{"id":32375,"date":"2019-10-31T21:46:40","date_gmt":"2019-10-31T18:46:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone\/"},"modified":"2019-10-31T21:46:40","modified_gmt":"2019-10-31T18:46:40","slug":"uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb \u00e7ipat Qualcomm q\u00eb lejon nxjerrjen e \u00e7el\u00ebsave t\u00eb mbyllur nga magazina TrustZone","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

K\u00ebrkuesit nga kompania NCC Group zbuluan<\/a><\/noindex> detajet<\/noindex> dobitjet (CVE-2018-11976<\/a><\/noindex>) n\u00eb \u00e7ipet Qualcomm, q\u00eb lejon t\u00eb p\u00ebrcaktohet p\u00ebrmbajtja e \u00e7el\u00ebsave t\u00eb mbyllur t\u00eb enkriptimit, t\u00eb vendosur n\u00eb nj\u00eb enklav\u00eb t\u00eb izoluar Qualcomm QSEE (Mjedisi i Ekzekutimit t\u00eb Sigurt t\u00eb Qualcomm), i bazuar n\u00eb teknologjin\u00eb ARM TrustZone. Problemi shfaqet n\u00eb most cases it will give you a sufficient insight into who is executing the password reset request.<\/a><\/noindex> SoC Snapdragon, q\u00eb jan\u00eb p\u00ebrhapur n\u00eb smartphone-t e bazuar n\u00eb platform\u00ebn Android. Rregullimet q\u00eb zgjidhin problemin, tashm\u00eb are packages with proprietary NVIDIA drivers. For systems with NVIDIA graphics chips, free \"Nouveau\" drivers continue to be offered by default, while proprietary drivers are available as an option for quick installation after the installation is completed;<\/a><\/noindex> N\u00eb p\u00ebrdit\u00ebsimin e prillit t\u00eb Android dhe n\u00eb versionet e reja t\u00eb firmware p\u00ebr \u00e7ipat Qualcomm. P\u00ebrgatitja e rregullimeve nga ana e kompanis\u00eb Qualcomm zgjati m\u00eb shum\u00eb se nj\u00eb vit \u2014 informacioni mbi vunerabilitetin iu d\u00ebrgua Qualcomm q\u00eb m\u00eb 19 mars 2018.<\/p>\n

Kujtojm\u00eb se teknologjia ARM TrustZone lejon krijimin e mjediseve t\u00eb mbrojtura t\u00eb izoluar nga hardueri, t\u00eb cilat jan\u00eb plot\u00ebsisht t\u00eb ndara nga sistemi kryesor dhe ekzekutohen n\u00eb nj\u00eb procesor virtual t\u00eb ve\u00e7ant\u00eb duke p\u00ebrdorur nj\u00eb sistem operativ t\u00eb ve\u00e7ant\u00eb. Q\u00ebllimi kryesor i TrustZone \u00ebsht\u00eb sigurimi i ekzekutimit t\u00eb izoluar t\u00eb p\u00ebrpunuesve t\u00eb \u00e7el\u00ebsave t\u00eb enkriptimit, autentikimit biometrik, t\u00eb dh\u00ebnave t\u00eb pages\u00ebs dhe informacionit tjet\u00ebr t\u00eb ndjesh\u00ebm. Nd\u00ebrveprimi me OS-n\u00eb kryesore realizohet n\u00eb m\u00ebnyr\u00eb indirekte p\u00ebrmes nj\u00eb nd\u00ebrfaqe t\u00eb menaxhimit. \u00c7el\u00ebsat e mbyllur t\u00eb enkriptimit vendosen brenda nj\u00eb depoje \u00e7el\u00ebsash t\u00eb izoluar harduerikisht, q\u00eb me zbatimin e duhur lejon parandalimin e rrjedhjes s\u00eb tyre n\u00eb rast t\u00eb kompromentimit t\u00eb sistemit kryesor.<\/p>\n

Dob\u00ebsia lidhet me nj\u00eb munges\u00eb n\u00eb zbatimin e algoritmit t\u00eb p\u00ebrpunimit t\u00eb kurbave eliptike, q\u00eb \u00e7oi n\u00eb rrjedhjen e informacionit mbi p\u00ebrpunimin e t\u00eb dh\u00ebnave. K\u00ebrkuesit zhvilluan nj\u00eb teknik\u00eb sulmi p\u00ebrmes kanaleve an\u00ebsore, q\u00eb lejon p\u00ebrmbajtjen e \u00e7el\u00ebsave t\u00eb mbyllur t\u00eb rinovohen n\u00eb baz\u00eb t\u00eb rrjedhjeve t\u00eb t\u00eb dukshme, vendosur n\u00eb nj\u00eb Android Keystore<\/a><\/noindex>. Rrjedhjet identifikohen bazuar n\u00eb analiz\u00ebn e aktivitetit t\u00eb blokut t\u00eb parashikimit t\u00eb kalimeve dhe ndryshimin e koh\u00ebs s\u00eb aksesit n\u00eb t\u00eb dh\u00ebna n\u00eb memorie. Gjat\u00eb eksperimentit, k\u00ebrkuesit demonstruan me sukses rinovimin e \u00e7el\u00ebsave ECDSA me gjat\u00ebsi 224 dhe 256 bit nga depoja e \u00e7el\u00ebsave t\u00eb izoluar harduerikisht, e p\u00ebrdorur n\u00eb smartphone-n Nexus 5X. P\u00ebr t\u00eb rinovuar \u00e7el\u00ebsin, ishte e nevojshme t\u00eb gjeneroheshin rreth 12,000 n\u00ebnshkrime digjitale, p\u00ebr t\u00eb cilat u desh\u00ebn m\u00eb shum\u00eb se 14 or\u00eb. P\u00ebr kryerjen e sulmit u p\u00ebrdor nj\u00eb grup mjetesh Cachegrab<\/a><\/noindex>.<\/p>\n

Arsyeja kryesore e shfaqjes s\u00eb problemit \u00ebsht\u00eb p\u00ebrdorimi i p\u00ebrbashk\u00ebt i komponent\u00ebve t\u00eb zakonsh\u00ebm t\u00eb harduerit dhe caches p\u00ebr llogaritjet n\u00eb TrustZone dhe n\u00eb sistemin kryesor \u2014 izolimi \u00ebsht\u00eb realizuar n\u00eb nivelin e ndarjes logjike, por duke p\u00ebrdorur blloqe t\u00eb p\u00ebrbashk\u00ebta llogarit\u00ebse dhe me mbetje t\u00eb gjetjeve t\u00eb llogaritjeve dhe informacionit mbi adresat e kalimeve n\u00eb cache-n e zakonsh\u00ebm t\u00eb procesorit. Me metod\u00ebn Prime+Probe, e cila bazohet n\u00eb vler\u00ebsimin e ndryshimit t\u00eb koh\u00ebs s\u00eb aksesit n\u00eb informacionin e mbajtur n\u00eb cache, mund t\u00eb ndjek\u00ebsh me sakt\u00ebsi t\u00eb mjaftueshme rrjedhat e t\u00eb dh\u00ebnave dhe shenjat e ekzekutimit t\u00eb kodit t\u00eb lidhur me llogaritjet e n\u00ebnshkrimeve dixhitale n\u00eb TrustZone. <\/p>\n

Shumica e koh\u00ebs s\u00eb formimit t\u00eb n\u00ebnshkrimit digjital duke p\u00ebrdorur \u00e7el\u00ebsat ECDSA n\u00eb \u00e7ipat Qualcomm shpenzohet p\u00ebr kryerjen e operacioneve t\u00eb shum\u00ebzimit n\u00eb cik\u00ebl duke p\u00ebrdorur nj\u00eb vektor inicializimi t\u00eb pandryshuesh\u00ebm p\u00ebr \u00e7do n\u00ebnshkrim (nonce<\/a><\/noindex>). N\u00ebse sulmuesi mund t\u00eb rikonstruktoj\u00eb edhe disa bita t\u00eb informacionit rreth k\u00ebtij vektori, krijohet mund\u00ebsia p\u00ebr t\u00eb kryer nj\u00eb sulm p\u00ebr rikuperimin e t\u00eb gjith\u00eb \u00e7el\u00ebsit t\u00eb mbyllur n\u00eb m\u00ebnyr\u00eb sekondar. <\/p>\n

N\u00eb rastin e Qualcomm, jan\u00eb identifikuar dy vende t\u00eb rrjedhjes s\u00eb till\u00eb informacioni n\u00eb algoritmin e shum\u00ebzimit: gjat\u00eb ekzekutimit t\u00eb operacioneve t\u00eb k\u00ebrkimit n\u00eb tabela dhe n\u00eb kodin e nxjerrjes s\u00eb kusht\u00ebzuar t\u00eb t\u00eb dh\u00ebnave bazuar n\u00eb vler\u00ebn e bitit t\u00eb fundit n\u00eb vektorin \u00abnonce\u00bb. Pavar\u00ebsisht nga prania n\u00eb kodin e Qualcomm t\u00eb masave p\u00ebr t\u00eb parandaluar rrjedhjen e informacionit p\u00ebrmes kanaleve t\u00eb tjera, metoda e zhvilluar e sulmit lejon t\u00eb anashkalohet k\u00ebto masa dhe t\u00eb p\u00ebrcaktohen disa bita t\u00eb vler\u00ebs \u00abnonce\u00bb, t\u00eb cilat jan\u00eb t\u00eb mjaftueshme p\u00ebr t\u00eb rikonstruktuar \u00e7el\u00ebsat ECDSA me 256 bit.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2018-11976) \u0432 \u0447\u0438\u043f\u0430\u0445 Qualcomm, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u0432 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0430\u043d\u043a\u043b\u0430\u0432\u0435 Qualcomm QSEE (Qualcomm Secure Execution Environment), \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ARM TrustZone. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 SoC Snapdragon, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0445 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0432 \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443, \u0443\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0432 \u0430\u043f\u0440\u0435\u043b\u044c\u0441\u043a\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-32375","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Ndjeshm\u00ebria n\u00eb \u00e7ipat Qualcomm, e cila lejon nxjerrjen e \u00e7el\u00ebsave t\u00eb mbyllur nga depoja TrustZone | ProHoster","description":"Hulumtuesit nga NCC Group zbuluan detajet e k\u00ebtij ndjeshm\u00ebrie.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0447\u0438\u043f\u0430\u0445 Qualcomm, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0438\u0437 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 TrustZone | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 NCC Group \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-chipah-qualcomm-pozvolyayushhaya-izvlech-zakrytye-klyuchi-iz-hranilishha-trustzone","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:46:40+00:00","article:modified_time":"2019-10-31T18:46:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32375","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 10:33:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:59:30","updated":"2026-01-21 10:33:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/32375","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=32375"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/32375\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=32375"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=32375"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=32375"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}