{"id":35134,"date":"2019-10-31T22:02:29","date_gmt":"2019-10-31T19:02:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimosti-v-hsm-modulyah-kotorye-mogut-privesti-k-atake-na-klyuchi-shifrovaniya\/"},"modified":"2019-10-31T22:02:29","modified_gmt":"2019-10-31T19:02:29","slug":"uyazvimosti-v-hsm-modulyah-kotorye-mogut-privesti-k-atake-na-klyuchi-shifrovaniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-hsm-modulyah-kotorye-mogut-privesti-k-atake-na-klyuchi-shifrovaniya","title":{"rendered":"Dob\u00ebsit\u00eb n\u00eb modulet HSM, t\u00eb cilat mund t\u00eb \u00e7ojn\u00eb n\u00eb sulme ndaj \u00e7el\u00ebsave t\u00eb enkriptimit.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nj\u00eb grup hulumtuesish nga kompania Ledger, e specializuar n\u00eb prodhimin e portofol\u00ebve t\u00eb harduerit p\u00ebr kriptovalutat, ka identifikuar<\/a><\/noindex> disa dob\u00ebsi n\u00eb pajisjet HSM (Module t\u00eb Siguris\u00eb s\u00eb Harduerit<\/a><\/noindex>), t\u00eb cilat mund t\u00eb p\u00ebrdoren p\u00ebr t\u00eb nxjerr\u00eb \u00e7el\u00ebsa ose p\u00ebr t\u00eb kryer nj\u00eb sulm t\u00eb larg\u00ebt p\u00ebr t\u00eb nd\u00ebrruar firmware-in e pajisjes HSM. Aktalisht, raporti p\u00ebr k\u00ebt\u00eb problem disponibel<\/noindex> \u00ebsht\u00eb vet\u00ebm n\u00eb fr\u00ebngjisht, nj\u00eb raport n\u00eb anglisht pritet t\u00eb publikohet<\/a><\/noindex> n\u00eb gusht gjat\u00eb konferenc\u00ebs Blackhat USA 2019. HSM \u00ebsht\u00eb nj\u00eb pajisje e jashtme e specializuar, e cila \u00ebsht\u00eb e destinuar p\u00ebr t\u00eb ruajtur \u00e7el\u00ebsat publik\u00eb dhe privat\u00eb, t\u00eb cilat p\u00ebrdoren p\u00ebr t\u00eb formuar n\u00ebnshkrime digjitale dhe p\u00ebr t\u00eb koduar t\u00eb dh\u00ebna. <\/p>\n

HSM lejon nj\u00eb rritje t\u00eb konsiderueshme t\u00eb siguris\u00eb, pasi izolon plot\u00ebsisht \u00e7el\u00ebsat nga sistemi dhe aplikacionet, duke ofruar vet\u00ebm nj\u00eb API p\u00ebr ekzekutimin e primitivave themelor\u00eb kriptografik\u00eb, t\u00eb realizuar n\u00eb an\u00ebn e pajisjes. Zakonisht, HSM p\u00ebrdoret n\u00eb fusha ku k\u00ebrkohet nj\u00eb siguri e lart\u00eb, si n\u00eb banka, bursa kripto, qendrat e besueshm\u00ebris\u00eb p\u00ebr verifikimin dhe gjenerimin e certifikatave dhe n\u00ebnshkrimeve digjitale.<\/p>\n

Metodat e propozuara t\u00eb sulmeve lejojn\u00eb nj\u00eb p\u00ebrdorues t\u00eb paautorizuar t\u00eb marr\u00eb kontroll t\u00eb plot\u00eb mbi p\u00ebrmbajtjen e HSM, duke p\u00ebrfshir\u00eb nxjerrjen e t\u00eb gjithave \u00e7el\u00ebsave dhe kredencialeve t\u00eb administratorit t\u00eb ruajtur n\u00eb pajisje. Problemet shkaktohen nga mbushja e buffers n\u00eb trajtuesin e brendsh\u00ebm t\u00eb komandave PKCS#11 dhe nj\u00eb gabim n\u00eb implementimin e mbrojtjes kriptografike t\u00eb firmware-t, i cili lejon t\u00eb anashkalohet verifikimi i firmware-t p\u00ebrmes n\u00ebnshkrimit dixhital PKCS#1v1.5 dhe t\u00eb inicohet ngarkimi n\u00eb HSM i firmware-t t\u00eb vet\u00eb. <\/p>\n

Si nj\u00eb demonstrim, u organizua ngarkimi i firmware-t t\u00eb modifikuar, n\u00eb t\u00eb cilin u shtua nj\u00eb backdoor, q\u00eb mbetet aktiv pas instalimeve t\u00eb m\u00ebvonshme t\u00eb p\u00ebrdit\u00ebsimeve t\u00eb zakonshme t\u00eb firmware-t nga prodhuesi. K\u00ebtu pretendohet se sulmi mund t\u00eb kryhet n\u00eb distanc\u00eb (metoda e sulmit nuk specifikohet, por me shum\u00eb gjasa \u00ebsht\u00eb e lidhur me nj\u00eb z\u00ebvend\u00ebsim t\u00eb firmware-t q\u00eb ngarkohet ose me transferimin p\u00ebr p\u00ebrpunim t\u00eb certifikatave t\u00eb dizajnuara posa\u00e7\u00ebrisht).<\/p>\n

Problemi u identifikua gjat\u00eb testeve fuzzing t\u00eb implementimeve t\u00eb brendshme t\u00eb komandave PKCS#11 n\u00eb HSM. Testimi u organizua p\u00ebrmes ngarkimit t\u00eb modulit n\u00eb HSM duke p\u00ebrdorur SDL standard. Si rezultat, u zbulua nj\u00eb mbingarkes\u00eb buferi n\u00eb implementimin e PKCS#11, e cila mund t\u00eb shfryt\u00ebzohej jo vet\u00ebm nga mjedisi i brendsh\u00ebm HSM, por edhe p\u00ebrmes thirrjes s\u00eb drejtorit PKCS#11 nga sistemi operativ kryesor t\u00eb kompjuterit, t\u00eb cilit i \u00ebsht\u00eb lidhur moduli HSM. <\/p>\n

M\u00eb pas, mbingarkesa e buferit u shfryt\u00ebzua p\u00ebr t\u00eb ekzekutuar kod n\u00eb an\u00ebn e HSM dhe p\u00ebr t\u00eb rinovuar parametrat e aksesit. Gjat\u00eb studimit t\u00eb p\u00ebrb\u00ebrjes, u identifikua edhe nj\u00eb tjet\u00ebr dob\u00ebsi, q\u00eb lejon ngarkimin e nj\u00eb versioni t\u00eb ri t\u00eb firmware pa n\u00ebnshkrimin digjital. N\u00eb fund, u shkrua dhe u ngarkua n\u00eb HSM nj\u00eb modul i ri, i cili heq t\u00eb gjitha sekretet e ruajtura n\u00eb HSM.<\/p>\n

Emri i prodhuesit t\u00eb pajisjeve HSM, t\u00eb cilat kan\u00eb zbuluar dob\u00ebsi, nuk \u00ebsht\u00eb b\u00ebr\u00eb publik ende, por thuhet se pajisjet problematike po p\u00ebrdoren nga disa banka t\u00eb m\u00ebdha dhe ofrues t\u00eb sh\u00ebrbimeve n\u00eb re. Nd\u00ebrkoh\u00eb, raportet tregojn\u00eb se informacioni p\u00ebr problemet ishte d\u00ebrguar m\u00eb par\u00eb te prodhuesi dhe ai tashm\u00eb i ka eliminuar dob\u00ebsit\u00eb n\u00eb p\u00ebrdit\u00ebsimin e fundit t\u00eb firmware-it. K\u00ebrkues t\u00eb pavarur sugjerojn\u00eb se problemi mund t\u00eb jet\u00eb n\u00eb pajisjet e kompanis\u00eb Gemalto, e cila n\u00eb maj l\u00ebshoi<\/a><\/noindex> p\u00ebrdit\u00ebsimi i Sentinel LDK me eliminimin e dob\u00ebsive, hyrja n\u00eb informacion p\u00ebr t\u00eb cilat \u00ebsht\u00eb ende e mbyllur<\/a><\/noindex>.<\/p>\n<\/ul>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Ledger, \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u043a\u043e\u0448\u0435\u043b\u044c\u043a\u0438 \u0434\u043b\u044f \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b, \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 HSM (Hardware Security Module), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u043a\u043b\u044e\u0447\u0435\u0439 \u0438\u043b\u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 HSM-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0434\u043e\u043a\u043b\u0430\u0434 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0444\u0440\u0430\u043d\u0446\u0443\u0437\u0441\u043a\u043e\u043c \u044f\u0437\u044b\u043a\u0435, \u0430\u043d\u0433\u043b\u043e\u044f\u0437\u044b\u0447\u043d\u044b\u0439 \u0434\u043e\u043a\u043b\u0430\u0434 \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Blackhat […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35134","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsit\u00eb n\u00eb modulat HSM, q\u00eb mund t\u00eb \u00e7ojn\u00eb n\u00eb sulm ndaj \u00e7el\u00ebsave t\u00eb enkriptimit | ProHoster","description":"Nj\u00eb grup k\u00ebrkuesish nga kompania Ledger, e cila prodhon porta harduerike p\u00ebr kriptovaluta, ka zbuluar disa dob\u00ebsi n\u00eb pajisjet HSM (Hardware Security Module), t\u00eb cilat mund t\u00eb p\u00ebrdoren p\u00ebr t\u00eb nxjerr\u00eb \u00e7el\u00ebsat ose p\u00ebr t\u00eb kryer nj\u00eb sulm t\u00eb larg\u00ebt p\u00ebr t\u00eb z\u00ebvend\u00ebsuar firmware-in e pajisjes HSM. Aktualisht, raporti mbi problemin \u00ebsht\u00eb i disponuesh\u00ebm vet\u00ebm n\u00eb fr\u00ebngjisht, nd\u00ebrsa raporti n\u00eb anglisht pritet t\u00eb publikohet n\u00eb gusht gjat\u00eb konferenc\u00ebs Blackhat.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-hsm-modulyah-kotorye-mogut-privesti-k-atake-na-klyuchi-shifrovaniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 HSM-\u043c\u043e\u0434\u0443\u043b\u044f\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u043a\u043b\u044e\u0447\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Ledger, \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u043a\u043e\u0448\u0435\u043b\u044c\u043a\u0438 \u0434\u043b\u044f \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b, \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 HSM (Hardware Security Module), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u043a\u043b\u044e\u0447\u0435\u0439 \u0438\u043b\u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 HSM-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0434\u043e\u043a\u043b\u0430\u0434 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0444\u0440\u0430\u043d\u0446\u0443\u0437\u0441\u043a\u043e\u043c \u044f\u0437\u044b\u043a\u0435, \u0430\u043d\u0433\u043b\u043e\u044f\u0437\u044b\u0447\u043d\u044b\u0439 \u0434\u043e\u043a\u043b\u0430\u0434 \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Blackhat","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-hsm-modulyah-kotorye-mogut-privesti-k-atake-na-klyuchi-shifrovaniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:02:29+00:00","article:modified_time":"2019-10-31T19:02:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35134","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 21:59:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:09:54","updated":"2026-01-21 21:59:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/35134","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=35134"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/35134\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=35134"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=35134"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=35134"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}