{"id":101725,"date":"2021-10-22T16:22:55","date_gmt":"2021-10-22T14:22:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave"},"modified":"2021-10-22T16:22:55","modified_gmt":"2021-10-22T14:22:58","slug":"ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","title":{"rendered":"\u00datok na Intel SGX, kter\u00fd umo\u017e\u0148uje extrakci d\u016fv\u011brn\u00fdch dat nebo spu\u0161t\u011bn\u00ed k\u00f3du v enclave.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdzkumn\u00edci z Vojensk\u00e9ho technick\u00e9ho univerzity lidov\u00e9 osvobozeneck\u00e9 arm\u00e1dy \u010c\u00edny, N\u00e1rodn\u00edho univerzity Singapuru a \u0160v\u00fdcarsk\u00e9ho feder\u00e1ln\u00edho technologick\u00e9ho institutu v Curychu vyvinuli novou metodu \u00fatoku na izolovan\u00e9 enkl\u00e1vy Intel SGX (Software Guard eXtensions). Tento \u00fatok, nazvan\u00fd SmashEx, je zp\u016fsoben probl\u00e9my s reentrantnost\u00ed p\u0159i zpracov\u00e1n\u00ed v\u00fdjime\u010dn\u00fdch situac\u00ed v r\u00e1mci runtime komponent\u016f Intel SGX. Navrhovan\u00e1 metoda \u00fatoku umo\u017e\u0148uje p\u0159i p\u0159evzet\u00ed kontroly nad opera\u010dn\u00edm syst\u00e9mem identifikovat d\u016fv\u011brn\u00e9 \u00fadaje ulo\u017een\u00e9 v enkl\u00e1v\u011b nebo zorganizovat kop\u00edrov\u00e1n\u00ed vlastn\u00edho k\u00f3du do pam\u011bti enkl\u00e1vy a jeho proveden\u00ed. <\/p>\n

Prototypy exploit\u016f byly p\u0159ipraveny pro enkl\u00e1vy s runtime zalo\u017een\u00fdm na Intel SGX SDK (CVE-2021-0186) a Microsoft Open Enclave (CVE-2021-33767). V prvn\u00edm p\u0159\u00edpad\u011b byla demonstrov\u00e1na mo\u017enost extrakce RSA kl\u00ed\u010de pou\u017e\u00edvan\u00e9ho na webov\u00e9m serveru pro HTTPS, zat\u00edmco ve druh\u00e9m p\u0159\u00edpad\u011b se poda\u0159ilo ur\u010dit obsah z\u00edskan\u00fd pomoc\u00ed utilitiy cURL, spu\u0161t\u011bn\u00e9 uvnit\u0159 enkl\u00e1vy. Zranitelnost byla ji\u017e softwarov\u011b odstran\u011bna ve verz\u00edch Intel SGX SDK 2.13 a Open Enclave 0.17.1. Krom\u011b bal\u00ed\u010dk\u016f Intel SGX SDK a Microsoft Open Enclave se zranitelnost tak\u00e9 projevuje v SDK Google Asylo, EdgelessRT, Apache Teaclave, Rust SGX SDK, SGX-LKL, CoSMIX a Veracruz. <\/p>\n

P\u0159ipome\u0148me, \u017ee technologie SGX (Software Guard Extensions) se objevila v procesorech Intel Core \u0161est\u00e9 generace (Skylake) a nab\u00edz\u00ed \u0159adu instrukc\u00ed, kter\u00e9 umo\u017e\u0148uj\u00ed vy\u010dlenit aplikac\u00edm u\u017eivatelsk\u00e9 \u00farovn\u011b uzav\u0159en\u00e9 oblasti pam\u011bti \u2014 enclave, jejich\u017e obsah nem\u016f\u017ee b\u00fdt p\u0159e\u010dten ani zm\u011bn\u011bn ani j\u00e1drem, ani k\u00f3dem vykon\u00e1van\u00fdm v re\u017eimech ring0, SMM a VMM. P\u0159ed\u00e1n\u00ed \u0159\u00edzen\u00ed k\u00f3du v enclave nen\u00ed mo\u017en\u00e9 tradi\u010dn\u00edmi p\u0159echodov\u00fdmi funkcemi a manipulacemi s registry a z\u00e1sobn\u00edkem \u2014 pro p\u0159ed\u00e1n\u00ed \u0159\u00edzen\u00ed do enclave se pou\u017e\u00edvaj\u00ed speci\u00e1ln\u011b vytvo\u0159en\u00e9 nov\u00e9 instrukce EENTER, EEXIT a ERESUME, kter\u00e9 prov\u00e1d\u011bj\u00ed kontrolu opr\u00e1vn\u011bn\u00ed. Vlo\u017een\u00fd k\u00f3d v enclave m\u016f\u017ee p\u0159itom pou\u017e\u00edt klasick\u00e9 metody vol\u00e1n\u00ed pro osloven\u00ed funkc\u00ed uvnit\u0159 enclave a speci\u00e1ln\u00ed instrukci pro vol\u00e1n\u00ed extern\u00edch funkc\u00ed. Pro ochranu p\u0159ed hardwarov\u00fdmi \u00fatoky, jako je p\u0159ipojen\u00ed k modulu DRAM, se pou\u017e\u00edv\u00e1 \u0161ifrov\u00e1n\u00ed pam\u011bti enclave.

\"\u00datok<\/center> <\/p>\n

Probl\u00e9m je spojen s t\u00edm, \u017ee technologie SGX umo\u017e\u0148uje opera\u010dn\u00edmu syst\u00e9mu p\u0159eru\u0161it vykon\u00e1v\u00e1n\u00ed enclav\u016f pomoc\u00ed generov\u00e1n\u00ed hardwarov\u00e9 v\u00fdjimky, zat\u00edmco v enclavech nen\u00ed spr\u00e1vn\u011b implementov\u00e1no primitivum pro atomick\u00e9 zpracov\u00e1n\u00ed t\u011bchto v\u00fdjimek. Na rozd\u00edl od j\u00e1dra opera\u010dn\u00edho syst\u00e9mu a b\u011b\u017en\u00fdch aplikac\u00ed, k\u00f3d uvnit\u0159 enclav\u016f nem\u00e1 p\u0159\u00edstup k primitiv\u016fm pro organizaci atomick\u00fdch akc\u00ed b\u011bhem zpracov\u00e1n\u00ed asynchronn\u011b vznikaj\u00edc\u00edch v\u00fdjimek. Bez t\u011bchto atomick\u00fdch primitiv\u016f m\u016f\u017ee b\u00fdt enclave kdykoli p\u0159eru\u0161en a vr\u00e1cen do vykon\u00e1v\u00e1n\u00ed, i v okam\u017eic\u00edch, kdy se v enclavu prov\u00e1d\u00ed kritick\u00e9 sekce a nach\u00e1z\u00ed se v nebezpe\u010dn\u00e9m stavu (nap\u0159\u00edklad kdy\u017e nejsou ulo\u017eeny\/obnoveny registry CPU).

\"\u00datok<\/center> <\/p>\n

Pro norm\u00e1ln\u00ed fungov\u00e1n\u00ed technologie SGX umo\u017e\u0148uje p\u0159eru\u0161it vykon\u00e1v\u00e1n\u00ed enclavu pomoc\u00ed konfigurovateln\u00fdch hardwarov\u00fdch v\u00fdjimek. Tato vlastnost umo\u017e\u0148uje runtime prost\u0159ed\u00edm enclav\u016f realizovat zpracov\u00e1n\u00ed v\u00fdjimek uvnit\u0159 enclavu nebo zpracov\u00e1n\u00ed sign\u00e1l\u016f, ale tak\u00e9 m\u016f\u017ee vyvolat chyby reentrability. \u00datok SmashEx spo\u010d\u00edv\u00e1 v vyu\u017eit\u00ed nedostatk\u016f v SDK, kv\u016fli nim\u017e nen\u00ed dan\u00e1 situace znovu vyvol\u00e1n\u00ed zpracovatele v\u00fdjimky spr\u00e1vn\u011b zpracov\u00e1na. Je d\u016fle\u017eit\u00e9, \u017ee k exploataci zranitelnosti mus\u00ed \u00fato\u010dn\u00edk m\u00edt schopnost p\u0159eru\u0161it vykon\u00e1v\u00e1n\u00ed enclavu, t.j. mus\u00ed m\u00edt kontrolu nad prac\u00ed syst\u00e9mov\u00e9ho prost\u0159ed\u00ed. <\/p>\n

Po generaci v\u00fdjimky z\u00edsk\u00e1v\u00e1 \u00fato\u010dn\u00edk mal\u00e9 \u010dasov\u00e9 okno, b\u011bhem kter\u00e9ho m\u016f\u017ee zachytit tok vykon\u00e1v\u00e1n\u00ed manipulac\u00ed s enterparametry. Zejm\u00e9na p\u0159i p\u0159\u00edstupu k syst\u00e9mu (prost\u0159ed\u00ed mimo enclave) je mo\u017en\u00e9 vytvo\u0159it novou v\u00fdjimku bezprost\u0159edn\u011b po vykon\u00e1n\u00ed instrukce vstupu do enclavy (EENTER), co\u017e povede k p\u0159ed\u00e1n\u00ed \u0159\u00edzen\u00ed syst\u00e9mu ve f\u00e1zi, kdy je\u0161t\u011b nen\u00ed dokon\u010deno nastaven\u00ed z\u00e1sobn\u00edku pro enclave, v\u010detn\u011b udr\u017eov\u00e1n\u00ed stavu registr\u016f CPU. <\/p>\n

Syst\u00e9m pak m\u016f\u017ee vr\u00e1tit kontrolu zp\u011bt do enclave, ale proto\u017ee z\u00e1sobn\u00edk enclave b\u011bhem p\u0159eru\u0161en\u00ed nebyl nastaven, bude enclave vykon\u00e1v\u00e1n se z\u00e1sobn\u00edkem, kter\u00fd je v pam\u011bti syst\u00e9mu, co\u017e lze vyu\u017e\u00edt k uplatn\u011bn\u00ed metod exploatace zalo\u017een\u00fdch na n\u00e1vratov\u011b orientovan\u00e9m programov\u00e1n\u00ed (ROP \u2014 Return-Oriented Programming). P\u0159i pou\u017eit\u00ed techniky ROP se \u00fato\u010dn\u00edk nesna\u017e\u00ed um\u00edstit sv\u016fj k\u00f3d do pam\u011bti, ale pracuje ji\u017e existuj\u00edc\u00edmi kusy strojov\u00fdch instrukc\u00ed v na\u010dten\u00fdch knihovn\u00e1ch, kter\u00e9 kon\u010d\u00ed instrukc\u00ed n\u00e1vratu \u0159\u00edzen\u00ed (obvykle se jedn\u00e1 o konce funkc\u00ed knihoven). Pr\u00e1ce exploitace spo\u010d\u00edv\u00e1 v sestaven\u00ed \u0159et\u011bzce vol\u00e1n\u00ed podobn\u00fdch blok\u016f (\"gadgets\") pro z\u00edsk\u00e1n\u00ed pot\u0159ebn\u00e9 funk\u010dnosti.

\"\u00datok<\/center>
\"\u00datok<\/center>
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041e\u0431\u043e\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u043d\u0430\u0443\u0447\u043d\u043e-\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u041d\u0430\u0440\u043e\u0434\u043d\u043e-\u043e\u0441\u0432\u043e\u0431\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0440\u043c\u0438\u0438 \u041a\u0438\u0442\u0430\u044f, \u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0430 \u0438 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u043d\u043a\u043b\u0430\u0432\u044b Intel SGX (Software Guard eXtensions). \u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 SmashEx \u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438 \u0441 \u0440\u0435\u0435\u043d\u0442\u0435\u0440\u0430\u0431\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0439 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0431\u043e\u0442\u044b runtime-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f Intel SGX. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":101726,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101725","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00datok na Intel SGX, kter\u00fd umo\u017e\u0148uje extrakci d\u016fv\u011brn\u00fdch dat nebo spu\u0161t\u011bn\u00ed k\u00f3du v enclave | ProHoster","description":"V\u00fdzkumn\u00edci z Obrann\u00e9 v\u011bdeckotechnick\u00e9 univerzity lidov\u00e9 osvobozeneck\u00e9 arm\u00e1dy \u010c\u00edny, N\u00e1rodn\u00edho univerzity Singapuru a \u0160v\u00fdcarsk\u00e9 vysok\u00e9 technick\u00e9 \u0161koly v Curychu vyvinuli novou metodu \u00fatoku na.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 Intel SGX, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u0430\u043d\u043a\u043b\u0430\u0432\u0435 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041e\u0431\u043e\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u043d\u0430\u0443\u0447\u043d\u043e-\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u041d\u0430\u0440\u043e\u0434\u043d\u043e-\u043e\u0441\u0432\u043e\u0431\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0440\u043c\u0438\u0438 \u041a\u0438\u0442\u0430\u044f, \u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0430 \u0438 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-22T14:22:58+00:00","article:modified_time":"2021-10-22T14:22:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101725","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-22 14:25:41","updated":"2022-09-28 00:18:10","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=101725"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101725\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/101726"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=101725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=101725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=101725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}