Sign up
Subscribe to our Blind-Spot Monitor newsletters to catch up on all the top automotive stories of the week Subscribe to our Blind-Spot Monitor newsletters to catch up on all the top automotive stories of the week Sign up now>

BlackBerry software flaw could impact cars, medical devices, say U.S. agencies

Politico reports Canadian company initially resisted making a public announcement about the vulnerability

Staff, Reuters
Aug 24, 2021  •  August 24, 2021  •  1 minute read  •  Join the conversation
The Blackberry logo is seen on a smarphone in front of a displayed stock graph in this illustration taken February 5, 2021.
The Blackberry logo is seen on a smarphone in front of a displayed stock graph in this illustration taken February 5, 2021. Photo by Dado Ruvic /Reuters

A cybersecurity flaw in a software designed by BlackBerry Ltd could put at risk cars and medical equipment that use it and expose highly sensitive systems to attackers, the U.S. drugs regulator and a federal agency said on mid-August.

Story continues below

The warning came after the Canadian company disclosed that its QNX Real Time Operating System (QNX RTOS) has a vulnerability that could allow an attacker to execute an arbitrary code or flood a server with traffic until it crashes or gets paralyzed.

The software is used by automakers including Volkswagen, BMW, and Ford in many critical functions, including the Advanced Driver Assistance System.

The issue does not impact current or recent versions of the QNX RTOS, but rather versions dating from 2012 and earlier, BlackBerry said, adding that, at this time, no customers have indicated that they have been impacted.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) said the software is used in a wide range of products and its compromise “could result in a malicious actor gaining control of highly sensitive systems, increasing risk to the Nation’s critical functions”, the CISA said.

Story continues below

The federal agency that comes under the Department of Homeland Security and the company said they were not yet aware of any case of active exploitation of the flaw.

More On This Topic

  1. Tesla fixes code loophole that would have made Model X easy to steal

    Tesla fixes code loophole that would have made Model X easy to steal

  2. These are the 4 top hacking vulnerabilities in today’s cars 

    These are the 4 top hacking vulnerabilities in today’s cars 

The U.S. Food and Drug Administration said it was not aware of any adverse events even as medical equipment manufacturers assess which systems could be affected.

The company also said it has notified potential customers that have been affected and has made software patches available to resolve the matter.

BlackBerry had initially denied that the vulnerability, dubbed as BadAlloc, impacted its products and later resisted making a public announcement, Politico reported , citing two people familiar with talks between the company and federal cybersecurity officials, including a government employee.

Trending