2

I am researching an QNX ARM based car navigation and it seems this system has a backdoor that enables telnet access without password to the system if a challenge/response succeeds.

When a file called challenge is placed on a USB key and inserted in the system it will write some bytes in it. Here are a few examples: eaxj2ABs4BeMQqQJamOH?smOCVEC KKUcw5m:vvJXmCIK3SBDDqv9p:Or odlwY@ed6B?8OKCmaqIDdFz7YSnv BBqGoWKocmAuvSDacMAkZ:83:QVq

I found the ELF file that handles the challenge/response in the firmware (can share this upon request) and it reads a public key file: hChallengePub = sub_1030A0((int)"/ifs/challenge.pub", &v11, &v13)

challenge.pub contains the following bytes:

30 29 03 02 07 00 02 01 0E 02 0F 00 9C 9C A4 5A
FA 1E 2D 32 2A 93 9D 37 41 93 02 0F 00 95 AB 6B
DB 94 29 4D C3 C6 07 3B B7 31 40

Debug text in the ELF points to source file src/pk/ecc/ecc_import.c which leds me to believe it's an ECC public key but it seems to be incomplete (eg no ASN.1 header).

I want to be able to convert this key into pem format so I can run some tests with openssl so I am looking for pointers how to do this.

Ultimately I'd like to see if I can create proper response and get access but maybe this is impossible if it requires private key (which it should if it's any good).

Improve this question

1 Answer 1

Reset to default
2

src/pk/ecc/ecc_import.c strongly suggests that it's using LibTomCrypt: https://github.com/libtom/libtomcrypt/blob/develop/src/pk/ecc/ecc_import.c

The content of challenge.pub appears to be DER-encoded. It can be decoded as follows:

SEQUENCE(4 elem)
    BIT STRING (1 bit) 0
    INTEGER            14
    INTEGER (112 bit)  3176466357047968568460177262985619
    INTEGER (112 bit)  3035660427084515633934604600553792

As can be seen in the ecc_import.c code referenced above, this translates to:

  • key->type = PK_PUBLIC
  • key_size = 14 bytes
  • key->pubkey.x = 3176466357047968568460177262985619
  • key->pubkey.y = 3035660427084515633934604600553792
Improve this answer
3
  • How to verify it with openssl ? openssl ec -noout -text -inform DER -in challenge.pub -pubin fails: read EC key unable to load Key 24340:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1198: 24340:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:372:Type=X509_ALGOR 24340:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:694:Field=algor, Type=X509_PUBKEY Missing ASN1 ?
    – Remko
    Apr 5, 2016 at 17:22
  • LibTomCrypt uses a different format than openssl expects. See superuser.com/questions/900918/… for openssl's expected format.
    – Jason Geffner
    Apr 5, 2016 at 17:49
  • Accepting this answer as it's very helpful (would still like to convert to OpenSSL compatible PEM format but I will research that)
    – Remko
    Apr 11, 2016 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.