Who are we? Jos Wetzels Ali Abbasi

BlackBerry QNX Hypervisor

BlackBerry QNX Hypervisor

• Safety-Certified Type 1 hypervisor based on QNX Neutrino Microkernel
• Hypervisor 1.0 (2015) based on 32-bit QNX SDP 6.x
• Hypervisor 2.0 (2017) based on 64-bit QNX SDP 7.0
• Hardware virtualization support (VT-x, ARMv8 virtualization)
• VirtIO guest communication

Many more critical systems

Many more critical systems

• Industrial Control Systems
• Caterpillar Surface Mining Control
• GE Mark VI Turbine Controller
• Novar HVAC
• Fortna Warehouse Control
• Emerson Ovation DCS
• Defense & Aerospace
• UAVs
• Anti-Tank Guidance
• Autonomous Underwater Vehicles
• Aerospace System-on-Modules (SoMs)
• Satellite Systems
• Rail Safety (MEN MTCS)
• MPRI Cancer Therapy
• Etc.

What’s New?

What’s New?

• ‘Wheel of Fortune’ @ 33C3
• PRNG issues in VxWorks, RedactedOS, QNX <= 6.6
• This talk
• New QNX 7 userspace & kernelspace PRNGs
• Exploit Mitigations in QNX 6 & 7

OS & Security Architecture

QNX Microkernel Architecture

QNX Microkernel Architecture

QNX IPC Message Passing

QNX IPC Message Passing

QNX Attack Surface

QNX Attack Surface

QNX Security History

QNX Security History

• BlackBerry Mobile Research (2011 - 2014)
• Alexander Antukh, Ralf-Philipp Weinmann, Daniel Martin Gomez, Zach Lanier et al.
• QNX IPC, PPS, Kernel Calls (2016)
• Alex Plaskett et al.
• Various individual vulnerabilities (2000 – 2008)
• Anakata, Julio Cesar Fort, Tim Brown
• Observations
• Lots of setuid logic bugs (ifwatchd, pppoectl)
• Lots of memory corruption (std utils, Photon GUI, PPPoEd)
• Lots of insecure permissions (ptrace, Photon, /etc/ configs)