Curiosity Rover's OS has backdoor bug

Canadian security researcher Yannick Formaggio has detailed a significant flaw in VxWorks, the real-time operating system (RTOS) made by Intel subsidiary Wind River. Speaking at the 44CON event made famous last week, Formaggio detailed how an integer overflow mess allows remote code execution in the operating system. Formaggio …

[Destroy All Monsters]

Formaggio makes Fromaggio out of VxWorks

Come on Reg

[petur]

Re: Formaggio makes Fromaggio out of VxWorks

Yeah, and I guess I'll not be the only one who misread his name as fromaggio too :)

[Dr Paul Taylor]

Un gran formaggio?

"Formaggio" vuol dire "cheese" in italiano. Non so la parola "fromaggio" - forse e' un errore francese?

[Destroy All Monsters]

Re: Un gran formaggio?

quatrofromaggio and other disgraces

[Anonymous Coward]

Re: Un gran formaggio?

Indeed. However, I once went to an "Italian" restaurant in Newcastle that had "Fromageo" on the menu.

[Velv]

D'you know what? If you can get to Curiosity to compromise it, your fucking welcome to take it away

[Ragarath]

But someone could send a signal out and hijack it remotely they could then aim the rovers instruments at Earth!

War of the Worlds begins!

It has a laser you know.

P.S. please ignore any problems with sending the correct encrypted signal.

[VinceH]

Don't panic!

It might have a laser, but it's not a frikkin laser, and it's not attached to a shark. We're okay.

[joed]

remote code exec bug

now really remote

[jake]

Edge conditions.

Test them, or fail as a programmer.

EOF

[Destroy All Monsters]

Re: Edge conditions.

Err... jake?

There are dedicated "testers" for that who don't actually program.

Mashing these two activities up into single person is not good practice. At all.

[sqlrob]

Re: Edge conditions.

Edge conditions need to be in unit tests. So yeah, the initial phase of that testing is on the same person. Incompleteness of those tests should be caught in code review.

If it makes it past those two steps, then it's on the testers. But depending solely on QA is itself a bad practice.

[jake]

@DAM (was: Re: Edge conditions.)

"There are dedicated "testers" for that who don't actually program."

Non-programmers trying to test code. Gee, I wonder why so many commercial products are bug-ridden.

"Mashing these two activities up into single person is not good practice. At all."

Who said anything about "single person", DAM? Peer review works. Always has, always will.

[Peter Gathercole]

"FTP server is susceptible to ring buffer overflow when accessed at a high speed"

Well, that's one vulnerability they don't have to worry about, unless it's from the Martians .

[Wzrd1]

Re: "FTP server is susceptible to ring buffer overflow when accessed at a high speed"

My thought precisely.

The data link speed would require an excruciatingly slow buffer overflow.

The only way to exploit it is if the Martians have compatible hardware to overflow it, with the specialized string.

What is a race condition in a bounds checking routine?

[Efros]

Given it's a vehicle

More a tailgate than a backdoor.

[Anonymous Coward]

I wonder if the real problem was it got accidentally upgraded to Windows 10?

[Anonymous Coward]

Other operating systems are available

Or El Capitan.

[launcap]

I have one of those at home..

.. in miniture anyway. I worked/was employed/went there on a daily basis at Windriver when those rovers were made. Windriver USA made (without checking with NASA) a whole load of RC miniture rovers with NASA and Windriver logos.

NASA pitched a bit of a fit about unauthorised use of their logo and so the minitures never got sold - instead we were allowed to take away a couple each on the strict understanding that we didn't *ever* try to sell them..

I gave one to my nephew and kept one - both (as far as I know) still in their original boxes.

[Paul]

Quite a few domestic routers use VxWorks, the venerable WRT-54G for example was one where the switch from linux to VxWorks garned a fair bit of publicity, and the 54GL was created to keep hackers happy.

I now wonder how many consumer devices there are on the internet potentially at risk to these vulnerabilities

[Wzrd1]

"I now wonder how many consumer devices there are on the internet potentially at risk to these vulnerabilities"

How many of those WRT routers are running an externally accessible FTP server?

[Stevie]

Bah!

All your laser-induced breakdown spectroscopy data are belong to us.