{"id":119725,"date":"2024-09-06T15:43:01","date_gmt":"2024-09-06T13:43:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-eucleak-pozvolyayushhaya-klonirovat-yubikey-5-i-drugie-klyuchi-na-chipah-infineon"},"modified":"2024-09-06T15:43:01","modified_gmt":"2024-09-06T13:43:02","slug":"ataka-eucleak-pozvolyayushhaya-klonirovat-yubikey-5-i-drugie-klyuchi-na-chipah-infineon","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-eucleak-pozvolyayushhaya-klonirovat-yubikey-5-i-drugie-klyuchi-na-chipah-infineon","title":{"rendered":"\u00datok EUCLEAK, kter\u00fd umo\u017e\u0148uje klonov\u00e1n\u00ed YubiKey 5 a dal\u0161\u00edch kl\u00ed\u010d\u016f na \u010dipech Infineon","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Bezpe\u010dnostn\u00ed v\u00fdzkumn\u00edci z firmy NinjaLab vyvinuli techniku \u00fatoku skrze vedlej\u0161\u00ed kan\u00e1ly, kter\u00e1 umo\u017e\u0148uje klonov\u00e1n\u00ed ECDSA kl\u00ed\u010d\u016f ulo\u017een\u00fdch v kryptografick\u00fdch tokenech YubiKey 5 a dal\u0161\u00edch za\u0159\u00edzen\u00edch, kter\u00e1 pou\u017e\u00edvaj\u00ed kryptografickou knihovnu od spole\u010dnosti Infineon. \u00datok byl pojmenov\u00e1n EUCLEAK a krom\u011b token\u016f s \u010dipy Infineon SLE78 m\u016f\u017ee b\u00fdt aplikov\u00e1n i na mnoh\u00e9 dal\u0161\u00ed syst\u00e9my s mikrokontrol\u00e9ry spole\u010dnosti Infineon, v\u010detn\u011b \u010dip\u016f Infineon Optiga Trust M a Infineon Optiga TPM. <\/p>\n

Mo\u017enost proveden\u00ed \u00fatoku byla prakticky potvrzena pro kl\u00ed\u010de YubiKey 5Ci a TPM na \u010dipech SLB96xx, zat\u00edmco u dal\u0161\u00edch za\u0159\u00edzen\u00ed m\u00e1 zat\u00edm teoretick\u00fd charakter. U kl\u00ed\u010d\u016f YubiKey 5 byla zranitelnost odstran\u011bna ve verzi firmwaru 5.7 v\u00fdm\u011bnou kryptografick\u00e9 knihovny (oprava se vztahuje pouze na nov\u00e1 za\u0159\u00edzen\u00ed, nebo\u0165 u ji\u017e vydan\u00fdch za\u0159\u00edzen\u00edch YubiKey nen\u00ed mo\u017enost aktualizace firmwaru). Pro knihovnu Infineon byly vyvinuty blokuj\u00edc\u00ed opravy zranitelnosti, av\u0161ak zat\u00edm nebyly nasazeny, nebo\u0165 nepro\u0161ly certifikac\u00ed. <\/p>\n

Krom\u011b kl\u00ed\u010d\u016f YubiKey 5 probl\u00e9m potenci\u00e1ln\u011b zasahuje TPM \u010dipy (Trusted Platform Module) notebook\u016f Lenovo, Dell a HP, izolovan\u00e9 enclave smartphon\u016f Samsung a OnePlus, hardwarov\u00e9 kryptom\u011bnov\u00e9 pen\u011b\u017eenky, smart karty, SIM karty a EMV \u010dipy bankovn\u00edch karet, stejn\u011b jako \u010dipy elektronick\u00fdch pas\u016f pou\u017e\u00edvan\u00e9 v \u010c\u00edn\u011b, Indii, Braz\u00edlii, USA a n\u011bkter\u00fdch dal\u0161\u00edch asijsk\u00fdch a evropsk\u00fdch zem\u00edch. <\/p>\n

Riziko klonov\u00e1n\u00ed kl\u00ed\u010d\u016f je kompenzov\u00e1no podm\u00ednkami a slo\u017eitost\u00ed prov\u00e1d\u011bn\u00ed \u00fatoku \u2014 \u00fato\u010dn\u00edk mus\u00ed z\u00edskat fyzick\u00fd p\u0159\u00edstup ke kl\u00ed\u010di a rozebrat ho, zbavit se plastov\u00e9ho krytu a st\u00ednic\u00edho pl\u00e1\u0161t\u011b. Po takov\u00e9 manipulaci je mo\u017en\u00e9 obnovit kryt na 3D tisk\u00e1rn\u011b, ale ud\u011blat manipulaci s kl\u00ed\u010dem nen\u00e1padnou je dost obt\u00ed\u017en\u00e9. Skenov\u00e1n\u00ed kl\u00ed\u010de trv\u00e1 n\u011bkolik minut, ale dal\u0161\u00edch p\u0159ibli\u017en\u011b hodinu je pot\u0159eba na pe\u010dliv\u00e9 rozebr\u00e1n\u00ed a vytvo\u0159en\u00ed nov\u00e9ho krytu. Po skenov\u00e1n\u00ed m\u016f\u017ee b\u00fdt za\u0159\u00edzen\u00ed vr\u00e1ceno majiteli, ale pro rekonstrukci soukrom\u00e9ho ECDSA kl\u00ed\u010de na z\u00e1klad\u011b z\u00edskan\u00fdch dat je pot\u0159eba dal\u0161\u00edch p\u0159ibli\u017en\u011b 24 hodin v\u00fdpo\u010dt\u016f (uv\u00e1d\u00ed se, \u017ee proces lze zkr\u00e1tit na hodinu, pokud se ru\u010dn\u00ed operace automatizuj\u00ed a provedou optimalizace).

\"\u00datok<\/center> <\/p>\n

Krom\u011b fyzick\u00e9ho p\u0159\u00edstupu k kl\u00ed\u010di pro \u00fasp\u011b\u0161n\u00e9 proveden\u00ed \u00fatoku na slu\u017eby s v\u00edcestup\u0148ovou autentizac\u00ed \u00fato\u010dn\u00edkovi nav\u00edc mus\u00ed n\u011bjak\u00fdm zp\u016fsobem zjistit p\u0159ihla\u0161ovac\u00ed jm\u00e9no a heslo k slu\u017eb\u011b, pro dodate\u010dnou autentizaci k n\u00ed\u017e je pou\u017eit poskytnut\u00fd hardwarov\u00fd kl\u00ed\u010d. V p\u0159\u00edpad\u011b bezheslov\u00e9 autentizace v re\u017eimech FIDO2 Passwordless nebo Passkey je nutn\u00e9 reprodukovat unik\u00e1tn\u00ed biometrick\u00fd faktor (nap\u0159\u00edklad otisk prstu). <\/p>\n

Metoda \u00fatoku spo\u010d\u00edv\u00e1 ve vytvo\u0159en\u00ed kl\u00ed\u010d\u016f ECDSA ulo\u017een\u00fdch v tokenu na z\u00e1klad\u011b dat z\u00edskan\u00fdch anal\u00fdzou elektromagnetick\u00e9ho sign\u00e1lu emitovan\u00e9ho tokenem p\u0159i vytv\u00e1\u0159en\u00ed digit\u00e1ln\u00edch podpis\u016f, co\u017e souvis\u00ed s informacemi o efem\u00e9rn\u00edm kl\u00ed\u010di ECDSA, kter\u00e9 sta\u010d\u00ed k obnov\u011b tajn\u00e9ho kl\u00ed\u010de pomoc\u00ed metod strojov\u00e9ho u\u010den\u00ed. V p\u0159\u00edpad\u011b YubiKey pro spu\u0161t\u011bn\u00ed operac\u00ed s digit\u00e1ln\u00edm podpisem je nutn\u00e9 zn\u00e1t p\u0159ihla\u0161ovac\u00ed jm\u00e9no a heslo v jednom ze slu\u017eeb, kde se token pou\u017e\u00edv\u00e1 jako dodate\u010dn\u00fd prvek autentizace. <\/p>\n

Probl\u00e9m je zp\u016fsoben pou\u017eit\u00edm v knihovn\u011b Infineon nebezpe\u010dn\u00e9ho algoritmu pro v\u00fdpo\u010det inverzn\u00edho prvku modulo, jeho\u017e v\u00fdpo\u010dty zab\u00edraj\u00ed \u010das z\u00e1visl\u00fd na hodnot\u00e1ch vstupn\u00edch dat (pro r\u016fzn\u00e9 vektory je pozorov\u00e1na r\u016fzn\u00e9 doba v\u00fdpo\u010dtu inverzn\u00edho prvku modulo). Takov\u00e1 vlastnost umo\u017e\u0148uje na z\u00e1klad\u011b anal\u00fdzy zm\u011bn sign\u00e1lu vy\u010dlenit informace o jednotliv\u00fdch bitech b\u011bhem vykon\u00e1v\u00e1n\u00ed operac\u00ed s inicializa\u010dn\u00edm vektorem. V p\u0159\u00edpad\u011b ECDSA sta\u010d\u00ed k proveden\u00ed \u00fatoku na sekven\u010dn\u00ed obnovu cel\u00e9ho soukrom\u00e9ho kl\u00ed\u010de ur\u010den\u00ed i jen n\u011bkolika bit\u016f s informacemi o inicializa\u010dn\u00edm vektoru (nonce). Pro \u00fasp\u011b\u0161nou obnovu kl\u00ed\u010de je t\u0159eba zachytit aktivitu p\u0159i generov\u00e1n\u00ed p\u0159ibli\u017en\u011b 40 digit\u00e1ln\u00edch podpis\u016f. <\/p>\n

Pro anal\u00fdzu elektromagnetick\u00e9ho vyza\u0159ov\u00e1n\u00ed p\u0159i generov\u00e1n\u00ed digit\u00e1ln\u00edch podpis\u016f je zapot\u0159eb\u00ed profesion\u00e1ln\u00ed vybaven\u00ed v hodnot\u011b p\u0159es 10 tis\u00edc dolar\u016f. Nap\u0159\u00edklad p\u0159i \u00fatoku byli v\u00fdzkumn\u00edci vybaveni m\u011b\u0159ic\u00edm komplexem Langer ICR HH 500-6 (2300 $), pou\u017e\u00edvan\u00fdm k testov\u00e1n\u00ed polovodi\u010d\u016f na elektromagnetickou kompatibilitu, zesilova\u010dem Langer BT 706, mikromanipul\u00e1torem Thorlabs PT3\/M (1000 $) s rozli\u0161en\u00edm 10 \u00b5m, digit\u00e1ln\u00edm mikroskopem Dino-Lite AM4113TL (450 $) a \u010dty\u0159kan\u00e1lov\u00fdm osciloskopem PicoScope 6424E (7500 $) s 8bitov\u00fdm rozli\u0161en\u00edm ADC.

\"\u00datok<\/center> <\/p>\n

Sc\u00e9n\u00e1\u0159 \u00fatoku na tokeny YubiKey 5 se skl\u00e1d\u00e1 z n\u00e1sleduj\u00edc\u00edch krok\u016f: <\/p>\n