Critical Zero Days Remotely Compromise the Most Popular Real-Time OS
summary
Research finds 11 zero-days in the VxWorks IPnet TCP/IP stack that affect hundreds of millions of devices out of ~2 billion VxWorks installs. Exploits include an IP source-route ICMP copy bug that triggers a stack overflow and remote code execution, a reverse‑ARP reply that assigns addresses and exposes hidden debug features, and urgent‑pointer underflow / 5‑packet state desync that causes massive out‑of‑bounds copies. Firmware is dumped via JTAG from an eBay-bought patient monitor, a working patient monitor RCE demo alters vitals, and a printer-to-cloud NAT bypass shows remote compromise through TCP header manipulation. Vendors issue patches.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 0:24Presentation Overview
- 1:18Agenda
- 2:03What is VXWorks
- 3:38Where VXWorks is used
- 4:42Why are TCPIP stacks important
- 5:58TCPIP stacks in the 90s
- 6:22Wing Nuke
- 6:58IP Net
- 8:26Impact evangelism
- 8:54SonicWALL
- 9:20Overview
- 10:40How it works
- 18:06Basic TCP
- 18:20TCP Window
- 19:18Urgent Data
- 19:53Urgent Pointer
- 22:41Data Mechanism
- 23:36VxWorks
- 27:28Example 5 Way Handshake
- 31:25Patient Monitor
- 32:08Three Easy Steps
- 32:20Dump the Framework
- 35:04Heap exploitation strategy
- 36:44Live demo
related talks
37mCDPwn: Taking Over Millions of Enterprise-Things with Layer 2 Zero-Days
34mCoDe16; 16 Zero-Day Vulnerabilities Affecting CODESYS Framework Leading to Remote Code Execution
29mFrom an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single Packet
38mFail Harder: Finding Critical 0-Days in Spite of Ourselves
44mNight of the living vulnerabilities
45mOutside the box: pwning IoT devices through their applications
27mWIFI-Important Remote Attack Surface: Threat is Expanding
35m0-day In-the-Wild Exploitation in 2022...so far.