{"id":32375,"date":"2019-10-31T21:46:40","date_gmt":"2019-10-31T18:46:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone\/"},"modified":"2019-10-31T21:46:40","modified_gmt":"2019-10-31T18:46:40","slug":"uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","title":{"rendered":"Turvaauk Qualcommi \u0161ippides, mis v\u00f5imaldab v\u00e4lja tuua suletud v\u00f5tmeid TrustZone'i salvest.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Uurijad NCC Group'ist avaldasid<\/a><\/noindex> detailid<\/noindex> haavatavused (CVE-2018-11976<\/a><\/noindex>) Qualcommi kiipides, mis v\u00f5imaldab m\u00e4\u00e4rata kr\u00fcpteerimisv\u00f5tmete sisu, mis on paigutatud isoleeritud n\u00e4dalasse Qualcomm QSEE (Qualcomm Secure Execution Environment), mis p\u00f5hineb ARM TrustZone tehnoloogial. Probleem avaldub enamikul<\/a><\/noindex> Snapdragon SoC'ides, mis on levinud Androidi platvormil p\u00f5hinevates nutitelefonides. Probleemi lahendused on juba lisakujunduse truuduse fondid OpenType formaadis, mida saab kasutada programmis gnome-terminal (p\u00e4rast HarfBuzz'i kasutusele v\u00f5tmist on t\u00f5usnud probleeme vanade truuduse fontide kasutamisel gnome-terminalis).<\/a><\/noindex> aprillisel Androidi v\u00e4rskendusel ja uutest Qualcommi kiipide p\u00fcsivara v\u00e4ljaannetes. Qualcommi paranduse ettevalmistamiseks kulus rohkem kui aasta \u2014 esialgsed teated haavatavusest saadeti Qualcommile juba 19. m\u00e4rtsil 2018.<\/p>\n

Tuletame meelde, et ARM TrustZone tehnoloogia v\u00f5imaldab luua riistvara isoleeritud kaitstud keskkondi, mis on t\u00e4ielikult eraldatud peamisest s\u00fcsteemist ja t\u00f6\u00f6tavad eraldi virtuaalses protsessoris, kasutades eraldi spetsialiseeritud ops\u00fcsteemi. TrustZone'i peamine eesm\u00e4rk on tagada kr\u00fcpteerimisv\u00f5tmete, biomeetrilise autentimise, makseteabe ja muu konfidentsiaalse teabe isoleeritud t\u00f6\u00f6tlemine. Suhtlemine peamise ops\u00fcsteemiga toimub kaudselt halduri liidese kaudu. Kr\u00fcpteerimisv\u00f5tmed paigutatakse riistvara isoleeritud v\u00f5tmetehoidlasse, mis n\u00f5uetekohase teostuse korral v\u00f5imaldab v\u00e4ltida nende lekimist, kui peamine s\u00fcsteem on kompromiteeritud.<\/p>\n

Haavatavus on seotud eba\u00fchtlaste elliptiliste k\u00f5verate t\u00f6\u00f6tlemise algoritmi rakendusega, mis viib andmete t\u00f6\u00f6tlemise k\u00e4igus teabe leketeni. Uurijad arendasid v\u00e4lja k\u00fclgkanali r\u00fcnnaku tehnikat, mis v\u00f5imaldab olemasolevate kaudsete leakide p\u00f5hjal taastada riistvara isoleeritud Android Keystore<\/a><\/noindex>. Lekkeid m\u00e4\u00e4ratakse kindlaks, anal\u00fc\u00fcsides \u00fcleminekuennustusploki tegevust ja m\u00e4lus andmete juurdep\u00e4\u00e4suaja muutumist. Katsete k\u00e4igus demonstreerisid uurijad edukalt 224- ja 256-bitiste ECDSA v\u00f5tmete taastamist riistvara isoleeritud v\u00f5tmetehoidlast, mida kasutati Nexus 5X nutitelefonis. V\u00f5tme taastamiseks oli vajalik genereerida umbes 12 000 digitaalset allkirja, milleks kulus \u00fcle 14 tunni. R\u00fcnnaku teostamiseks kasutati t\u00f6\u00f6riistu Cachegrab<\/a><\/noindex>.<\/p>\n

Probleemi peamine p\u00f5hjus on usaldusv\u00e4\u00e4rsete komponentide ja vahem\u00e4lu \u00fchise kasutamisega seotud arvutused TrustZone'is ja p\u00f5hiss\u00fcsteemis \u2014 isolatsioon on rakendatud loogilise jagunemise tasemel, kuid kasutatakse jagatud arvutusplokke ning j\u00e4ljed arvutustest ja \u00fcleminekuaadresside teabest j\u00e4\u00e4vad \u00fcldisesse protsessori vahem\u00e4llu. Prime+Probe meetodi abil, mis p\u00f5hineb vahem\u00e4lus hoitud teabe juurde p\u00e4\u00e4semise aja muutuste hindamisel, on v\u00f5imalik teatud mustrite kontrollimise kaudu \u00fcsna t\u00e4pselt j\u00e4lgida andmevooge ja koodide t\u00e4itmise m\u00e4rke, mis on seotud digitaalsete allkirjade arvutustega TrustZone'is. <\/p>\n

Suur osa digitaalallkirja genereerimise ajast ECDSA v\u00f5tmete abil Qualcommi kiipides kulub ringk\u00e4ikude p\u00f5hjal mitme korralise korrutamise teostamiseks, kasutades igas allkirjas muutumatut initsialiseerimisvektorit (nonce<\/a><\/noindex>). Kui r\u00fcndaja suudab taastada v\u00e4hemalt paar bitti teavet selle vektori kohta, tekib v\u00f5imalus r\u00fcnnakuks, mille k\u00e4igus taastatakse kogu salajane v\u00f5ti j\u00e4rjestikku. <\/p>\n

Qualcommi puhul on tuvastatud kaks sarnaste andmete leket tekkepunktis multiplikatsioonialgoritmis: tabelite otsinguoperatsioonide ja tingimuslikult andmete v\u00e4ljav\u00f5tmise koodi seas, mis p\u00f5hineb viimase bitiga vektoris \"nonce\". Mallet on Qualcommi koodis olemas meetmed, mis takistavad teabe lekkeid k\u00fclgkanalite kaudu, kuid koostatud r\u00fcnnaku meetod v\u00f5imaldab neid meetmeid \u00fcletada ja m\u00e4\u00e4rata mitmeid bitid \"nonce\" v\u00e4\u00e4rtusest, mis on piisavad 256-bitiste ECDSA v\u00f5tmete taastamiseks.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2018-11976) \u0432 \u0447\u0438\u043f\u0430\u0445 Qualcomm, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u0432 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0430\u043d\u043a\u043b\u0430\u0432\u0435 Qualcomm QSEE (Qualcomm Secure Execution Environment), \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ARM TrustZone. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 SoC Snapdragon, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0445 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0432 \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443, \u0443\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0432 \u0430\u043f\u0440\u0435\u043b\u044c\u0441\u043a\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-32375","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus Qualcommi kiipides, mis v\u00f5imaldab TrustZone jaost taandamist rajatavalt v\u00f5ti | ProHoster","description":"NCC Groupi teadlased avaldasid haavatavuse \u00fcksikasjad.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0447\u0438\u043f\u0430\u0445 Qualcomm, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0438\u0437 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 TrustZone | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:46:40+00:00","article:modified_time":"2019-10-31T18:46:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32375","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 10:33:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:59:30","updated":"2026-01-21 10:33:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/32375","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=32375"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/32375\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=32375"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=32375"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=32375"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}