Attacking VxWorks: From stone age to interstellar

Presented first at 44Con London September 2015 then at Syscan 360 in Beijing in October 2015.

VxWorks is the world’s most widely-used real-time operating system deployed in embedded systems. Its market reach spans across all safety critical fields, including the Mars Curiosity rover, Boeing 787 Dreamliner, network routers to name a few. The safety critical nature of these applications make VxWorks security a major concern.

Our team has conducted a thorough security analysis on VxWorks, including its supported network protocols and OS security mechanism. We will present the tool we developed for VxWorks assessment. The main goal of our tool is to provide effective penetration testing by implementing the WdbRPC protocol in python. To show its effectiveness, we are going to reveal some of the bugs we discovered along the way.

Finally, we will wrap up by demonstrating the vulnerability we found that allows remote code execution on most VxWorks based devices. A quick Internet scan shows that at least 100k devices running VxWorks are connected to the Internet. Considering the popularity of VxWorks in the age of IoT, this issue will have a widespread impact.

Transcript

1. ATTACKING VXWORKS FROM STONE AGE TO INTERSTELLAR Syscan+360 Beijing 10/22/2015 YANNICK FORMAGGIO, WENZHE ZHU, RICHARD HSU & ERIC LIU
2. ABOUT ME Yannick Formaggio Security Researcher at Istuary Innovation Labs @TheLumberJhack || yannickformaggio on LinkedIn Eric Liu Lead Security Researcher With help from 朱文哲 (Wenzhe Zhu), Richard Hsu 2
3. AGENDA 1.  Introduction to VxWorks & previous papers 2.  Inside VxWorks: Memory management & protections 3.  From fuzzing to exploit: RPC Integer Overflow RCE 3
4. INTRODUCTION 4
5. WHAT’S VXWORKS?   #1 Embedded devices RTOS   Developed by Wind River   Claimed > 1.5 billions devices   Supports lot of CPU architectures
6. WHAT’S VXWORKS? 1987 •  First release •  32 bits processing 1990’s •  VxWorks 5 released •  1st RTOS w/ network stack 2000’s •  VxWorks 6.x (12-2004) •  Security improvements (RTPs, no more task shared memory) 2014 •  VxWorks 7.x (02-2014) •  64bits, more security improvements
7. “ ” The Real-Time Operating System for the Internet of Things Powering billions of intelligent devices, VxWorks® delivers an industry-leading combination of scalability, safety, security, and virtualization capabilities to meet next-generation requirements. Windriver VxWorks product 7
8. SOME CUSTOMERS 8
9. SOME STATS 9
10. VXWORKS & SECURITY Source: http://www.cvedetails.com/product/15063/Windriver-Vxworks.html?vendor_id=95 10
11. VXWORKS & SECURITY   Wind River treats VxWorks security seriously   Partnership with McAffee in Feb 2011 Source: http://www.windriver.com/news/press/pr.html?ID=8801
12. VXWORKS & SECURITY   Wind River treats VxWorks security seriously   Partnership with McAffee in Feb 2011   6.x introduced some memory protections   7.x improved way further:   Digitally signed modules (X.509)   Encryption   Centralized user database   Password management (SHA-256 algorithm)   Ability to create/delete users at run time   Encrypted data storage
13. PREVIOUS RESEARCH PAPERS & INSPIRATIONS
14. PREVIOUS RESEARCH & INSPIRATIONS 2010: “Shiny Old VxWorks Vulnerabilities” HD Moore 4 Metasploit modules targeting WDB RPC   (Re)sources on pudn.com …   Weak password hash entropy è rainbow table containing around 200k hashed passwords 14
15. PREVIOUS RESEARCH & INSPIRATIONS “Reverse Engineering VxWorks Firmware: WRT54Gv8” /dev/ttyS0 15
16. PREVIOUS RESEARCH & INSPIRATIONS 2011: “Digging Inside the VxWorks OS and Firmware The Holistic Security” Aditya K Sood (0kn0ck) – SecNiche Security Lab   WDB debugging Interface (again)   OS Security 16
17. INSIDE VXWORKS MEMORY LAYOUT & PROTECTIONS 17
18. X86 MEMORY LAYOUT: UPPER MEMORY IDT (2KB) Addresss 0x0000 + LOCAL_MEM_LOCAL_ADRS GDT + 0x800 SM Anchor + 0x1100 Boot Line + 0x1200 Exception message + 0x1300 FD DMA Area + 0x2000 + 0x5000 (no memory) + 0xa0000 Initial Stack + 0x100000 System Image + 0x108000 _end WDB Memory Pool Interrupt stack System Memory Pool … sysMemTop() Available Reserved KEY 18
19. X86 UPPER MEMORY IDT (2KB) Addresss 0x0000 + LOCAL_MEM_LOCAL_ADRS GDT + 0x800 SM Anchor + 0x1100 Boot Line + 0x1200 Exception message + 0x1300 FD DMA Area + 0x2000 + 0x5000 (no memory) + 0xa0000 Initial Stack + 0x100000 System Image + 0x108000 _end WDB Memory Pool Interrupt stack System Memory Pool … sysMemTop() Available Reserved KEY   Interrupt Descriptor/ Vector Table 19
20. X86 UPPER MEMORY IDT (2KB) Addresss 0x0000 + LOCAL_MEM_LOCAL_ADRS GDT + 0x800 SM Anchor + 0x1100 Boot Line + 0x1200 Exception message + 0x1300 FD DMA Area + 0x2000 + 0x5000 (no memory) + 0xa0000 Initial Stack + 0x100000 System Image + 0x108000 _end WDB Memory Pool Interrupt stack System Memory Pool … sysMemTop() Available Reserved KEY   Interrupt Descriptor/ Vector Table   ASCII string for fatal exception message 20
21. X86 UPPER MEMORY IDT (2KB) Addresss 0x0000 + LOCAL_MEM_LOCAL_ADRS GDT + 0x800 SM Anchor + 0x1100 Boot Line + 0x1200 Exception message + 0x1300 FD DMA Area + 0x2000 + 0x5000 (no memory) + 0xa0000 Initial Stack + 0x100000 System Image + 0x108000 _end WDB Memory Pool Interrupt stack System Memory Pool … sysMemTop() Available Reserved KEY   Interrupt Decriptor/ Vector Table   ASCII string for fatal exception message   VxWorks image entry point 21
22. X86 UPPER MEMORY IDT (2KB) Addresss 0x0000 + LOCAL_MEM_LOCAL_ADRS GDT + 0x800 SM Anchor + 0x1100 Boot Line + 0x1200 Exception message + 0x1300 FD DMA Area + 0x2000 + 0x5000 (no memory) + 0xa0000 Initial Stack + 0x100000 System Image + 0x108000 _end WDB Memory Pool Interrupt stack System Memory Pool … sysMemTop() Available Reserved KEY   Interrupt Descriptor/ Vector Table   ASCII string for fatal exception message   VxWorks image entry point   WDB shared memory 22
23. MEMORY PROTECTIONS 1.  Stack protections 2.  Heap protections 23
24. MEMORY PROTECTION: Task and interrupt stack overrun and underrun protections Stack pages Stack Start Stop 24
25. MEMORY PROTECTION Non-executable task stacks & Non- writable Text Segment Program pages Read Only Raw Data r+w . T E X T .DATA 25
26. MEMORY PROTECTION -r-w-x Address Space 0x00000000 NULL Pointer usage/dereference detection 26
27. MEMORY PROTECTION HEAP BLOCK OVERRUN DETECTION / USAGE TRACKING & LEAKAGE DETECTION 27
28. FROM FUZZING TO EXPLOIT 28
29. FUZZING TARGETS  Network protocols:   Portmap (RPC)   FTP   TFTP   NTP   … 29
30. FUZZING   Used Sulley fuzzing framework   Problem: no accurate crash detection available   Solution: using WdbRPC 30
31. WHAT’S WDB RPC?   Debugging Interface   Service running on port UDP/17185   Based on SUN-RPC protocol   Provides direct access to system memory 31
32. WDB PROTOCOL V2 Target Server Target Agent WDB Shell Debugger Browser Other tools HOST VxWorks WTX 32 OS
33. STEPS FOR PROCESS MONITORING USING WDB: VXWORKS 5.X HOST TARGET CALL REPLY 33
34. STEPS FOR PROCESS MONITORING USING WDB: VXWORKS 5.X WDB_TARGET_CONNECT HOST TARGET CALL REPLY 34
35. STEPS FOR PROCESS MONITORING USING WDB: VXWORKS 5.X WDB_TARGET_CONNECT HOST TARGET WDB_TARGET_CONNECT CALL REPLY 35 1. Connect
36. STEPS FOR PROCESS MONITORING USING WDB: VXWORKS 5.X WDB_TARGET_CONNECT HOST TARGET WDB_TARGET_CONNECT WDB_FUNC_CALL CALL REPLY 36 1. Connect
37. STEPS FOR PROCESS MONITORING USING WDB: VXWORKS 5.X WDB_TARGET_CONNECT HOST TARGET WDB_TARGET_CONNECT WDB_FUNC_CALL WDB_FUNC_CALL CALL REPLY 37 1. Connect 2. Set task breakable
38. STEPS FOR PROCESS MONITORING USING WDB: VXWORKS 5.X WDB_TARGET_CONNECT HOST TARGET WDB_TARGET_CONNECT WDB_FUNC_CALL WDB_FUNC_CALL CALL REPLY WDB_CONTEXT_SUSPEND WDB_CONTEXT_SUSPEND 38 1. Connect 2. Set task breakable 3. Suspend execution
39. STEPS FOR PROCESS MONITORING USING WDB: VXWORKS 5.X WDB_TARGET_CONNECT HOST TARGET WDB_TARGET_CONNECT WDB_FUNC_CALL WDB_FUNC_CALL CALL REPLY WDB_CONTEXT_SUSPEND WDB_CONTEXT_SUSPEND WDB_EVENTPOINT_ADD WDB_EVENTPOINT_ADD 39 1. Connect 2. Set task breakable 3. Suspend execution 4. Set breakpoint
40. STEPS FOR PROCESS MONITORING USING WDB: VXWORKS 5.X WDB_TARGET_CONNECT HOST TARGET WDB_TARGET_CONNECT WDB_FUNC_CALL WDB_FUNC_CALL CALL REPLY WDB_CONTEXT_SUSPEND WDB_CONTEXT_SUSPEND WDB_EVENTPOINT_ADD WDB_EVENTPOINT_ADD WDB_CONTEXT_CONT WDB_CONTEXT_CONT 40 1. Connect 2. Set task breakable 3. Suspend execution 4. Set breakpoint/attach 5. Continue Execution
41. STEPS FOR PROCESS MONITORING USING WDB: VXWORKS 6.X WDB_TARGET_CONNECT2 HOST TARGET WDB_TARGET_CONNECT2 WDB_FUNC_CALL WDB_FUNC_CALL CALL REPLY WDB_EVALUATE_GOPHER WDB_EVALUATE_GOPHER WDB_EVALUATE_GOPHER WDB_EVALUATE_GOPHER … 41 More info on Gopher 1. Connect 2. Set task breakable 3. Set breakpoint/attach
42. STEPS FOR PROCESS MONITORING USING WDB: VXWORKS 6.X CALL REPLY 42 WDB_TARGET_CONNECT2 HOST TARGET WDB_TARGET_CONNECT2 WDB_FUNC_CALL WDB_FUNC_CALL WDB_EVALUATE_GOPHER WDB_EVALUATE_GOPHER … WDB_MEM_READ WDB_MEM_READ  Host reads the pointed memory addresses
43. CRASH DETECTION   Target sends event notification 43 HOST TARGET EVENT NOTICATION
44. CRASH DETECTION   Target sends event notification   Host acknowledges 44 HOST TARGET EVENT NOTICATION WDB_EVENT_GET
45. CRASH DETECTION 1)  Target sends event notification 2)  Host acknowledges 3)  Host ask more information (registers content, memory area, …) 45 HOST TARGET EVENT NOTICATION WDB_EVENT_GET WDB_EVENT_GET WDB_REGS_GET WDB_MEM_READ
46. WDBRPC FRAMEWORK   Python 2.7   Supports VxWorks 5.x and 6.x   Partially implements WDBRPC protocol   Implements a basic remote debugger: WdbDbg 46
47. WDBRPC FRAMEWORK   Some externals dependencies:   PyElfTools: reads the imports from the VxWorks Image   Capstone Engine: disassemble code around crash area 47
48. FUZZING 48 Sulley Fuzzer VxWorks Target Test cases VxWorks Process Monitor PED RPC WDB RPC WdbDbg
49. DEMO 49
50. RESULTS 50
51. CRASH ANALYSIS   Portmap task crashed many times on the same RPC field: credential flavor   When set to a negative value => PC is set to arbitrary memory value 51
52. CRASH ANALYSIS 52
53. CRASH ANALYSIS 53
54. CRASH ANALYSIS 54
55. CRASH ANALYSIS 55
56. CRASH ANALYSIS 56 O_o
57. CRASH ANALYSIS 57
58. CRASH ANALYSIS 58
59. CVE-2015-7599   Vuln reported to Wind River on July 22nd and acknowledged on 23rd   Confirmed August 11th Wind River is providing patches   Every VxWorks customers should check the Knowledge Library for details   On Sept 9th 2015 I’ve been authorised to disclose details 59
60. AFFECTED VERSIONS
61. HOW TO EXPLOIT?   Integer overflow leading to RCE   Heap spray to place the shellcode   Compute credential flavor value   Jump into shellcode directly   all memory protections bypassed/defeated   backdoor account set up 61
62. EXPLOITATION DEMO 62
63. WHAT ABOUT A REAL TARGETS?   Schneider Modicon Quantum PLC runs VxWorks and has port 111 open ( https:// www.digitalbond.com/tools/ basecamp/schneider- modicon-quantum/) 63
64. … BUT   Currently shipped module: portmap unavailable by default   Previous releases have a patch now
65. SOME NUMBERS   Schneider Modicon Quantum PLC runs VxWorks 5.4 and has port 111 open 65
66. FUN FACT 66
67. MORE BUGS FOUND DURING FUZZING FTP server is susceptible to ring buffer overflow when accessed at a high speed 67
68. MORE BUGS FOUND DURING FUZZING FTP server crashes when received specially crafted username è network stack down 68
69. CONCLUSION   Wind River takes VxWorks’ security seriously   Implemented a lot of memory protections   Being defeated by a simple integer overflow bug   And now we have a debugging framework to find more! 69
70. FUTURE WORK ?   VxWorks 7?   More complete WDBRPC protocol and Wdb over serial implementation   Continuing to find bugs 70
71. QUESTIONS ? 71
72. THANKS !
73. CODE RELEASE   The WdbDbg framework will be available here: https://bitbucket.org/istuarysecurityteam/wdbdbg   Exploit code will not be released unless explicit authorisation given 73
74. LINKS http://www.vxdev.com/docs/vx55man/tornado-api/wdbpcl/wdb.html http://www.uio.no/[...]/vxworks_architecture_supplement_6.2.pdf http://www.uio.no/[...]/vxworks_kernel_programmers_guide_6.2.pdf http://cimsol-mc.sourceforge.net/files/vxworks/VxWorks60.pdf Digging Inside the VxWorks OS and Firmware The Holistic Security HD Moore - Fun with VxWorks 74