I am researching an QNX ARM based car navigation and it seems this system has a backdoor that enables telnet access without password to the system if a challenge/response succeeds.
When a file called
challenge is placed on a USB key and inserted in the system it will write some bytes in it. Here are a few examples:
I found the ELF file that handles the challenge/response in the firmware (can share this upon request) and it reads a public key file:
hChallengePub = sub_1030A0((int)"/ifs/challenge.pub", &v11, &v13)
challenge.pub contains the following bytes:
30 29 03 02 07 00 02 01 0E 02 0F 00 9C 9C A4 5A
FA 1E 2D 32 2A 93 9D 37 41 93 02 0F 00 95 AB 6B
DB 94 29 4D C3 C6 07 3B B7 31 40
Debug text in the ELF points to source file
src/pk/ecc/ecc_import.c which leds me to believe it's an ECC public key but it seems to be incomplete (eg no ASN.1 header).
I want to be able to convert this key into pem format so I can run some tests with openssl so I am looking for pointers how to do this.
Ultimately I'd like to see if I can create proper response and get access but maybe this is impossible if it requires private key (which it should if it's any good).