resources on other nodes,
transparently.
• Resources can be:
• Files;
• Devices;
• Processes <-
• Same goes for IPC
