{"id":101725,"date":"2021-10-22T16:22:55","date_gmt":"2021-10-22T14:22:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave"},"modified":"2021-10-22T16:22:55","modified_gmt":"2021-10-22T14:22:58","slug":"ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","title":{"rendered":"Sulmi ndaj Intel SGX, i cili lejon nxjerrjen e t\u00eb dh\u00ebnave konfidenciale ose ekzekutimin e kodit n\u00eb enclav\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

K\u00ebrkuesit nga Universiteti i Mbrojtjes Shkencore dhe Teknologjik t\u00eb Ushtris\u00eb \u00c7lirimtare t\u00eb Kin\u00ebs, Universiteti Komb\u00ebtar t\u00eb Singaporit dhe Shkolla Politeknike e Cyrihut kan\u00eb zhvilluar nj\u00eb metod\u00eb t\u00eb re sulmi ndaj enclave-ve t\u00eb izoluara Intel SGX (Software Guard eXtensions). Sulmi njihet si SmashEx dhe shkaktohet nga problemet e ri-atribuueshm\u00ebris\u00eb gjat\u00eb trajtimit t\u00eb situatave p\u00ebrjashtuese n\u00eb procesin e pun\u00ebs s\u00eb komponenteve runtime p\u00ebr Intel SGX. Metoda e sugjeruar e sulmit mund\u00ebson, p\u00ebrmes kontrollit t\u00eb sistemit operativ, identifikimin e t\u00eb dh\u00ebnave konfidenciale t\u00eb vendosura n\u00eb enclave, ose organizimin e kopjimit t\u00eb kodit t\u00eb vet n\u00eb memorjen e enclave dhe ekzekutimin e tij. <\/p>\n

Prototipat e eksploit\u00ebve jan\u00eb p\u00ebrgatitur p\u00ebr enclave me runtime t\u00eb bazuar n\u00eb Intel SGX SDK (CVE-2021-0186) dhe Microsoft Open Enclave (CVE-2021-33767). N\u00eb rastin e par\u00eb \u00ebsht\u00eb demonstruar mund\u00ebsia e nxjerrjes s\u00eb \u00e7el\u00ebsit RSA, i cili p\u00ebrdoret n\u00eb serverin web p\u00ebr HTTPS, nd\u00ebrsa n\u00eb t\u00eb dytin \u00ebsht\u00eb arritur t\u00eb identifikohet p\u00ebrmbajtja e marr\u00eb nga utilitarja cURL, e ekzekutuar brenda enclave. Shtigjshm\u00ebria \u00ebsht\u00eb eliminuar tashm\u00eb p\u00ebrmes nj\u00eb azhurnimi programor n\u00eb versionet Intel SGX SDK 2.13 dhe Open Enclave 0.17.1. P\u00ebrve\u00e7 paketave Intel SGX SDK dhe Microsoft Open Enclave, kjo shtigjshm\u00ebri shfaqet gjithashtu n\u00eb SDK-t\u00eb Google Asylo, EdgelessRT, Apache Teaclave, Rust SGX SDK, SGX-LKL, CoSMIX dhe Veracruz. <\/p>\n

T\u00eb kujtojm\u00eb se teknologjia SGX (Software Guard Extensions) u shfaq n\u00eb procesor\u00ebt Intel Core t\u00eb gjenerat\u00ebs s\u00eb gjasht\u00eb (Skylake) dhe ofron nj\u00eb s\u00ebr\u00eb instrukcionesh q\u00eb lejojn\u00eb ndarjen e hap\u00ebsirave t\u00eb mbyllura t\u00eb memories p\u00ebr aplikacionet e nivelit p\u00ebrdorues - enclave, p\u00ebrmbajtja e t\u00eb cilave nuk mund t\u00eb lexoj\u00eb dhe modifikohet as nga kernel-i, as nga kodi q\u00eb ekzekutohet n\u00eb m\u00ebnyrat ring0, SMM dhe VMM. T\u00eb kalosh kontrollin n\u00eb kodin brenda enclave nuk \u00ebsht\u00eb e mundur me funksionet tradicionale t\u00eb kalimit dhe manovrimeve me regjistrat e stack-un - p\u00ebr t\u00eb kaluar kontrollin n\u00eb enclave p\u00ebrdoren instrukcione t\u00eb reja t\u00eb krijuara posa\u00e7\u00ebrisht, EENTER, EEXIT dhe ERESUME, q\u00eb verifikojn\u00eb autorizimin. Megjithat\u00eb, kodi i vendosur n\u00eb enclave mund t\u00eb p\u00ebrdor\u00eb metoda klasike thirrjeje p\u00ebr t\u00eb apeluar funksionet brenda enclave dhe nj\u00eb instruksion t\u00eb ve\u00e7ant\u00eb p\u00ebr thirrjen e funksioneve t\u00eb jashtme. P\u00ebr t\u00eb mbrojtur nga sulmet harduerike, si lidhja n\u00eb modulin DRAM, aplikohet enkriptimi i memories s\u00eb enclave.

\"Sulmi<\/center> <\/p>\n

Problemi \u00ebsht\u00eb se teknologjia SGX lejon sistemin operativ t\u00eb nd\u00ebrpres\u00eb ekzekutimin e enklav\u00ebs duke gjeneruar nj\u00eb p\u00ebrjashtim harduerik, nd\u00ebrsa n\u00eb enklava nuk realizohen si\u00e7 duhet primitivet p\u00ebr p\u00ebrpunimin atomik t\u00eb k\u00ebtyre p\u00ebrjashtimeve. Ndryshe nga b\u00ebrthama e sistemit operativ dhe aplikacionet e zakonshme, kodi brenda enklavave nuk ka akses n\u00eb primitivet p\u00ebr organizimin e veprimeve atomike gjat\u00eb p\u00ebrpunimit t\u00eb p\u00ebrjashtimeve q\u00eb ndodhin asinkronisht. Pa k\u00ebto primitive atomike, enklava mund t\u00eb nd\u00ebrpritet n\u00eb \u00e7do moment dhe t\u00eb kthehet n\u00eb ekzekutim, madje n\u00eb momentet kur n\u00eb enklav\u00eb p\u00ebrfundohen seksionet kritike dhe ajo ndodhet n\u00eb nj\u00eb gjendje t\u00eb pasigurt (p\u00ebr shembull, kur regjistrat e CPU nuk jan\u00eb ruajtur\/rivendosur).

\"Sulmi<\/center> <\/p>\n

P\u00ebr funksionimin normal, teknologjia SGX lejon nd\u00ebrprerjen e ekzekutimit t\u00eb enklav\u00ebs nga p\u00ebrjashtime harduerike t\u00eb personalizuara. Kjo ve\u00e7ori lejon mjediseve runtime t\u00eb enklavave t\u00eb realizojn\u00eb p\u00ebrpunimin e p\u00ebrjashtimeve brenda-enklav\u00ebs ose p\u00ebrpunimin e sinjaleve, por gjithashtu mund t\u00eb provokoj\u00eb gabime t\u00eb ri-nd\u00ebrhyrjes. Sulmi SmashEx bazohet n\u00eb shfryt\u00ebzimin e mang\u00ebsive n\u00eb SDK p\u00ebr shkak t\u00eb t\u00eb cilave situata e thirrjes s\u00eb p\u00ebrs\u00ebritur t\u00eb trajtuesit t\u00eb p\u00ebrjashtimit nuk p\u00ebrpunizohet si\u00e7 duhet. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme q\u00eb p\u00ebr t\u00eb shfryt\u00ebzuar k\u00ebt\u00eb vulnerabilitet, sulmuesi duhet t\u00eb ket\u00eb mund\u00ebsin\u00eb p\u00ebr t\u00eb nd\u00ebrprer\u00eb ekzekutimin e enklav\u00ebs, pra, duhet t\u00eb kontrolloj\u00eb funksionimin e mjedisit sistemor. <\/p>\n

Pas gjenerimit t\u00eb nj\u00eb p\u00ebrjashtimi, sulmuesi merr nj\u00eb dritare t\u00eb vog\u00ebl kohore, gjat\u00eb s\u00eb cil\u00ebs mund t\u00eb kap\u00eb fluksin e ekzekutimit p\u00ebrmes manipulimit me parametrat e hyrjes. N\u00eb ve\u00e7anti, me qasje n\u00eb sistem (mjedisi jasht\u00eb enklav\u00ebs), \u00ebsht\u00eb e mundur t\u00eb krijohet nj\u00eb p\u00ebrjashtim i ri menj\u00ebher\u00eb pas ekzekutimit t\u00eb instrukcionit t\u00eb hyrjes n\u00eb enklav\u00eb (EENTER), i cili do t\u00eb \u00e7onte n\u00eb kthimin e kontrollit n\u00eb sistem n\u00eb nj\u00eb faz\u00eb kur akoma nuk \u00ebsht\u00eb p\u00ebrfunduar konfigurimi i grumbullit p\u00ebr enklav\u00ebn, ku p\u00ebrfshihet n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb ruajtja e gjendjes s\u00eb regjistrave t\u00eb CPU. <\/p>\n

Sistemi mund t\u00eb kthej\u00eb kontrollin p\u00ebrs\u00ebri n\u00eb enclave, por pasi steku i enclave gjat\u00eb nd\u00ebrprerjes nuk ishte i konfiguruar, enclave do t\u00eb ekzekutohet me stekun q\u00eb ndodhet n\u00eb memory-n\u00eb e sistemit, gj\u00eb q\u00eb mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb aplikuar metoda shfrytzuese q\u00eb bazohen n\u00eb programimin e orientuar nga kthimi (ROP - Return-Oriented Programming). Kur p\u00ebrdoret teknika ROP, sulmuesi nuk tenton t\u00eb vendos\u00eb kodin e tij n\u00eb memorje, por operon me p\u00ebrb\u00ebr\u00ebsit ekzistues n\u00eb bibliotekat e ngarkuara, q\u00eb p\u00ebrfundojn\u00eb me instrukcionin e kthimit t\u00eb kontrollit (zakonisht fundet e funksioneve t\u00eb bibliotekave). Puna e eksploitit p\u00ebrb\u00ebhet nga nd\u00ebrtimi i nj\u00eb zinxhiri thirrjesh t\u00eb till\u00eb blokesh (\"gadgets\") p\u00ebr t\u00eb arritur funksionalitetin e d\u00ebshiruar.

\"Sulmi<\/center>
\"Sulmi<\/center>
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041e\u0431\u043e\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u043d\u0430\u0443\u0447\u043d\u043e-\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u041d\u0430\u0440\u043e\u0434\u043d\u043e-\u043e\u0441\u0432\u043e\u0431\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0440\u043c\u0438\u0438 \u041a\u0438\u0442\u0430\u044f, \u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0430 \u0438 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u043d\u043a\u043b\u0430\u0432\u044b Intel SGX (Software Guard eXtensions). \u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 SmashEx \u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438 \u0441 \u0440\u0435\u0435\u043d\u0442\u0435\u0440\u0430\u0431\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0439 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0431\u043e\u0442\u044b runtime-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f Intel SGX. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":101726,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101725","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sulmi ndaj Intel SGX, i cili lejon ekstraktimin e t\u00eb dh\u00ebnave t\u00eb ndjeshme ose ekzekutimin e kodit n\u00eb enkla | ProHoster","description":"K\u00ebrkuesit nga Universiteti Shkencor dhe Teknik t\u00eb Mbrojtjes t\u00eb Armat\u00ebs \u00c7lirimtare t\u00eb Kin\u00ebs, nga Universiteti Komb\u00ebtar i Singaporit dhe nga Shkolla e Lart\u00eb Teknike e Zvicr\u00ebs zhvilluan nj\u00eb metod\u00eb t\u00eb re sulmi ndaj.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 Intel SGX, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u0430\u043d\u043a\u043b\u0430\u0432\u0435 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041e\u0431\u043e\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u043d\u0430\u0443\u0447\u043d\u043e-\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u041d\u0430\u0440\u043e\u0434\u043d\u043e-\u043e\u0441\u0432\u043e\u0431\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0440\u043c\u0438\u0438 \u041a\u0438\u0442\u0430\u044f, \u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0430 \u0438 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-na-intel-sgx-pozvolyayushhaya-izvlech-konfidenczialnye-dannye-ili-vypolnit-kod-v-anklave","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-22T14:22:58+00:00","article:modified_time":"2021-10-22T14:22:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101725","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-22 14:25:41","updated":"2022-09-28 00:18:10","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/101725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=101725"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/101725\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/101726"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=101725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=101725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=101725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}