{"id":118325,"date":"2024-07-26T15:43:00","date_gmt":"2024-07-26T13:43:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-806-modelyah-materinskih-plat-vyyavlen-testovyj-klyuch-pozvolyayushhij-obojti-uefi-secure-boot"},"modified":"2024-07-26T15:43:00","modified_gmt":"2024-07-26T13:43:00","slug":"v-806-modelyah-materinskih-plat-vyyavlen-testovyj-klyuch-pozvolyayushhij-obojti-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-806-modelyah-materinskih-plat-vyyavlen-testovyj-klyuch-pozvolyayushhij-obojti-uefi-secure-boot","title":{"rendered":"806 emaplaadil on avastatud testv\u00f5ti, mis v\u00f5imaldab m\u00f6\u00f6da minna UEFI Secure Bootist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Turva-uuringute firma Binarly tuvastas UEFI Secure Booti kontrollre\u017eiimi \u00fcletamise v\u00f5imaluse enam kui 800 toote puhul, mille on v\u00e4lja andnud ettev\u00f5tted Acer, Dell, Fujitsu, Gigabyte, HP, Intel, Lenovo ja Supermicro. Probleem sai koodnimeks PKfail ning see on seotud selle platvormi usaldusv\u00e4\u00e4rse v\u00f5tme (PK, Platform Key) kasutamisega, mille genereeris AMI (American Megatrends International) ja mis tarniti testimise m\u00e4rgina. K\u00f5ige vanemad tehaseversioonid, kus kasutati testv\u00f5tit, on v\u00e4lja antud 2012. aastal, uusimad on dateeritud juunisse 2024. Uurijate andmetel on probleemiga kokku puutunud rohkem kui 10% k\u00f5igist kontrollitud tehaseversioonidest. <\/p>\n

V\u00f5tme parameetrites m\u00e4rkis, et see ei ole usaldusv\u00e4\u00e4rne ning seda ei tohiks oma toodetes kasutada. Eeldati, et see testv\u00f5ti asendatakse tootja enda v\u00f5tmega, kuid tootjad ignoreerisid hoiatust ja kasutasid l\u00f5ppetappide tehaseversioonides t\u00fc\u00fcpilist \u00fcldv\u00f5tit, mis saadeti k\u00f5igile AMI partneritele ja klientidele. <\/p>\n

AMI privaatne testv\u00f5ti, mis on vajalik digiallkirjade loomiseks, tuli avalikkuse ette p\u00e4rast informatsiooni lekkimist \u00fche varustustootja juures, kelle t\u00f6\u00f6taja kogemata postitas GitHubi avalikku repositorysse koodi, mis sisaldas seda v\u00f5tit. Privaatv\u00f5ti oli paigutatud kr\u00fcpteeritud faili, mille kr\u00fcpteerimiseks kasutati lihtsat 4-t\u00e4heliselt parooli, mille suudeti kergesti \u00e4ra arvata bruteforce meetodil. <\/p>\n

Platvormi v\u00f5ti toimib usaldusketi juurena andmebaaside t\u00f5endamiseks Secure Boot jaoks. Platvormi v\u00f5tme salajase osa hankimine ohustab kogu usaldusketti, mis on seotud k\u00e4ivitatavate s\u00fcsteemi komponentide kehtivuse kontrollimisega \u2014 teades platvormi v\u00f5tit on v\u00f5imalik k\u00f5rvale hiilida Secure Boot kaitset ning laadida enda komponente l\u00e4bi KEK (Key Exchange Key) ja kahel andmebaasil 'db' (Signature Database) ja 'dbx' (Forbidden Signature Database) man\u00f6\u00f6verdades. KEK loob usaldusketi vahel tarkvara ja operatsioonis\u00fcsteemi, 'db' sisaldab k\u00e4ivitusprogrammide ja kolmandate osapoolte UEFI komponentide sertifikaate ja allkirju, 'dbx' aga sisaldab teadaolevaid pahatahtlike komponentide tagasi v\u00f5etud allkirju. <\/p>\n

R\u00fcnnaku l\u00e4biviimiseks piisab, kui genereerida uued v\u00f5tmed ja sertifikaadid KEK ja db jaoks, seej\u00e4rel kasutades avalikkusele k\u00e4tte j\u00f5udnud testplatvormi v\u00f5tit, et laadida UEFI-firmasse loodud KEK-sertifikaat. Laadides KEK-sertifikaadi firmasse, saab seotud salajast v\u00f5tit kasutada uue sertifikaadi laadimiseks andmebaasi db. P\u00e4rast sertifikaadi db laadimist saab seotud salajast v\u00f5tit kasutada laaditavate EFI-komponentide t\u00f5endamiseks. openssl req -newkey rsa:4096 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj '\/CN=BRLY KEK\/' -out KEK.crt openssl req -newkey rsa:4096 -nodes -keyout db.key -new -x509 -sha256 -days 3650 -subj '\/CN=BRLY db\/' -out db.crt efi-updatevar -a -c KEK.crt -k PK.key KEK efi-updatevar -a -c db.crt -k KEK.key db sbsign \u2014key db.key \u2014cert db.crt \u2014output rogue.efi.signed rogue.efi <\/p>\n

Platvormi v\u00f5tme \u00f5igsuse kontrollimiseks piisab, kui k\u00e4ivitada utiliit 'efi-readvar -v PK' pakist efitools ja veenduda, et platvormi v\u00f5ti ei ole testv\u00f5ti: efi-readvar -v PK Muutuja PK, pikkus 862 PK: Loend 0, t\u00fc\u00fcp X509 Allkiri 0, suurus 834, omanik 26dc4851-195f-4ae1-9a19-fbf883bbb35e Subjekt: CN=DO NOT TRUST \u2014 AMI Test PK V\u00e4ljaandja: CN=DO NOT TRUST \u2014 AMI Test PK

\r\n \"Vaata\r\n
<\/div>\r\n <\/div><\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Binarly \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0440\u0435\u0436\u0438\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 800 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c\u0438 Acer, Dell, Fujitsu, Gigabyte, HP, Intel, Lenovo \u0438 Supermicro. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f PKfail \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u043d\u0435 \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u043a\u043b\u044e\u0447\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b (PK, Platform Key), \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 AMI (American Megatrends International) […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-118325","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47806 emaplaadi mudelis leitud testv\u00f5ti, mis v\u00f5imaldab UEFI Secure Booti \u00fcletamist | ProHoster","description":"Turva-uuringute spetsialistid ettev\u00f5ttest Binarly avastasid, et UEFI Secure Boot autentimise re\u017eiimi on v\u00f5imalik \u00fcmber minna rohkem kui 800 tootel, mis on v\u00e4lja antud ettev\u00f5tete Acer, Dell, Fujitsu, Gigabyte, HP, Intel, Lenovo ja Supermicro poolt. Probleem sai koodnimeks PKfail ning see on seotud usaldusv\u00e4\u00e4rse platvormi v\u00f5tme (PK, Platform Key) kasutamisega, mille on genereerinud ettev\u00f5te AMI (American Megatrends International).","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-806-modelyah-materinskih-plat-vyyavlen-testovyj-klyuch-pozvolyayushhij-obojti-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 806 \u043c\u043e\u0434\u0435\u043b\u044f\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442 \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0442\u0435\u0441\u0442\u043e\u0432\u044b\u0439 \u043a\u043b\u044e\u0447, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 UEFI Secure Boot | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Binarly \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0440\u0435\u0436\u0438\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 800 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c\u0438 Acer, Dell, Fujitsu, Gigabyte, HP, Intel, Lenovo \u0438 Supermicro. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f PKfail \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u043d\u0435 \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u043a\u043b\u044e\u0447\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b (PK, Platform Key), \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 AMI (American Megatrends International)","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-806-modelyah-materinskih-plat-vyyavlen-testovyj-klyuch-pozvolyayushhij-obojti-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-26T13:43:00+00:00","article:modified_time":"2024-07-26T13:43:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"118325","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 04:53:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 04:53:19","updated":"2026-01-23 04:53:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/118325","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=118325"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/118325\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=118325"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=118325"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=118325"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}