{"id":41110,"date":"2020-02-05T21:30:57","date_gmt":"2020-02-05T18:30:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot"},"modified":"2020-02-05T21:30:57","modified_gmt":"2020-02-05T18:30:57","slug":"metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","title":{"rendered":"Metode de dezactivare a protec\u021biei Lockdown \u00een Ubuntu pentru ocolirea de la distan\u021b\u0103 a UEFI Secure Boot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Andrei Konovalov de la compania Google a publicat<\/a><\/noindex> metoda de dezactivare la distan\u021b\u0103 a protec\u021biei Lockdown<\/a><\/noindex>, oferit \u00een pachetul cu nucleul Linux livrat cu Ubuntu (metodele propuse teoretic ar trebui<\/a><\/noindex> s\u0103 func\u021bioneze cu nucleul Fedora \u0219i alte distribu\u021bii, dar nu au fost testate). <\/p>\n

Lockdown restric\u021bioneaz\u0103 accesul utilizatorului root la nucleu \u0219i blocheaz\u0103 c\u0103ile de ocolire UEFI Secure Boot. De exemplu, \u00een modul lockdown, accesul la \/dev\/mem, \/dev\/kmem, \/dev\/port, \/proc\/kcore, debugfs, modul de depanare kprobes, mmiotrace, tracefs, BPF, CIS PCMCIA (Structura de Informa\u021bii a Cardului), anumite interfe\u021be ACPI \u0219i registrele MSR ale CPU-ului, sunt blocate apelurile kexec_file \u0219i kexec_load, se interzice trecerea \u00een modul de suspendare, se limiteaz\u0103 utilizarea DMA pentru dispozitive PCI, se interzice importul codului ACPI din variabile EFI, manipularile cu porturile de intrare\/ie\u0219ire nu sunt permise, inclusiv modificarea num\u0103rului de \u00eentrerupere \u0219i a portului de intrare\/ie\u0219ire pentru portul serial.<\/p>\n

Mecanismul Lockdown a fost ad\u0103ugat recent la compunerea principal\u0103 a nucleului Linux 5.4<\/a><\/noindex>, dar \u00een nucleele livrate de distribu\u021bii este \u00eenc\u0103 implementat sub form\u0103 de patch-uri sau completat cu patch-uri. Una dintre diferen\u021bele \u00eentre extensiile furnizate \u00een distribu\u021bii \u0219i implementarea \u00eencorporat\u0103 \u00een nucleu este posibilitatea de a dezactiva blocarea furnizat\u0103 \u00een cazul \u00een care se are acces fizic la sistem. <\/p>\n

\u00cen Ubuntu \u0219i Fedora, combina\u021bia de taste Alt+SysRq+X este prev\u0103zut\u0103 pentru dezactivarea Lockdown. Se sub\u00een\u021belege c\u0103 combina\u021bia Alt+SysRq+X poate fi utilizat\u0103 doar cu acces fizic la dispozitiv, iar \u00een cazul unui hack de la distan\u021b\u0103 \u0219i ob\u021binerea accesului root, atacatorul nu va putea dezactiva Lockdown \u0219i, de exemplu, s\u0103 \u00eencarce \u00een nucleu un modul cu semn\u0103tur\u0103 digital\u0103 nevalidat\u0103 care con\u021bine un rootkit. <\/p>\n

Andrei Konovalov a demonstrat c\u0103 metodele legate de utilizarea tastaturii pentru confirmarea prezen\u021bei fizice a utilizatorului sunt ineficiente. Cea mai simpl\u0103 metod\u0103 de dezactivare a Lockdown ar fi simularea software<\/a><\/noindex> a apelului Alt+SysRq+X prin \/dev\/uinput, dar aceast\u0103 variant\u0103 este blocat\u0103 ini\u021bial. Totu\u0219i, au fost identificate cel pu\u021bin \u00eenc\u0103 dou\u0103 metode de substitu\u021bie pentru Alt+SysRq+X. <\/p>\n

Prima metod\u0103 este legat\u0103 de utilizarea interfe\u021bei \u201esysrq-trigger\u201d \u2014 pentru a simula, este suficient s\u0103 activa\u021bi aceast\u0103 interfa\u021b\u0103, scriind \u201e1\u201d \u00een \/proc\/sys\/kernel\/sysrq, iar apoi s\u0103 scrie\u021bi \u201ex\u201d \u00een \/proc\/sysrq-trigger. Aceast\u0103 bre\u0219\u0103 men\u021bionat\u0103 remediat\u0103<\/a><\/noindex> a fost rectificat\u0103 \u00een actualizarea din decembrie a nucleului Ubuntu \u0219i \u00een Fedora 31. De remarcat este c\u0103 dezvoltatorii, similar cu cazul \/dev\/uinput, ini\u021bial au \u00eencercat<\/a><\/noindex> bloca\u021bi aceast\u0103 metod\u0103, dar blocarea nu a func\u021bionat din cauza unei erori<\/a><\/noindex> \u00een cod.<\/p>\n

A doua metod\u0103 este legat\u0103 de emularea tastaturii prin USB\/IP<\/a><\/noindex> \u0219i trimiterea ulterioar\u0103 a secven\u021bei Alt+SysRq+X de la o tastatur\u0103 virtual\u0103. \u00cen kernelul livrat cu Ubuntu, USB\/IP este activat \u00een mod implicit (CONFIG_USBIP_VHCI_HCD=m \u0219i CONFIG_USBIP_CORE=m) \u0219i sunt furnizate modulele necesare, semnate digital, usbip_core \u0219i vhci_hcd. Atacatorul poate crea<\/a><\/noindex> un dispozitiv USB virtual, pornind<\/a><\/noindex> un handler de re\u021bea pe interfa\u021ba loopback \u0219i conect\u00e2ndu-l ca dispozitiv USB la distan\u021b\u0103 prin USB\/IP. Despre aceast\u0103 metod\u0103 s-a raportat<\/a><\/noindex> dezvoltatorilor Ubuntu, dar o corectare nu a fost \u00eenc\u0103 lansat\u0103.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043d\u043e\u0432\u0430\u043b\u043e\u0432 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u043e\u0441\u043e\u0431 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b Lockdown, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 \u0441 \u044f\u0434\u0440\u043e\u043c Linux, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 Ubuntu (\u0442\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0434\u043e\u043b\u0436\u043d\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u044f\u0434\u0440\u043e\u043c Fedora \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432, \u043d\u043e \u043e\u043d\u0438 \u043d\u0435 \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b). Lockdown \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u043a \u044f\u0434\u0440\u0443 \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u043f\u0443\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 lockdown \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41110","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Metode de dezactivare a protec\u021biei Lockdown \u00een Ubuntu pentru ocolirea UEFI Secure Boot | ProHoster","description":"Andrei Konovalov de la Google a publicat o metod\u0103 pentru dezactivarea de la distan\u021b\u0103 a protec\u021biei","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0435\u0442\u043e\u0434\u044b \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b Lockdown \u0432 Ubuntu \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0445\u043e\u0434\u0430 UEFI Secure Boot | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043d\u043e\u0432\u0430\u043b\u043e\u0432 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u043e\u0441\u043e\u0431 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b","og:url":"https:\/\/prohoster.info\/ro\/blog\/metody-otklyucheniya-zashhity-lockdown-v-ubuntu-dlya-udalyonnogo-obhoda-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-05T18:30:57+00:00","article:modified_time":"2020-02-05T18:30:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41110","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:15","updated":"2022-09-28 13:36:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/41110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=41110"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/41110\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=41110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=41110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=41110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}