Nuglaanta TPM-Fail oo kuu ogolaanaysa inaad soo ceshato furayaasha ku kaydsan qaybaha TPM

Koox cilmi-baarayaal ah oo ka socda Machadka Worcester Polytechnic, Jaamacadda Lübeck iyo Jaamacadda California, San Diego horumartay Habka weerarka kanaalka-dhinac u oggolaanaya soo kabashada furayaasha gaarka ah ee ku kaydsan TPM (Trusted Platform Module). Weerarka ayaa la magac baxay TPM-Fail waxayna saamaysaa fTPM (hirgelinta software firmware-ku-saleysan, oo ku shaqeeya microprocessor gaar ah gudaha CPU) oo ka socda Intel (CVE-2019-11090) iyo hardware TPM ee chips-yada SMicroelectronics ST33 (CVE-2019-16863).

Cilmi-baarayaasha la daabacay Qalabka weerarka noociisa ah ayaa la sameeyay waxaana la soo bandhigay awooda dib u soo celinta furaha gaarka ah ee 256-bit loo adeegsaday si loo dhaliyo saxiixyada dhijitaalka ah iyadoo la adeegsanayo ECDSA iyo EC-Schnorr elliptical curve algorithms ayaa la muujiyay. Iyada oo ku xidhan xuquuqaha gelitaanka, wadarta wakhtiga weerarka ee nidaamyada fTPM ee Intel wuxuu u dhexeeyaa 4 ilaa 20 daqiiqo wuxuuna u baahan yahay falanqaynta 1 ilaa 15 hawlgal. Weerar lagu qaado nidaamyada leh chip-ka ST33 wuxuu u baahan yahay ku dhawaad ​​80 daqiiqo iyo falanqaynta ku dhawaad ​​40 hawl-abuurista saxeexa dhijitaalka ah.

Cilmi-baadhayaashu waxay sidoo kale muujiyeen awoodda ay u leeyihiin inay ku fuliyaan weerar fog oo ku saabsan shabakadaha xawaaraha sare leh, iyaga oo u oggolaanaya inay dib u soo ceshadaan furaha gaarka ah shan saacadood gudahood shabakadda 1GB ee xaaladaha shaybaarka, ka dib markii ay cabbireen wakhtiga jawaabta ee 45 kalfadhiyada xaqiijinta oo leh server VPN ku salaysan oo xooggan oo Swan ku salaysan oo ku kaydinaya furihiisa TPM nugul.

Habka weerarku wuxuu ku salaysan yahay falanqaynta kala duwanaanshaha wakhtiyada fulinta hawlgallada inta lagu jiro abuurista saxeexa dhijitaalka ah. Qiyaasta daahitaanka xisaabtu waxay u oggolaanaysaa mid si loo go'aamiyo macluumaadka ku saabsan qaniinyada shakhsi ahaaneed inta lagu jiro isku dhufashada scalar ee hawlgallada qalooca elliptical. ECDSA, go'aaminta xitaa waxoogaa macluumaad ah oo ku saabsan vector-ka bilawga ah (aan lahayn) ayaa ku filan in la sameeyo weerar si isdaba joog ah loogu soo celiyo dhammaan furaha gaarka ah. Weerarka guusha leh wuxuu u baahan yahay in la falanqeeyo jiilka dhowr kun oo saxeex dhijitaal ah oo lagu sameeyay xogta uu yaqaan weerarka.

Nuglaanta meesha laga saaray STMicroelectronics waxay heshay nooc cusub oo chips-keeda ah, kaas oo hirgelinta ECDSA algorithm laga xoreeyay xiriirinta waqtiyada fulinta. Waxa xiisaha lihi leh, chips-yada STMicroelectronics ee ay saamaysay ayaa sidoo kale loo isticmaalaa qalabka buuxiya Shuruudaha Guud (CC) EAL 4+ heerka amniga. Cilmi-baarayaashu waxay sidoo kale tijaabiyeen chips-yada TPM ee Infineon iyo Nuvoton, laakiin waxay ogaadeen inaysan soo bandhigin qulqulka ku salaysan kala duwanaanshaha waqtiga xisaabinta.

Arrintu waxay saamaynaysay Processor-yaasha Intel tan iyo qoyska Haswell, oo la sii daayay 2013. Waxaa la sheegay in dhibaatadu ay saamayso tiro badan oo ah laptops, PCs, iyo server-yada warshado kala duwan, oo ay ku jiraan Dell, Lenovo, iyo HP.

Intel wuxuu ku daray hagaajin Nofeembar update firmware, kaas oo, marka lagu daro dhibaatada la tixgelinayo, meesha laga saaray 24 kale oo dayacan, kuwaas oo sagaal ka mid ah lagu qiimeeyay darnaan sare iyo mid halis ah. Kaliya macluumaadka guud ayaa la bixiyaa arrimahan, tusaale ahaan, waxaa la xusay in dayacanka halista ah (CVE-2019-0169) ay ku lug leedahay awoodda ay ku sababi karto qulqulka qulqulka Intel CSME (Mashiinka Amniga iyo Maareynta Isku-dhafka ah) iyo Intel TXE (Matoorka Fulinta la Aaminsan yahay), taasoo u oggolaanaysa weeraryahan inuu kordhiyo mudnaanta iyo helitaanka xogta xasaasiga ah.

Waxaad sidoo kale ogaan kartaa kashifid Natiijooyinka xisaab xidhka SDK-yada kala duwan ee horumarinta codsiyada ee la falgala kood ka socda meelo go'doonsan ayaa la falanqeeyay. Siddeed SDKs ayaa la falanqeeyay si loo aqoonsado shaqooyinka dhibka leh ee looga faa'iidaysan karo weerarada: Intel SGX-SDK, SGX-LKL, Microsoft OpenEnclave, Graphene,
miridhku-EDP и Google Asylo Intel SGX, dhagaxa rukunka loogu talagalay RISC-V iyo Sancus ee Sancus TEE. Inta lagu jiro xisaab-xidhka, kashifay 35 nuglaanta, oo ku salaysan dhowr xaaladood oo weerar ah ayaa la sameeyay, taas oo u oggolaanaysa mid ka mid ah in uu ka soo saaro furayaasha AES ee ka soo horjeeda ama abaabulo fulinta koodhkiisa iyada oo la abuurayo shuruudo loogu talagalay musuqmaasuqa xusuusta.

Source: opennet.ru