{"id":32375,"date":"2019-10-31T21:46:40","date_gmt":"2019-10-31T18:46:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone\/"},"modified":"2019-10-31T21:46:40","modified_gmt":"2019-10-31T18:46:40","slug":"uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","title":{"rendered":"S\u00e5rbarhed i Qualcomm-chips, der muligg\u00f8r udtr\u00e6kning af hemmelige n\u00f8gler fra TrustZone-lageret.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Forskere fra NCC Group <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nccgroup.trust\/us\/our-research\/private-key-extraction-qualcomm-keystore\/\">har afsl\u00f8ret<\/a><\/noindex> <noindex>detaljer<\/noindex> S\u00e5rbarheder (<noindex><a rel=\"nofollow\" href=\"https:\/\/www.qualcomm.com\/company\/product-security\/bulletins#_CVE-2018-11976\">CVE-2018-11976<\/a><\/noindex>) i Qualcomm-chips, der g\u00f8r det muligt at bestemme indholdet af lukkede krypteringsn\u00f8gler placeret i Qualcomm QSEE (Qualcomm Secure Execution Environment), baseret p\u00e5 ARM TrustZone-teknologi. Problemet viser sig i <noindex><a rel=\"nofollow\" href=\"https:\/\/www.qualcomm.com\/company\/product-security\/bulletins\">de fleste<\/a><\/noindex> Snapdragon SoC'er, der er blevet udbredt i smartphones p\u00e5 Android-platformen. Rettelser, der afhj\u00e6lper problemet, er allerede <noindex><a rel=\"nofollow\" href=\"https:\/\/source.android.com\/security\/bulletin\/2019-04-01\">inkluderet<\/a><\/noindex> I aprilopdateringen af Android og i de nye firmwareudgivelser til Qualcomm-chips. Qualcomm brugte over et \u00e5r p\u00e5 at forberede rettelsen \u2014 i f\u00f8rste omgang blev oplysninger om s\u00e5rbarheden sendt til Qualcomm allerede den 19. marts 2018.<\/p>\n<p>Det skal bem\u00e6rkes, at ARM TrustZone-teknologi giver mulighed for at skabe hardware-isolerede beskyttede milj\u00f8er, der er helt adskilt fra det prim\u00e6re system og k\u00f8rer p\u00e5 en separat virtuel processor ved brug af et separat specialiseret operativsystem. Hovedform\u00e5let med TrustZone er at sikre isoleret udf\u00f8relse af behandlere for krypteringsn\u00f8gler, biometrisk autentificering, betalingsdata og anden fortrolig information. Interaktionen med hoved-OS foreg\u00e5r indirekte via et dispatch-interface. Lukkede krypteringsn\u00f8gler opbevares inden for et hardware-isoleret n\u00f8glelager, hvilket med korrekt implementering kan forhindre l\u00e6kage i tilf\u00e6lde af kompromittering af det prim\u00e6re system.<\/p>\n<p>S\u00e5rbarheden er relateret til en mangel i implementeringen af algoritmen til behandling af elliptiske kurver, som f\u00f8rte til l\u00e6kage af oplysninger om behandlingen af data. Forskere udviklede en teknik til angreb via siderkanaler, der g\u00f8r det muligt at genoprette indholdet af lukkede n\u00f8gler placeret i hardware-isoleret <noindex><a rel=\"nofollow\" href=\"https:\/\/developer.android.com\/training\/articles\/keystore.html\">Android Keystore<\/a><\/noindex>. L\u00e6kagerne bestemmes ud fra analysen af aktiviteten i overgangen til forudsigelse og \u00e6ndringer i adgangstiden til data i hukommelsen. I l\u00f8bet af eksperimentet demonstrerede forskerne med succes gendannelsen af 224- og 256-bit ECDSA n\u00f8gler fra det hardware-isolerede n\u00f8glelager, der bruges i Nexus 5X smartphone. For at genoprette n\u00f8glen kr\u00e6vedes det at generere omkring 12.000 digitale signaturer, som tog mere end 14 timer. Til angrebet blev der anvendt v\u00e6rkt\u00f8jer fra <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nccgroup\/cachegrab\">Cachegrab<\/a><\/noindex>.<\/p>\n<p>Den prim\u00e6re \u00e5rsag til problemet er den f\u00e6lles brug af hardwarekomponenter og cache til beregninger i TrustZone og i det prim\u00e6re system \u2014 isolationen er udf\u00f8rt p\u00e5 niveau med logisk opdeling, men bruger f\u00e6lles beregningsenheder og efterlader spor af beregninger og information om adresseovergange i den almindelige procesork\u00e6de. Ved hj\u00e6lp af Prime+Probe-metoden, baseret p\u00e5 vurdering af \u00e6ndringer i adgangstid til den cacherede information, kan man ved at kontrollere tilstedev\u00e6relsen af specifikke m\u00f8nstre i cachen med en ret h\u00f8j n\u00f8jagtighed spore datastreams og tegn p\u00e5 udf\u00f8relse af kode relateret til beregninger af digitale signaturer i TrustZone.  <\/p>\n<p>Det tager st\u00f8rstedelen af tiden til at generere en digital signatur ved brug af ECDSA-n\u00f8gler i Qualcomm-chips p\u00e5 at udf\u00f8re multiplikationsoperationer i en l\u00f8kke ved hj\u00e6lp af en u\u00e6ndret initialiseringsvektor for hver signatur (<noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/Nonce\">nonce<\/a><\/noindex>). Hvis en angriber kan genskabe blot nogle f\u00e5 bits med information om den p\u00e5g\u00e6ldende vektor, \u00e5bner det op for muligheden for et angreb ved sekventiel genskabelse af hele den private n\u00f8gle. <\/p>\n<p>I tilf\u00e6lde af Qualcomm er der identificeret to steder for l\u00e6kage af s\u00e5danne oplysninger i multiplikationsalgoritmen: ved udf\u00f8relse af tabelopslag og i koden til betinget dataudtr\u00e6k baseret p\u00e5 v\u00e6rdien af den sidste bit i vektoren \u201enonce\u201c. P\u00e5 trods af eksistensen af beskyttelsesforanstaltninger mod l\u00e6kage af oplysninger via sidekanaler i Qualcomm-koden, g\u00f8r den udviklede angrebsmetode det muligt at omg\u00e5 disse foranstaltninger og bestemme et par bits af v\u00e6rdien \u201enonce\u201c, som er tilstr\u00e6kkelige til at genoprette 256-bit ECDSA-n\u00f8gler.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Kilde: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50572\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2018-11976) \u0432 \u0447\u0438\u043f\u0430\u0445 Qualcomm, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u0432 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0430\u043d\u043a\u043b\u0430\u0432\u0435 Qualcomm QSEE (Qualcomm Secure Execution Environment), \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ARM TrustZone. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 SoC Snapdragon, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0445 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0432 \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443, \u0443\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0432 \u0430\u043f\u0440\u0435\u043b\u044c\u0441\u043a\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-32375","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0447\u0438\u043f\u0430\u0445 Qualcomm, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0438\u0437 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 TrustZone | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:46:40+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:46:40+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed i Qualcomm-chips, der muligg\u00f8r udtr\u00e6kning af hemmelige n\u00f8gler fra TrustZone-lageret | ProHoster","description":"Forskere fra NCC Group har afsl\u00f8ret detaljer om s\u00e5rbarheden.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0447\u0438\u043f\u0430\u0445 Qualcomm, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0438\u0437 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 TrustZone | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:46:40+00:00","article:modified_time":"2019-10-31T18:46:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32375","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 10:33:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:59:30","updated":"2026-01-21 10:33:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/32375","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=32375"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/32375\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=32375"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=32375"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=32375"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}