Abstract

Connected vehicles have rapidly gained popularity in the market, but this proliferation has also introduced greater risks to both passengers and traffic security. While there is a growing body of research on hacking and security vulnerabilities in individual cars, there’s been relatively limited focus on the operating systems that underpin these vehicles, despite the potential for higher impact.

In this presentation, we aim to address this gap by introducing the first fullchain exploits against QNX, one of the most widely deployed, COTS operating systems in the automotive industry. QNX is such a significant target that it has been featured in PWN2OWN Vehicle 2024. Our objective is to drive innovation within the research community by shedding light on the vulnerabilities inherent to this critical component of connected vehicles.

During this talk, we will conduct a comprehensive dissection of QNX, delving into its architecture, design, and overall security posture. By doing so, we hope to spark discussions in the security communicty and encourage a proactive approach to enhancing the security of this pivotal automotive operating system.