{"id":52697,"date":"2019-11-14T00:00:00","date_gmt":"2019-11-13T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-tpm-fail-pozvolyayushhaya-vosstanovit-klyuchi-hranimye-v-tpm-modulyah"},"modified":"2020-02-18T14:00:29","modified_gmt":"2020-02-18T11:00:29","slug":"uyazvimost-tpm-fail-pozvolyayushhaya-vosstanovit-klyuchi-hranimye-v-tpm-modulyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-tpm-fail-pozvolyayushhaya-vosstanovit-klyuchi-hranimye-v-tpm-modulyah","title":{"rendered":"Vulnerabilitatea TPM-Fail, care permite recuperarea cheilor stocate \u00een modulele TPM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un grup de cercet\u0103tori de la Institutul Politehnic Worcester, Universitatea L\u00fcbeck \u0219i Universitatea din California, San Diego a dezvoltat<\/a><\/noindex> metoda de atac prin canale externe, care permite recuperarea valorilor cheilor private stocate \u00een TPM (Module de Platform\u0103 de \u00cencredere). Atacul a primit numele de cod TPM-Fail<\/a><\/noindex> \u0219i vizeaz\u0103 fTPM (implementare software<\/a><\/noindex> pe baza firmware-ului, care ruleaz\u0103 pe un microprocesor separat \u00een cadrul CPU) de la Intel (CVE-2019-11090) \u0219i TPM hardware pe cipuri STMicroelectronics ST33<\/a><\/noindex> (CVE-2019-16863).<\/p>\n

Cercet\u0103torii au publicat<\/a><\/noindex> un prototip de instrumentare pentru executarea atacului \u0219i au demonstrat capacitatea de a recupera o cheie privat\u0103 de 256 bi\u021bi, utilizat\u0103 pentru a genera semn\u0103turi digitale folosind algoritmi baza\u021bi pe curbe eliptice ECDSA \u0219i EC-Schnorr. \u00cen func\u021bie de drepturile de acces, timpul total al atacului asupra sisteme Intel fTPM variaz\u0103 \u00eentre 4-20 minute \u0219i necesit\u0103 analiza a 1-15 mii de opera\u021biuni. Pentru a ataca sistemele cu cip ST33 este necesar\u0103 aproximativ 80 de minute \u0219i analiza a aproximativ 40 de mii de opera\u021biuni de generare a semn\u0103turilor digitale. <\/p>\n

Cercet\u0103torii au demonstrat, de asemenea, posibilitatea de a realiza un atac de la distan\u021b\u0103 \u00een re\u021bele de mare vitez\u0103, permi\u021b\u00e2nd, \u00een condi\u021bii de laborator, \u00een re\u021bea local\u0103 cu band\u0103 de 1GB, recuperarea cheii private \u00een cinci ore, dup\u0103 m\u0103surarea timpului de r\u0103spuns pentru 45 de mii de sesiuni de autentificare cu un server VPN bazat pe software-ul strongSwan, care stocheaz\u0103 cheile sale \u00eentr-un TPM vulnerabil.<\/p>\n

Metoda de atac se bazeaz\u0103 pe analiza diferen\u021belor \u00een timpul execut\u0103rii opera\u021biunilor \u00een procesul de generare a semn\u0103turilor digitale. Estimarea \u00eent\u00e2rzierii \u00een timpul efectu\u0103rii calculului permite determinarea informa\u021biilor despre bi\u021bi individuali \u00een timpul efectu\u0103rii \u00eenmul\u021birii cu scalar \u00een opera\u021biile cu curbe eliptice. Pentru ECDSA, determinarea chiar \u0219i a c\u00e2torva bi\u021bi cu informa\u021bii despre vectorul de ini\u021bializare (nonce) este suficient\u0103 pentru a efectua un atac prin recuperarea secven\u021bial\u0103 a \u00eentregii chei private. Pentru a efectua cu succes atacul, este necesar\u0103 analiza timpului de generare a c\u00e2torva mii de semn\u0103turi digitale, create pe baza datelor cunoscute atacatorului.<\/p>\n

Vulnerabilitatea remediat\u0103<\/a><\/noindex> de la compania STMicroelectronics \u00een noua edi\u021bie a chip-urilor, \u00een care implementarea algoritmului ECDSA a fost eliberat\u0103 de corela\u021biile cu timpul de execu\u021bie al opera\u021biunilor. Este interesant c\u0103 chip-urile STMicroelectronics afectate de problem\u0103 sunt utilizate \u00een echipamente care corespund nivelului de securitate Common Criteria (CC) EAL 4+. Cercet\u0103torii au verificat, de asemenea, chip-urile TPM ale companiilor Infineon \u0219i Nuvoton, dar \u00een acestea nu exist\u0103 scurgeri pe baza modific\u0103rii timpului de calcul.<\/p>\n

\u00cen procesoarele Intel, problema se manifest\u0103 \u00eencep\u00e2nd cu familia Haswell, lansat\u0103 \u00een 2013. Se observ\u0103 c\u0103 o gam\u0103 larg\u0103 de laptopuri, PC-uri \u0219i servere, produse de diferi\u021bi furnizori, inclusiv Dell, Lenovo \u0219i HP, este supus\u0103 acestei probleme.<\/p>\n

Compania Intel a inclus o corec\u021bie \u00een actualizarea din noiembrie<\/a><\/noindex> a firmware-urilor, \u00een care, pe l\u00e2ng\u0103 problema discutat\u0103, remediat<\/a><\/noindex> sunt incluse alte 24 de vulnerabilit\u0103\u021bi, dintre care nou\u0103 au fost clasificate ca av\u00e2nd un nivel ridicat de pericol, iar una critic. Pentru problemele men\u021bionate se ofer\u0103 doar informa\u021bii generale, de exemplu, este men\u021bionat c\u0103 vulnerabilitatea critic\u0103 (CVE-2019-0169) este cauzat\u0103 de posibilitatea de a provoca un overflow de memorie pe partea ambientelor Intel CSME (Converged Security and Management Engine) \u0219i Intel TXE (Trusted Execution Engine), ceea ce permite unui atacator s\u0103 \u00ee\u0219i creasc\u0103 privilegiile \u0219i s\u0103 ob\u021bin\u0103 acces la date confiden\u021biale.<\/p>\n

De asemenea, se poate men\u021biona informa\u021biilor despre vulnerabilit\u0103\u021bi \u0219i distribuirea remedierilor,<\/a><\/noindex> rezultatelor auditului diferitelor SDK-uri pentru dezvoltarea aplica\u021biilor care interac\u021bioneaz\u0103 cu codul executat \u00een enclave izolate. Cu scopul de a identifica func\u021biile problematice care ar putea fi utilizate pentru a efectua atacuri, au fost analizate opt SDK-uri: Intel SGX-SDK<\/a><\/noindex>, SGX-LKL<\/a><\/noindex>, Microsoft OpenEnclave<\/a><\/noindex>, Graphene<\/a><\/noindex>,
\nRust-EDP<\/a><\/noindex> \u0219i Google Asylo<\/a><\/noindex> pentru Intel SGX, Keystone<\/a><\/noindex> pentru RISC-V \u0219i Sancus<\/a><\/noindex> pentru Sancus TEE. \u00cen cadrul auditului au fost identificate<\/a><\/noindex> 35 de vulnerabilit\u0103\u021bi, pe baza c\u0103rora au fost dezvoltate mai multe scenarii de atac, permi\u021b\u00e2nd extragerea cheilor AES din enclave sau organizarea execut\u0103rii propriului cod prin crearea condi\u021biilor pentru deteriorarea con\u021binutului memoriei.<\/p>\n

\"Vulnerabilitatea<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0412\u0443\u0441\u0442\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u043e\u043b\u0438\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0438\u043d\u0441\u0442\u0438\u0442\u0443\u0442\u0430, \u041b\u044e\u0431\u0435\u043a\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0421\u0430\u043d-\u0414\u0438\u0435\u0433\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439, \u0445\u0440\u0430\u043d\u0438\u043c\u044b\u0445 \u0432 TPM (Trusted Platform Module). \u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f TPM-Fail \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 fTPM (\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u0430\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0430\u044f \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u043c \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0435 \u0432\u043d\u0443\u0442\u0440\u0438 CPU) \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Intel (CVE-2019-11090) \u0438 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":52698,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52697","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitatea TPM-Fail, care permite recuperarea cheilor stocate \u00een modulele TPM | ProHoster","description":"Un grup de cercet\u0103tori de la Institutul Politehnic Worcester, Universitatea L\u00fcbeck \u0219i Universitatea din California, San Diego","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-tpm-fail-pozvolyayushhaya-vosstanovit-klyuchi-hranimye-v-tpm-modulyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c TPM-Fail, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043a\u043b\u044e\u0447\u0438, \u0445\u0440\u0430\u043d\u0438\u043c\u044b\u0435 \u0432 TPM-\u043c\u043e\u0434\u0443\u043b\u044f\u0445 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0412\u0443\u0441\u0442\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u043e\u043b\u0438\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0438\u043d\u0441\u0442\u0438\u0442\u0443\u0442\u0430, \u041b\u044e\u0431\u0435\u043a\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0421\u0430\u043d-\u0414\u0438\u0435\u0433\u043e","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-tpm-fail-pozvolyayushhaya-vosstanovit-klyuchi-hranimye-v-tpm-modulyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-13T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52697","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:30:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:38:25","updated":"2026-01-24 04:30:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/52697","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=52697"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/52697\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/52698"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=52697"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=52697"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=52697"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}