{"id":35134,"date":"2019-10-31T22:02:29","date_gmt":"2019-10-31T19:02:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimosti-v-hsm-modulyah-kotorye-mogut-privesti-k-atake-na-klyuchi-shifrovaniya\/"},"modified":"2019-10-31T22:02:29","modified_gmt":"2019-10-31T19:02:29","slug":"uyazvimosti-v-hsm-modulyah-kotorye-mogut-privesti-k-atake-na-klyuchi-shifrovaniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-hsm-modulyah-kotorye-mogut-privesti-k-atake-na-klyuchi-shifrovaniya","title":{"rendered":"Dob\u00ebsi n\u00eb modulet HSM q\u00eb mund t\u00eb \u00e7ojn\u00eb n\u00eb sulme ndaj \u00e7el\u00ebsave t\u00eb enkriptimit","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nj\u00eb grup studiuesish nga kompania Ledger, e cila prodhon kuleta harduerike p\u00ebr kriptovaluta, identifikoi<\/a><\/noindex> ka zbuluar disa dob\u00ebsi n\u00eb pajisjet HSM (Hardware Security Module<\/a><\/noindex>), t\u00eb cilat mund t\u00eb p\u00ebrdoren p\u00ebr t\u00eb nxjerr\u00eb \u00e7el\u00ebsa ose p\u00ebr t\u00eb kryer nj\u00eb sulm n\u00eb distanc\u00eb p\u00ebr z\u00ebvend\u00ebsimin e firmware-it t\u00eb pajisjes HSM. Aktualisht, raporti p\u00ebr problemin \u00ebsht\u00eb i disponuesh\u00ebm \u00ebsht\u00eb n\u00eb dispozicion<\/noindex> vet\u00ebm n\u00eb fr\u00ebngjisht, nd\u00ebrsa versioni n\u00eb anglisht planifikohet t\u00eb publikohet<\/a><\/noindex> n\u00eb gusht gjat\u00eb konferenc\u00ebs Blackhat USA 2019. HSM \u00ebsht\u00eb nj\u00eb pajisje e jashtme e specializuar, e projektuar p\u00ebr ruajtjen e \u00e7el\u00ebsave publik\u00eb dhe privat\u00eb q\u00eb p\u00ebrdoren p\u00ebr krijimin e n\u00ebnshkrimeve dixhitale dhe p\u00ebr enkriptimin e t\u00eb dh\u00ebnave. <\/p>\n

HSM e rrit ndjesh\u00ebm mbrojtjen, pasi i izolon plot\u00ebsisht \u00e7el\u00ebsat nga sistemi dhe aplikacionet, duke ofruar vet\u00ebm API p\u00ebr ekzekutimin e primitiveve baz\u00eb kriptografike t\u00eb realizuara n\u00eb an\u00ebn e pajisjes. Zakonisht, HSM p\u00ebrdoret n\u00eb fusha ku k\u00ebrkohet niveli m\u00eb i lart\u00eb i siguris\u00eb, p\u00ebr shembull n\u00eb banka, bursa kriptovalutash, autoritete certifikuese p\u00ebr verifikimin dhe gjenerimin e certifikatave dhe n\u00ebnshkrimeve dixhitale.<\/p>\n

Metodat e propozuara t\u00eb sulmit i lejojn\u00eb nj\u00eb p\u00ebrdoruesi t\u00eb paautentikuar t\u00eb marr\u00eb kontroll t\u00eb plot\u00eb mbi p\u00ebrmbajtjen e HSM-s\u00eb, p\u00ebrfshir\u00eb nxjerrjen e t\u00eb gjith\u00eb \u00e7el\u00ebsave kriptografik\u00eb dhe kredencialeve t\u00eb administratorit t\u00eb ruajtura n\u00eb pajisje. Problemet shkaktohen nga tejmbushja e buffer-it n\u00eb p\u00ebrpunuesin e brendsh\u00ebm t\u00eb komandave PKCS#11 dhe nga nj\u00eb gabim n\u00eb zbatimin e mbrojtjes kriptografike t\u00eb firmware-it, q\u00eb mund\u00ebson anashkalimin e verifikimit t\u00eb firmware-it me n\u00ebnshkrimin dixhital PKCS#1v1.5 dhe nisjen e ngarkimit t\u00eb nj\u00eb firmware-i t\u00eb personalizuar n\u00eb HSM. <\/p>\n

Si demonstrim, u organizua ngarkimi i nj\u00eb firmware-i t\u00eb modifikuar, ku ishte shtuar nj\u00eb backdoor q\u00eb mbetet aktiv edhe pas instalimeve t\u00eb m\u00ebvonshme t\u00eb p\u00ebrdit\u00ebsimeve zyrtare t\u00eb firmware-it nga prodhuesi. Pretendohet se sulmi mund t\u00eb kryhet n\u00eb distanc\u00eb (metoda e sulmit nuk specifikohet, por me gjas\u00eb b\u00ebhet fjal\u00eb p\u00ebr z\u00ebvend\u00ebsimin e firmware-it q\u00eb ngarkohet ose p\u00ebr d\u00ebrgimin p\u00ebr p\u00ebrpunim t\u00eb certifikatave t\u00eb formatuara posa\u00e7\u00ebrisht).<\/p>\n

Problemi u zbulua gjat\u00eb p\u00ebrdorimit t\u00eb testimit fuzzing mbi implementimin e brendsh\u00ebm t\u00eb komandave PKCS#11 t\u00eb ofruar n\u00eb HSM. Testimi u organizua duke ngarkuar modulin e tyre n\u00eb HSM p\u00ebrmes SDL standard. Si rezultat, n\u00eb implementimin PKCS#11 u zbulua nj\u00eb tejmbushje buffer-i, e cila mund t\u00eb shfryt\u00ebzohej jo vet\u00ebm nga mjedisi i brendsh\u00ebm i HSM, por edhe p\u00ebrmes qasjes te driveri PKCS#11 nga sistemi operativ kryesor i kompjuterit me t\u00eb cilin \u00ebsht\u00eb lidhur moduli HSM. <\/p>\n

M\u00eb pas, tejmbushja e buffer-it u shfryt\u00ebzua p\u00ebr ekzekutimin e kodit n\u00eb an\u00ebn e HSM dhe p\u00ebr rip\u00ebrcaktimin e parametrave t\u00eb aksesit. Gjat\u00eb analiz\u00ebs s\u00eb p\u00ebrb\u00ebrjes s\u00eb brendshme u zbulua edhe nj\u00eb cenueshm\u00ebri tjet\u00ebr, q\u00eb lejon ngarkimin e firmware-it t\u00eb ri pa n\u00ebnshkrim digjital. N\u00eb fund, u zhvillua dhe u ngarkua n\u00eb HSM nj\u00eb modul i posa\u00e7\u00ebm, i cili nxjerr jasht\u00eb t\u00eb gjitha sekretet e ruajtura n\u00eb HSM.<\/p>\n

Emri i prodhuesit, n\u00eb pajisjet HSM t\u00eb t\u00eb cilit jan\u00eb zbuluar cenueshm\u00ebrit\u00eb, ende nuk b\u00ebhet publik, por thuhet se pajisjet problematike p\u00ebrdoren nga disa banka t\u00eb m\u00ebdha dhe ofrues t\u00eb sh\u00ebrbimeve cloud. Gjithashtu raportohet se informacioni p\u00ebr problemet i ishte d\u00ebrguar m\u00eb her\u00ebt prodhuesit dhe ai i ka korrigjuar tashm\u00eb cenueshm\u00ebrit\u00eb n\u00eb nj\u00eb p\u00ebrdit\u00ebsim t\u00eb ri t\u00eb firmware-it. Studiues t\u00eb pavarur supozojn\u00eb se problemi mund t\u00eb jet\u00eb te pajisjet e kompanis\u00eb Gemalto, e cila n\u00eb maj ka lan\u00e7uar<\/a><\/noindex> p\u00ebrdit\u00ebsimin Sentinel LDK me korrigjimin e cenueshm\u00ebrive, qasja n\u00eb informacionin p\u00ebr t\u00eb cilat p\u00ebr momentin \u00ebsht\u00eb e mbyllur<\/a><\/noindex>.<\/p>\n<\/ul>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Ledger, \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u043a\u043e\u0448\u0435\u043b\u044c\u043a\u0438 \u0434\u043b\u044f \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b, \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 HSM (Hardware Security Module), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u043a\u043b\u044e\u0447\u0435\u0439 \u0438\u043b\u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 HSM-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0434\u043e\u043a\u043b\u0430\u0434 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0444\u0440\u0430\u043d\u0446\u0443\u0437\u0441\u043a\u043e\u043c \u044f\u0437\u044b\u043a\u0435, \u0430\u043d\u0433\u043b\u043e\u044f\u0437\u044b\u0447\u043d\u044b\u0439 \u0434\u043e\u043a\u043b\u0430\u0434 \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Blackhat […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35134","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cenueshm\u00ebri n\u00eb modulet HSM q\u00eb mund t\u00eb \u00e7ojn\u00eb n\u00eb sulm ndaj \u00e7el\u00ebsave t\u00eb enkriptimit | ProHoster","description":"Nj\u00eb grup studiuesish nga kompania Ledger, e cila prodhon kuleta harduerike p\u00ebr kriptovaluta, zbuloi disa.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-hsm-modulyah-kotorye-mogut-privesti-k-atake-na-klyuchi-shifrovaniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 HSM-\u043c\u043e\u0434\u0443\u043b\u044f\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u043a\u043b\u044e\u0447\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Ledger, \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u043a\u043e\u0448\u0435\u043b\u044c\u043a\u0438 \u0434\u043b\u044f \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b, \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-hsm-modulyah-kotorye-mogut-privesti-k-atake-na-klyuchi-shifrovaniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:02:29+00:00","article:modified_time":"2019-10-31T19:02:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35134","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 21:59:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:09:54","updated":"2026-01-21 21:59:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/35134","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=35134"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/35134\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=35134"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=35134"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=35134"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}