Vatsvagiri kubva kuEset mutsva musiyano (CVE-2020-3702) wekusagadzikana , inoshanda kuQualcomm uye MediaTek isina waya machipi. Kuda , iyo yakanganisa Cypress uye Broadcom machipisi, kusazvibata kutsva kunobvumidza iwe kuti udzikise yakavharirwa Wi-Fi traffic yakachengetedzwa uchishandisa iyo WPA2 protocol.
Ngatiyeukei kuti kusazvibata kweKr00k kunokonzereswa nekusarongeka kwemakiyi encryption kana mudziyo ukabviswa (kuparadzaniswa) kubva panzvimbo yekuwana. Mune yekutanga vhezheni yekusagadzikana, pakubviswa, kiyi yechikamu (PTK) yakachengetwa mundangariro yechip yakadzoserwa, sezvo pasina imwe data yaizotumirwa muchikamu chazvino. Muchiitiko ichi, iyo data yakasara mubhafa yekufambisa (TX) yakavharidzirwa nekiyi yakacheneswa inongove zero chete uye, nekudaro, inogona kudhindwa zviri nyore panguva yekubatwa. Kiyi isina chinhu inoshanda chete kune yakasara data mubuffer, iri mashoma kilobytes muhukuru.
Musiyano wakakosha pakati peyechipiri vhezheni yekusagadzikana, iyo inoonekwa muQualcomm neMediaTek machipi, ndewekuti pachinzvimbo chekuvharirwa nekiyi zero, data mushure mekuparadzaniswa inofambiswa isina kunyorwa zvachose, zvisinei nekuti iyo encryption mireza yakaiswa. Pamidziyo yakaedzwa kusasimba yakavakirwa pamachipisi eQualcomm, iyo D-Link DCH-G020 Smart Home Hub uye router yakavhurika zvakaonekwa. . Pamidziyo yakavakirwa pamachipi eMediaTek, iyo ASUS RT-AC52U router uye IoT mhinduro dzakavakirwa paMicrosoft Azure Sphere uchishandisa MediaTek MT3620 microcontroller yakaedzwa.
Kushandisa ese ari maviri marudzi ekusagadzikana, anorwisa anogona kutumira yakakosha kudzora mafuremu ayo anokonzeresa kuparadzaniswa uye kubata iyo data inotumirwa mushure. Disassociation inowanzoshandiswa mumatambo asina waya kushandura kubva pane imwe nzvimbo kuenda kune imwe paunenge uchidzungaira kana kana kutaurirana nenzvimbo yekupinda iripo yarasika. Kuparadzanisa kunogona kukonzerwa nekutumira chigadziro chekutonga, icho chinoparidzirwa chisina kunyorwa uye chisingadi kuvimbiswa (anorwisa anongoda kusvika kwechiratidzo cheWi-Fi, asi haafaniri kubatanidzwa kune network network). Kurwiswa kunogoneka kana mudziyo wemutengi ari munjodzi ukapinda munzvimbo isingapindike, uye kana chishandiso chisina kukanganiswa chikawana nzvimbo yekupinda inoratidza kusagadzikana.
Kusagadzikana kunokanganisa encryption pane isina waya network level uye inobvumidza iwe kuti uongorore chete isina chengetedzo yekubatanidza inotangwa nemushandisi (semuenzaniso, DNS, HTTP uye mail traffic), asi haibvumire iwe kukanganisa kubatana ne encryption padanho rekunyorera (HTTPS, SSH, STARTTLS, DNS pamusoro peTLS, VPN uye nezvimwe). Ngozi yekurwiswa inoderedzwawo nenyaya yekuti pane imwe nguva munhu anorwisa anogona kungobvisa mashoma kilobytes yedata yaive mune yekutumira buffer panguva yekudimburwa. Kuti ubudirire kutora chakavanzika data yakatumirwa pamusoro pekubatana kusina kuchengetedzwa, munhu anorwisa anofanira kunge achinyatsoziva payakatumirwa, kana kugara achitanga kudzima kubva panzvimbo yekupinda, izvo zvichave pachena kumushandisi nekuda kwekugara uchitangazve yekubatanidza isina waya.
Dambudziko rakagadziriswa mukuvandudzwa kwaChikunguru kwevatyairi vevaridzi veQualcomm machipisi uye mukuvandudza kwaApril kwevatyairi veMediaTek chips. Kugadziriswa kweMT3620 kwakarongwa muna Chikunguru. Vatsvagiri vakaona dambudziko havana ruzivo nezve kubatanidzwa kwezvigadziriso muyemahara ath9k mutyairi. Kuedza michina yekuona kune zvese zvinokanganisa mumutauro wePython.
Uyezve, inogona kucherechedzwa Vanotsvaga kubva kuCheckpoint vakaona kusakwana kutanhatu muQualcomm DSP machipi, anoshandiswa pamakumi mana muzana emafoni, kusanganisira zvishandiso kubva kuGoogle, Samsung, LG, Xiaomi uye OnePlus. Tsanangudzo pamusoro pekusagadzikana hazvipihwe kudzamara nyaya dzagadziriswa nevagadziri. Sezvo DSP chip iri "black box" isingagone kudzorwa nemugadziri we smartphone, kugadzirisa kunogona kutora nguva yakareba uye kunoda kurongeka pamwe neiyo DSP chip mugadziri.
DSP machipisi anoshandiswa mumafoni emazuva ano kuita mashandiro akadai seodhiyo, mufananidzo uye vhidhiyo kugadzirisa, mukombuta yeaugmented real system, kuona komputa uye kudzidza muchina, pamwe nekuita nekukurumidza kuchaja modhi. Pakati pekurwiswa kunobvumidzwa nekusagadzikana kwakaonekwa kunotaurwa: Kupfuura iyo yekupinda yekudzora sisitimu - kusingaonekwe kutorwa kwedata senge mafoto, mavhidhiyo, kufona zvakarekodhwa, data kubva kumakrofoni, GPS, nezvimwe. Kuramba basa - kuvharira kuwana kune ese akachengetwa ruzivo. Kuvanza chiitiko chakashata - kugadzira zvachose zvisingaonekwe uye zvisingabvisiki zvinokuvadza zvikamu.
Source: opennet.ru