{"id":112431,"date":"2023-12-22T21:10:32","date_gmt":"2023-12-22T19:10:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/mayhem-ataka-iskazhayushhaya-bity-v-pamyati-dlya-obhoda-autentifikaczii-v-sudo-i-openssh"},"modified":"2023-12-22T21:10:32","modified_gmt":"2023-12-22T19:10:33","slug":"mayhem-ataka-iskazhayushhaya-bity-v-pamyati-dlya-obhoda-autentifikaczii-v-sudo-i-openssh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/mayhem-ataka-iskazhayushhaya-bity-v-pamyati-dlya-obhoda-autentifikaczii-v-sudo-i-openssh","title":{"rendered":"Mayhem - nj\u00eb sulm q\u00eb shqet\u00ebson bit\u00ebt n\u00eb memorie p\u00ebr t\u00eb kaluar autentikimin n\u00eb sudo dhe OpenSSH","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Hulumtuesit nga Instituti Politeknik i Worcester (SHBA) prezantuan nj\u00eb lloj t\u00eb ri sulmi t\u00eb quajtur Mayhem, q\u00eb p\u00ebrdor metod\u00ebn e deformimit t\u00eb bit\u00ebve n\u00eb memorien dinamike t\u00eb operativit Rowhammer p\u00ebr t\u00eb ndryshuar vlerat e variablave n\u00eb grumbull, q\u00eb p\u00ebrdoren n\u00eb program si flamuj p\u00ebr t\u00eb vendosur n\u00ebse autentifikimi ka qen\u00eb i suksessh\u00ebm dhe p\u00ebr t\u00eb kaluar kontroll\u00ebt e siguris\u00eb. Shembuj praktik\u00eb t\u00eb zbatimit t\u00eb sulmit u demonstruan p\u00ebr t\u00eb anashkaluar autentifikimin n\u00eb SUDO, OpenSSH dhe MySQL, si dhe p\u00ebr t\u00eb ndryshuar rezultatet e kontroll\u00ebve t\u00eb siguris\u00eb n\u00eb bibliotek\u00ebn OpenSSL. <\/p>\n
Sulmi mund t\u00eb aplikohet n\u00eb aplikacione ku n\u00eb kontrolle p\u00ebrdoret krahasimi i ndryshimeve t\u00eb vlerave nga zero. Shembulli i kodit t\u00eb cenuesh\u00ebm: int auth = 0; ... \/\/ kodi i kontrollit q\u00eb ndryshon vler\u00ebn e auth n\u00eb rast autentifikimi t\u00eb suksessh\u00ebm if(auth != 0) return AUTH_SUCCESS; else return AUTH_FAILURE; <\/p>\n
N\u00eb kontekstin e k\u00ebtij shembulli, p\u00ebr nj\u00eb sulm t\u00eb suksessh\u00ebm \u00ebsht\u00eb e mjaftueshme t\u00eb arrihet deformimi i \u00e7do biti n\u00eb memorie, q\u00eb i p\u00ebrket nj\u00eb variabli 32-bit auth n\u00eb stack. Me deformimin e \u00e7do biti n\u00eb variablin, vlera nuk do t\u00eb jet\u00eb m\u00eb e barabart\u00eb me zero dhe operatori kusht do t\u00eb p\u00ebrcaktoj\u00eb kalimin e suksessh\u00ebm t\u00eb autentikimit. K\u00ebto modele verifikimi jan\u00eb mjaft t\u00eb zakonshme n\u00eb aplikacione dhe shfaqen, p\u00ebr shembull, n\u00eb SUDO, OpenSSH, MySQL dhe OpenSSL.
<\/center> <\/p>\n
Sulmi mund t\u00eb aplikohet edhe n\u00eb krahasime si «if(auth == 1)», por n\u00eb k\u00ebt\u00eb rast, realizimi i tij komplikohet, pasi duhet t\u00eb deformohet jo \u00e7do bit nga 32, por bita i fundit. Metoda gjithashtu mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb ndikuar n\u00eb vlerat e variablave n\u00eb regjistrat e procesorit, pasi p\u00ebrmbajtja e regjistrave mund t\u00eb nxirret p\u00ebrkoh\u00ebsisht n\u00eb stack gjat\u00eb ndryshimit t\u00eb kontekstit, thirrjes s\u00eb funksioneve ose aktivizimit t\u00eb handler-it t\u00eb sinjalit. N\u00eb intervalin e koh\u00ebs, nd\u00ebrsa vlerat e regjistrave ndodhen n\u00eb memorie, n\u00eb k\u00ebt\u00eb memorje mund t\u00eb b\u00ebhen deformime dhe registri do t\u00eb rikthej\u00eb vler\u00ebn e modifikuar.
<\/center> <\/p>\n
P\u00ebr t\u00eb manipuluar bit\u00ebt p\u00ebrdoret nj\u00eb nga modifikimet e sulmit t\u00eb klas\u00ebs RowHammer. P\u00ebr shkak se memoria DRAM p\u00ebrb\u00ebhet nga nj\u00eb mori dy-dimensionale e qelizave, secila prej t\u00eb cilave p\u00ebrb\u00ebhet nga nj\u00eb kondensator dhe nj\u00eb transistor, p\u00ebrfundimi i vazhduesh\u00ebm i leximeve n\u00eb t\u00eb nj\u00ebjt\u00ebn zon\u00eb t\u00eb memories \u00e7on n\u00eb fluktuacione t\u00eb tensionit dhe anomali q\u00eb shkaktojn\u00eb humbje t\u00eb vog\u00ebl t\u00eb ngarkes\u00ebs s\u00eb qelizave fqinje. N\u00ebse intensiteti i leximit \u00ebsht\u00eb i lart\u00eb, at\u00ebher\u00eb nj\u00eb qeliz\u00eb fqinje mund t\u00eb humbas\u00eb nj\u00eb sasi t\u00eb madhe ngarkese dhe cikli i ardhsh\u00ebm i rinovimit nuk do t\u00eb arrij\u00eb t\u00eb rikthej\u00eb gjendjen fillestare, q\u00eb do t\u00eb \u00e7oj\u00eb n\u00eb ndryshimin e vler\u00ebs s\u00eb t\u00eb dh\u00ebnave t\u00eb ruajtura n\u00eb qeliz\u00eb. P\u00ebr t\u00eb mbrojtur nga RowHammer, prodhuesit e \u00e7ip\u00ebve shtuan mekanizmin TRR (Target Row Refresh), i cili bllokon manipulimin e qelizave n\u00eb raste t\u00eb ve\u00e7anta, por nuk mbron nga t\u00eb gjitha variantet e mundshme t\u00eb sulmit. <\/p>\n
P\u00ebr t\u00eb mbrojtur nga sulmi Mayhem, rekomandohet q\u00eb n\u00eb krahasime t\u00eb mos p\u00ebrdoren vlerat e ndryshimeve nga zero ose p\u00ebrputhjes me nj\u00ebsi, por t\u00eb kontrollohet p\u00ebrputhshm\u00ebria duke p\u00ebrdorur nj\u00eb vler\u00eb rast\u00ebsore siciale me oktete t\u00eb pazbatuara. N\u00eb k\u00ebt\u00eb rast, p\u00ebr t\u00eb vendosur vler\u00ebn e nevojshme t\u00eb variablit, \u00ebsht\u00eb e nevojshme t\u00eb deformohet sakt\u00ebsisht nj\u00eb num\u00ebr thelb\u00ebsor bit\u00ebsh, q\u00eb \u00ebsht\u00eb e pamundur, n\u00eb krahasim me deformimin e vet\u00ebm nj\u00eb biti. Shembulli i kodit t\u00eb paprekur nga sulmi: int auth = 0xbe406d1a; ... \/\/ kodi i verifikimit q\u00eb vendos vler\u00ebn auth n\u00eb 0x23ab8701 n\u00eb rast t\u00eb suksesit t\u00eb autentikimit if(auth == 0x23ab8701) return AUTH_SUCCESS; else return AUTH_FAILURE; <\/p>\n
Metoda e mbrojtjes s\u00eb p\u00ebrmendur tashm\u00eb \u00ebsht\u00eb aplikuar nga zhvilluesit e sudo dhe \u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb l\u00ebshimin 1.9.15 si nj\u00eb rregullim p\u00ebr dob\u00ebsin\u00eb CVE-2023-42465. Prototipi i kodit p\u00ebr kryerjen e sulmit planifikohet t\u00eb publikohet pas zbatimit t\u00eb korrigjimeve n\u00eb projektet kryesore t\u00eb dob\u00ebsive. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Mayhem](\"\/wp-content\/uploads\/2023\/12\/ef5dd9463837514f055f9f2610652fb9.png\")
<\/center> <\/p>\n![\"Mayhem](\"\/wp-content\/uploads\/2023\/12\/089c4ea98448b638ba630e55821fc32f.png\")
<\/center> <\/p>\n