{"id":118325,"date":"2024-07-26T15:43:00","date_gmt":"2024-07-26T13:43:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-806-modelyah-materinskih-plat-vyyavlen-testovyj-klyuch-pozvolyayushhij-obojti-uefi-secure-boot"},"modified":"2024-07-26T15:43:00","modified_gmt":"2024-07-26T13:43:00","slug":"v-806-modelyah-materinskih-plat-vyyavlen-testovyj-klyuch-pozvolyayushhij-obojti-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/v-806-modelyah-materinskih-plat-vyyavlen-testovyj-klyuch-pozvolyayushhij-obojti-uefi-secure-boot","title":{"rendered":"806 emaplaatide mudelil avastati testv\u00f5ti, mis v\u00f5imaldab m\u00f6\u00f6da minna UEFI Secure Bootist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Turvauuringud tegi Binarly ettev\u00f5tte, kelle k\u00e4es on teave UEFI Secure Booti kinnitatud laadimise re\u017eiimi \u00fcletamise v\u00f5imalusest enam kui 800 tootes, mille on v\u00e4lja andnud Acer, Dell, Fujitsu, Gigabyte, HP, Intel, Lenovo ja Supermicro. Probleem on saanud koodnimeks PKfail ja on seotud usaldusv\u00e4\u00e4rse platvormi v\u00f5tme (PK, Platform Key) kasutamisega, mille on genereerinud AMI (American Megatrends International) ja see on antud testimisse. Vanimad p\u00fcsivara versioonid, mis kasutasid testv\u00f5tit, on v\u00e4lja antud 2012. aastal, ja uusimad kuup\u00e4evad on juunis 2024. Uuringute andmetel on probleemiga kokku puutunud rohkem kui 10% k\u00f5igist kontrollitud p\u00fcsivara versioonidest. <\/p>\n

V\u00f5tme parameetrites oli m\u00e4rgitud, et see on usaldusv\u00e4\u00e4rne ja et seda ei tohiks oma toodetes kasutada. Eeldati, et see testv\u00f5ti tuleb asendada tootja enda v\u00f5tmega, kuid tootjad ei p\u00f6\u00f6ranud hoiatusele t\u00e4helepanu ning kasutasid l\u00f5ppversioonides standardset \u00fcldv\u00f5tit, mis saadeti k\u00f5igile AMI partneritele ja klientidele. <\/p>\n

AMI testv\u00f5tme privaatne osa, mis on vajalik digitaalsete allkirjade tegemiseks, on avalikult kergesti k\u00e4tte saadav p\u00e4rast teabe lekkimist \u00fche riistvaratootja juures, kelle t\u00f6\u00f6taja kogemata postitas avalikku GitHubi registrisse koodi, mis sisaldas seda v\u00f5tme. Privaatne v\u00f5ti oli paigutatud kr\u00fcpteeritud faili, mille kr\u00fcpteerimisel kasutati lihtsat 4-t\u00e4helise parooli, mille leidmine osutus kergesti \u00e4ra arvamiseks. <\/p>\n

Platvormi v\u00f5ti kasutatakse usaldusjuure aluseks, et kinnitada andmebaase Secure Boot v\u00f5tmete jaoks. Platvormi private osa saamine toob kaasa kogu usaldusketi kompromiteerimise, mis on vajalik laetud s\u00fcsteemi komponentide kehtivuse kontrollimiseks \u2014 teadmisega platvormi v\u00f5tme kohta saab Secure Boot kaitse \u00fcletada ja laadida oma komponente, manipuleerides KEK (Key Exchange Key) ja andmebaasidega \u201edb\u201c (Allkiri andmebaas) ja \u201edbx\u201c (Keelatud allkiri andmebaas). KEK vastutab usaldusketi loomise eest vahelise p\u00fcsivara ja operatsioonis\u00fcsteemi vahel, \u201edb\u201c sisaldab allkirju ja sertifikaate laadimisprogrammile ning kolmandate osapoolte UEFI komponentidele, samas kui \u201edbx\u201c h\u00f5lmab teadaolevate pahatahtlike komponentide tagasiv\u00f5etud allkirju. <\/p>\n

R\u00fcnnaku teostamiseks piisab, kui genereerida uued v\u00f5tmed ja sertifikaadid KEK ja db jaoks, seej\u00e4rel kasutada avalikuks tulnud platvormi testv\u00f5ti, et laadida loodud KEK-sertifikaat UEFI p\u00fcsivara. Laadides p\u00fcsivara KEK-sertifikaadi, saab seotud privaatv\u00f5tit kasutada, et laadida uudissertifikaat andmebaasi db. P\u00e4rast sertifikaadi db laadimist saab seotud privaatv\u00f5tit kasutada laaditavate EFI komponentide kinnitamiseks. openssl req -newkey rsa:4096 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj '\/CN=BRLY KEK\/' -out KEK.crt openssl req -newkey rsa:4096 -nodes -keyout db.key -new -x509 -sha256 -days 3650 -subj '\/CN=BRLY db\/' -out db.crt efi-updatevar -a -c KEK.crt -k PK.key KEK efi-updatevar -a -c db.crt -k KEK.key db sbsign --key db.key --cert db.crt --output rogue.efi.signed rogue.efi <\/p>\n

Platvormi v\u00f5tme \u00f5igsuse kontrollimiseks piisab utiliidi \u201eefi-readvar -v PK\u201d k\u00e4ivitamisest efitools pakist ja veenduda, et platvormi v\u00f5ti ei ole testv\u00f5ti: efi-readvar -v PK Muutuja PK, pikkus 862 PK: Nimekiri 0, t\u00fc\u00fcp X509 Allkiri 0, suurus 834, omanik 26dc4851-195f-4ae1-9a19-fbf883bbb35e Aadress: CN=DO NOT TRUST \u2014 AMI Test PK Emitent: CN=DO NOT TRUST \u2014 AMI Test PK

\r\n \"M\u00e4ngi\r\n
<\/div>\r\n <\/div><\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Binarly \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0440\u0435\u0436\u0438\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 800 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c\u0438 Acer, Dell, Fujitsu, Gigabyte, HP, Intel, Lenovo \u0438 Supermicro. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f PKfail \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u043d\u0435 \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u043a\u043b\u044e\u0447\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b (PK, Platform Key), \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 AMI (American Megatrends International) […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-118325","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47806 emaplaadi mudelis leiti testv\u00f5ti, mis v\u00f5imaldab m\u00f6\u00f6da minna UEFI Secure Bootist | ProHoster","description":"Binarly k\u00fcberturbe uurijad on leidnud v\u00f5imaluse UEFI Secure Booti kontrollitud k\u00e4ivitamise re\u017eiimist m\u00f6\u00f6da hiilida enam kui 800 toote puhul, mille on tootnud ettev\u00f5tted Acer, Dell, Fujitsu, Gigabyte, HP ja Intel.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/v-806-modelyah-materinskih-plat-vyyavlen-testovyj-klyuch-pozvolyayushhij-obojti-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 806 \u043c\u043e\u0434\u0435\u043b\u044f\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442 \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0442\u0435\u0441\u0442\u043e\u0432\u044b\u0439 \u043a\u043b\u044e\u0447, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 UEFI Secure Boot | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Binarly \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0440\u0435\u0436\u0438\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 800 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c\u0438 Acer, Dell, Fujitsu, Gigabyte, HP, Intel.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/v-806-modelyah-materinskih-plat-vyyavlen-testovyj-klyuch-pozvolyayushhij-obojti-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-26T13:43:00+00:00","article:modified_time":"2024-07-26T13:43:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"118325","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 04:53:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 04:53:19","updated":"2026-01-23 04:53:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/118325","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=118325"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/118325\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=118325"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=118325"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=118325"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}