{"id":32375,"date":"2019-10-31T21:46:40","date_gmt":"2019-10-31T18:46:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone\/"},"modified":"2019-10-31T21:46:40","modified_gmt":"2019-10-31T18:46:40","slug":"uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","title":{"rendered":"Vulnerabilidade em chips Qualcomm permite a extra\u00e7\u00e3o de chaves privadas do armazenamento TrustZone","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Pesquisadores da NCC Group <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nccgroup.trust\/us\/our-research\/private-key-extraction-qualcomm-keystore\/\">revelaram<\/a><\/noindex> <noindex>detalhes<\/noindex> vulnerabilidades (<noindex><a rel=\"nofollow\" href=\"https:\/\/www.qualcomm.com\/company\/product-security\/bulletins#_CVE-2018-11976\">CVE-2018-11976<\/a><\/noindex>) em chips Qualcomm, que permitem determinar o conte\u00fado de chaves de criptografia fechadas, armazenadas em um enclave isolado Qualcomm QSEE (Qualcomm Secure Execution Environment), baseado na tecnologia ARM TrustZone. O problema se manifesta em <noindex><a rel=\"nofollow\" href=\"https:\/\/www.qualcomm.com\/company\/product-security\/bulletins\">maioria<\/a><\/noindex> SoC Snapdragon, que se tornaram populares em smartphones baseados na plataforma Android. As corre\u00e7\u00f5es que resolvem o problema j\u00e1 <noindex><a rel=\"nofollow\" href=\"https:\/\/source.android.com\/security\/bulletin\/2019-04-01\">est\u00e3o inclu\u00eddas<\/a><\/noindex> na atualiza\u00e7\u00e3o de abril do Android e nas novas vers\u00f5es de firmware para chips Qualcomm. Para preparar a corre\u00e7\u00e3o, a Qualcomm levou mais de um ano \u2014 originalmente, informa\u00e7\u00f5es sobre a vulnerabilidade foram enviadas \u00e0 Qualcomm em 19 de mar\u00e7o de 2018.<\/p>\n<p>Vale lembrar que a tecnologia ARM TrustZone permite a cria\u00e7\u00e3o de ambientes protegidos isolados por hardware, que est\u00e3o completamente separados do sistema principal e s\u00e3o executados em um processador virtual separado com o uso de um sistema operacional especializado. O principal objetivo do TrustZone \u00e9 garantir a execu\u00e7\u00e3o isolada de manipuladores de chaves de criptografia, autentica\u00e7\u00e3o biom\u00e9trica, dados de pagamento e outras informa\u00e7\u00f5es confidenciais. A intera\u00e7\u00e3o com o sistema operacional principal ocorre indiretamente atrav\u00e9s de uma interface de gerenciamento. As chaves de criptografia fechadas s\u00e3o armazenadas dentro de um reposit\u00f3rio de chaves isolado por hardware, o que, quando implementado corretamente, evita seu vazamento em caso de comprometimento do sistema principal.<\/p>\n<p>A vulnerabilidade est\u00e1 relacionada a uma falha na implementa\u00e7\u00e3o do algoritmo de processamento de curvas el\u00edpticas, que levava ao vazamento de informa\u00e7\u00f5es sobre o processamento de dados. Pesquisadores desenvolveram uma t\u00e9cnica de ataque por meio de canais laterais, que permite recuperar o conte\u00fado das chaves fechadas com base em vazamentos indiretos que ocorrem em um <noindex><a rel=\"nofollow\" href=\"https:\/\/developer.android.com\/training\/articles\/keystore.html\">Android Keystore<\/a><\/noindex>. Os vazamentos s\u00e3o identificados com base na an\u00e1lise da atividade do bloco de previs\u00e3o de transi\u00e7\u00f5es e na varia\u00e7\u00e3o do tempo de acesso aos dados na mem\u00f3ria. Durante o experimento, os pesquisadores demonstraram com sucesso a recupera\u00e7\u00e3o de chaves ECDSA de 224 e 256 bits de um reposit\u00f3rio de chaves isolado por hardware, utilizado no smartphone Nexus 5X. Para recuperar a chave, foram necess\u00e1rias aproximadamente 12 mil assinaturas digitais, levando mais de 14 horas. Para realizar o ataque, foi utilizado um conjunto de ferramentas <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nccgroup\/cachegrab\">Cachegrab<\/a><\/noindex>.<\/p>\n<p>A principal raz\u00e3o para o surgimento do problema \u00e9 o compartilhamento de componentes de hardware comuns e cache para c\u00e1lculos no TrustZone e no sistema principal \u2014 a isola\u00e7\u00e3o \u00e9 feita em n\u00edvel de divis\u00e3o l\u00f3gica, mas utilizando blocos computacionais compartilhados, com a grava\u00e7\u00e3o de rastros de c\u00e1lculos e informa\u00e7\u00f5es sobre endere\u00e7os de transi\u00e7\u00f5es no cache comum do processador. Usando o m\u00e9todo Prime+Probe, baseado na avalia\u00e7\u00e3o de mudan\u00e7as no tempo de acesso a informa\u00e7\u00f5es em cache, \u00e9 poss\u00edvel rastrear fluxos de dados e sinais de execu\u00e7\u00e3o de c\u00f3digo relacionado aos c\u00e1lculos de assinaturas digitais no TrustZone com uma precis\u00e3o bastante alta ao verificar a presen\u00e7a de certos padr\u00f5es no cache.  <\/p>\n<p>A maior parte do tempo de forma\u00e7\u00e3o de uma assinatura digital usando chaves ECDSA nos chips Qualcomm \u00e9 gasta na execu\u00e7\u00e3o de opera\u00e7\u00f5es de multiplica\u00e7\u00e3o em ciclo, utilizando um vetor de inicializa\u00e7\u00e3o imut\u00e1vel para cada assinatura (<noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/Nonce\">nonce<\/a><\/noindex>). Se um atacante conseguir recuperar pelo menos alguns bits de informa\u00e7\u00e3o sobre esse vetor, haver\u00e1 a possibilidade de realizar um ataque visando \u00e0 recupera\u00e7\u00e3o sequencial de toda a chave privada. <\/p>\n<p>No caso da Qualcomm, foram identificados dois pontos de vazamento de informa\u00e7\u00f5es semelhantes no algoritmo de multiplica\u00e7\u00e3o: ao realizar opera\u00e7\u00f5es de busca em tabelas e no c\u00f3digo de extra\u00e7\u00e3o condicional de dados com base no valor do \u00faltimo bit no vetor 'nonce'. Apesar das medidas implementadas no c\u00f3digo da Qualcomm para combater o vazamento de informa\u00e7\u00f5es por canais externos, o m\u00e9todo de ataque desenvolvido permite contornar essas medidas e determinar v\u00e1rios bits do valor 'nonce', suficientes para reconstruir chaves ECDSA de 256 bits.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Fonte: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50572\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2018-11976) \u0432 \u0447\u0438\u043f\u0430\u0445 Qualcomm, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u0432 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0430\u043d\u043a\u043b\u0430\u0432\u0435 Qualcomm QSEE (Qualcomm Secure Execution Environment), \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ARM TrustZone. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 SoC Snapdragon, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0445 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0432 \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443, \u0443\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0432 \u0430\u043f\u0440\u0435\u043b\u044c\u0441\u043a\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-32375","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0447\u0438\u043f\u0430\u0445 Qualcomm, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0438\u0437 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 TrustZone | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:46:40+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:46:40+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilidade em chips Qualcomm que permite extrair chaves privadas do armazenamento do TrustZone | ProHoster","description":"Pesquisadores da NCC Group revelaram os detalhes da vulnerabilidade.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0447\u0438\u043f\u0430\u0445 Qualcomm, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0438\u0437 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 TrustZone | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:46:40+00:00","article:modified_time":"2019-10-31T18:46:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32375","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 10:33:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:59:30","updated":"2026-01-21 10:33:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/32375","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=32375"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/32375\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=32375"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=32375"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=32375"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}