{"id":32375,"date":"2019-10-31T21:46:40","date_gmt":"2019-10-31T18:46:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone\/"},"modified":"2019-10-31T21:46:40","modified_gmt":"2019-10-31T18:46:40","slug":"uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","title":{"rendered":"O vulnerabilitate \u00een cipurile Qualcomm, care permite extragerea cheilor private din magazinul TrustZone","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la compania NCC Group au dezv\u0103luit<\/a><\/noindex> detalii<\/noindex> vulnerabilit\u0103\u021bilor (CVE-2018-11976<\/a><\/noindex>) \u00een cipurile Qualcomm, care permit determinarea con\u021binutului cheilor secrete de criptare, plasate \u00eentr-un enclave izolat Qualcomm QSEE (Qualcomm Secure Execution Environment), bazat pe tehnologia ARM TrustZone. Problema se manifest\u0103 \u00een majoritatea<\/a><\/noindex> SoC Snapdragon, care au fost r\u0103sp\u00e2ndite \u00een smartphone-uri bazate pe platforma Android. Corec\u021biile care elimin\u0103 problema sunt deja sunt incluse<\/a><\/noindex> \u00een actualizarea din aprilie a Android \u0219i \u00een noile versiuni ale firmware-ului pentru cipurile Qualcomm. Preg\u0103tirea solu\u021biei de c\u0103tre Qualcomm a durat mai bine de un an \u2014 informa\u021biile despre vulnerabilitate au fost trimise c\u0103tre Qualcomm \u00eenc\u0103 din 19 martie 2018.<\/p>\n

S\u0103 ne amintim c\u0103 tehnologia ARM TrustZone permite crearea de medii protejate izolate hardware, complet separate de sistemul principal \u0219i care ruleaz\u0103 pe un procesor virtual separat utiliz\u00e2nd un sistem de operare specializat. Principalul scop al TrustZone este de a asigura executarea izolat\u0103 a procesatorilor de chei de criptare, autentific\u0103rii biometrice, datelor de plat\u0103 \u0219i altor informa\u021bii confiden\u021biale. Interac\u021biunea cu sistemul de operare principal se realizeaz\u0103 indirect printr-o interfa\u021b\u0103 de gestionare. Cheile secrete de criptare sunt plasate \u00eentr-un depozit de chei izolat hardware, ceea ce, \u00een cazul unei implement\u0103ri corespunz\u0103toare, permite prevenirea scurgerii acestora \u00een caz de compromitere a sistemului principal.<\/p>\n

Vulnerabilitatea este legat\u0103 de o deficien\u021b\u0103 \u00een implementarea algoritmului de procesare a curbelor eliptice, care a dus la scurgeri de informa\u021bii despre procesarea datelor. Cercet\u0103torii au dezvoltat o tehnic\u0103 de atac prin canale laterale, care permite, prin scurgerile indirecte existente, recuperarea con\u021binutului cheilor secrete plasate \u00een izolatul hardware Android Keystore<\/a><\/noindex>. Fugas sunt determinate pe baza analizei activit\u0103\u021bii blocului de predic\u021bie a tranzi\u021biilor \u0219i a modific\u0103rii timpului de acces la datele din memorie. \u00cen timpul experimentului, cercet\u0103torii au demonstrat cu succes recuperarea cheilor ECDSA de 224 \u0219i 256 de bi\u021bi dintr-un depozit de chei izolat hardware, utilizat \u00een smartphone-ul Nexus 5X. Pentru a recupera cheia a fost necesar\u0103 generarea a aproximativ 12 mii de semn\u0103turi digitale, ceea ce a durat mai mult de 14 ore. Pentru a efectua atacul a fost utilizat un instrumentar Cachegrab<\/a><\/noindex>.<\/p>\n

Principala cauz\u0103 a problemei este utilizarea comun\u0103 a componentelor hardware comune \u0219i a cache-ului pentru calcule \u00een TrustZone \u0219i \u00een sistemul de baz\u0103 \u2014 izola\u021bia este realizat\u0103 la nivel de separare logic\u0103, dar folosind unit\u0103\u021bi de calcul comune \u0219i cu urme de calcule \u0219i informa\u021bii despre adresele de tranzi\u021bie \u00een cache-ul procesorului comun. Prin metoda Prime+Probe, care se bazeaz\u0103 pe evaluarea modific\u0103rii timpului de acces la informa\u021biile \u00een cache, se pot urm\u0103ri cu o acurate\u021be destul de ridicat\u0103 fluxurile de date \u0219i semnele de execu\u021bie a codului legat de calculele semn\u0103turilor digitale \u00een TrustZone, verific\u00e2nd existen\u021ba unor tipare specifice \u00een cache. <\/p>\n

Majoritatea timpului necesar pentru generarea unei semn\u0103turi digitale utiliz\u00e2nd chei ECDSA \u00een cipurile Qualcomm este cheltuit pe executarea opera\u021biunilor de multiplicare \u00eentr-un ciclu, folosind un vector de ini\u021bializare constant pentru fiecare semn\u0103tur\u0103 (nonce<\/a><\/noindex>). Dac\u0103 un atacator reu\u0219e\u0219te s\u0103 recupereze m\u0103car c\u00e2\u021biva bi\u021bi de informa\u021bii despre acest vector, exist\u0103 posibilitatea de a realiza un atac prin recuperarea secven\u021bial\u0103 a \u00eentregului cheie privat\u0103. <\/p>\n

\u00cen cazul Qualcomm, au fost identificate dou\u0103 locuri de scurgere a unor astfel de informa\u021bii \u00een algoritmul de \u00eenmul\u021bire: \u00een timpul opera\u021biunilor de c\u0103utare \u00een tabele \u0219i \u00een codul de extragere condi\u021bionat\u0103 a datelor bazat pe valoarea ultimului bit din vectorul \u201enonce\u201d. \u00cen ciuda existen\u021bei \u00een codul Qualcomm a unor m\u0103suri de prevenire a scurgerilor de informa\u021bii pe canale externe, metoda de atac dezvoltat\u0103 permite ocolirea acestor m\u0103suri \u0219i determinarea mai multor bi\u021bi din valoarea \u201enonce\u201d, suficien\u021bi pentru a reconstitui cheile ECDSA de 256 de bi\u021bi.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2018-11976) \u0432 \u0447\u0438\u043f\u0430\u0445 Qualcomm, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u0432 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0430\u043d\u043a\u043b\u0430\u0432\u0435 Qualcomm QSEE (Qualcomm Secure Execution Environment), \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ARM TrustZone. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 SoC Snapdragon, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0445 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0432 \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443, \u0443\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0432 \u0430\u043f\u0440\u0435\u043b\u044c\u0441\u043a\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-32375","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een cipurile Qualcomm, care permite extragerea cheilor private din stocarea TrustZone | ProHoster","description":"Cercet\u0103torii de la NCC Group au dezv\u0103luit detaliile vulnerabilit\u0103\u021bii.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0447\u0438\u043f\u0430\u0445 Qualcomm, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0438\u0437 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 TrustZone | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:46:40+00:00","article:modified_time":"2019-10-31T18:46:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32375","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 10:33:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:59:30","updated":"2026-01-21 10:33:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/32375","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=32375"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/32375\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=32375"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=32375"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=32375"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}