ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ืŸ Qualcomm ื˜ืฉื™ืคึผืก ื•ื•ืึธืก ืึทืœืึทื•ื– ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœืขืŸ ืฆื• ื–ื™ื™ืŸ ื™ืงืกื˜ืจืึทืงื˜ื™ื“ ืคื•ืŸ TrustZone ืกื˜ืึธืจื™ื“ื–ืฉ

ืจืขืกืขืึทืจื˜ืฉืขืจืก ืคื•ืŸ NCC ื’ืจื•ืคืข ืึทื ื˜ื“ืขืงื˜ ื“ื™ ืคืจื˜ื™ื ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื– (CVE-2018-11976) ืื™ืŸ Qualcomm ื˜ืฉื™ืคึผืก, ื•ื•ืึธืก ืึทืœืึทื•ื– ืื™ืจ ืฆื• ื‘ืึทืฉืœื™ืกืŸ ื“ื™ ืื™ื ื”ืึทืœื˜ ืคื•ืŸ ืคึผืจื™ื•ื•ืึทื˜ ืขื ืงืจื™ืคึผืฉืึทืŸ ืฉืœื™ืกืœืขืŸ ืื™ืŸ ืึทืŸ ืืคื’ืขื–ื•ื ื“ืขืจื˜ ืขื ืงืœืึทื•ื•ืข Qualcomm QSEE (Qualcomm Secure Execution Environment), ื‘ืื–ื™ืจื˜ ืื•ื™ืฃ ARM TrustZone ื˜ืขื›ื ืึธืœืึธื’ื™ืข. ื“ื™ ืคึผืจืึธื‘ืœืขื ืžืึทื ืึทืคืขืกืฅ ื–ื™ืš ืื™ืŸ ืžืขืจืกื˜ Snapdragon SoC, ื•ื•ืึธืก ืื™ื– ื’ืขื•ื•ืืจืŸ ื•ื•ื™ื™ื“ืกืคึผืจืขื“ ืื™ืŸ ืกืžืึทืจื˜ืคืึธื ืขืก ื‘ืื–ื™ืจื˜ ืื•ื™ืฃ ื“ื™ ืึทื ื“ืจื•ื™ื“ ืคึผืœืึทื˜ืคืึธืจืžืข. ื“ื™ ืคื™ืงืกื™ื– ื•ื•ืึธืก ืคืึทืจืจื™ื›ื˜ืŸ ื“ืขื ืคึผืจืึธื‘ืœืขื ื–ืขื ืขืŸ ืฉื•ื™ืŸ ืึทืจื™ื™ึทื ื’ืขืจืขื›ื ื˜ ืื™ืŸ ืืคืจื™ืœ ืึทื ื“ืจื•ื™ื“ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงืŸ ืื•ืŸ ื ื™ื™ึท ืคื™ืจืžื•ื•ืึทืจืข ืจื™ืœื™ืกื™ื– ืคึฟืึทืจ Qualcomm ื˜ืฉื™ืคึผืก. ืขืก ื”ืึธื˜ ื’ืขื ื•ืžืขืŸ Qualcomm ืžืขืจ ื•ื•ื™ ืึท ื™ืึธืจ ืฆื• ืฆื•ื’ืจื™ื™ื˜ืŸ ืึท ืคืึทืจืจื™ื›ื˜ืŸ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ื– ื˜ื›ื™ืœืขืก ื’ืขืฉื™ืงื˜ ืฆื• Qualcomm ืื•ื™ืฃ 19 ืžืขืจืฅ 2018.

ืœืึธืžื™ืจ ืฆื•ืจื™ืงืจื•ืคืŸ ืึทื– ARM TrustZone ื˜ืขื›ื ืึธืœืึธื’ื™ืข ืึทืœืึทื•ื– ืื™ืจ ืฆื• ืฉืึทืคึฟืŸ ื™ื™ึทื–ื ื•ื•ืึทืจื’-ืืคื’ืขื–ื•ื ื“ืขืจื˜ ืคึผืจืึธื˜ืขืงื˜ืขื“ ื™ื ื•ื•ื™ื™ืจืึทื ืžืึทื ืฅ ื•ื•ืึธืก ื–ืขื ืขืŸ ื’ืึธืจ ืืคื’ืขืฉื™ื™ื“ื˜ ืคื•ืŸ ื“ื™ ื”ื•ื™ืคึผื˜ ืกื™ืกื˜ืขื ืื•ืŸ ืœื•ื™ืคืŸ ืื•ื™ืฃ ืึท ื‘ืึทื–ื•ื ื“ืขืจ ื•ื•ื™ืจื˜ื•ืึทืœ ืคึผืจืึทืกืขืกืขืจ ื ื™ืฆืŸ ืึท ื‘ืึทื–ื•ื ื“ืขืจ ืกืคึผืขืฉืึทืœื™ื™ื–ื“ ืึธืคึผืขืจื™ื™ื˜ื™ื ื’ ืกื™ืกื˜ืขื. ื“ืขืจ ื”ื•ื™ืคึผื˜ ืฆื™ืœ ืคื•ืŸ TrustZone ืื™ื– ืฆื• ืฆื•ืฉื˜ืขืœืŸ ืืคื’ืขื–ื•ื ื“ืขืจื˜ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืคื•ืŸ ืคึผืจืึทืกืขืกืขืจื– ืคึฟืึทืจ ืขื ืงืจื™ืคึผืฉืึทืŸ ืฉืœื™ืกืœืขืŸ, ื‘ื™ืึธืžืขื˜ืจื™ืง ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ, ืฆืึธืœื•ื ื’ ื“ืึทื˜ืŸ ืื•ืŸ ืื ื“ืขืจืข ืงืึทื ืคืึทื“ืขื ืฉืึทืœ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข. ื™ื ื˜ืขืจืึทืงืฉืึทืŸ ืžื™ื˜ ื“ื™ ื”ื•ื™ืคึผื˜ ืึทืก ืื™ื– ื“ื•ืจื›ื’ืขืงืึธื›ื˜ ืžื™ื ืึทืฆืึทื“ ื“ื•ืจืš ื“ื™ ื“ืขืคึผืขืฉ ืฆื•ื‘ื™ื ื“. ืคึผืจื™ื•ื•ืึทื˜ ืขื ืงืจื™ืคึผืฉืึทืŸ ืฉืœื™ืกืœืขืŸ ื–ืขื ืขืŸ ืกื˜ืึธืจื“ ืื™ืŸ ืึท ื™ื™ึทื–ื ื•ื•ืึทืจื’-ืืคื’ืขื–ื•ื ื“ืขืจื˜ ืฉืœื™ืกืœ ืงืจืึธื, ื•ื•ืึธืก, ืื•ื™ื‘ ื™ืžืคึผืœืึทืžืขื ืึทื“ ืจืขื›ื˜, ืงืขื ืขืŸ ืคืึทืจืžื™ื™ึทื“ืŸ ื–ื™ื™ืขืจ ืœื™ืงืึทื“ื–ืฉ ืื•ื™ื‘ ื“ื™ ืึทื ื“ืขืจืœื™ื™ื™ื ื’ ืกื™ืกื˜ืขื ืื™ื– ืงืึทืžืคึผืจืึทืžื™ื™ื–ื“.

ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ื– ืจืขื›ื˜ ืฆื• ืึท ืคืœืึธ ืื™ืŸ ื“ื™ ื™ืžืคึผืœืึทืžืขื ื˜ื™ื™ืฉืึทืŸ ืคื•ืŸ ื“ื™ ื™ืœื™ืคึผื˜ื™ืง ื•ื™ืกื‘ื™ื™ื’ ืคึผืจืึทืกืขืกื™ื ื’ ืึทืœื’ืขืจื™ื“ืึทื, ื•ื•ืึธืก ื’ืขืคึฟื™ืจื˜ ืฆื• ืœื™ืงืึทื“ื–ืฉ ืคื•ืŸ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ื“ื™ ืคึผืจืึธื’ืจืขืก ืคื•ืŸ ื“ืึทื˜ืŸ ืคึผืจืึทืกืขืกื™ื ื’. ืจืขืกืขืึทืจื˜ืฉืขืจืก ื”ืึธื‘ืŸ ื“ืขื•ื•ืขืœืึธืคึผืขื“ ืึท ื–ื™ื™ึทื˜-ืงืึทื ืึทืœ ื‘ืึทืคืึทืœืŸ ื˜ืขื›ื ื™ืง ื•ื•ืึธืก ืึทืœืึทื•ื– ื ื™ืฆืŸ ื™ื’ื–ื™ืกื˜ื™ื ื’ ื•ืžื“ื™ืจืขืงื˜ ืœื™ืงืก ืฆื• ืฆื•ืจื™ืงืงืจื™ื’ืŸ ื“ื™ ืื™ื ื”ืึทืœื˜ ืคื•ืŸ ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœืขืŸ ืœื™ื’ืŸ ืื™ืŸ ืึท ื™ื™ึทื–ื ื•ื•ืึทืจื’-ืืคื’ืขื–ื•ื ื“ืขืจื˜. ืึทื ื“ืจื•ื™ื“ ืงื™ื™ืกื˜ืึธืจืข. ืœื™ืงืก ื–ืขื ืขืŸ ื‘ืืฉืœืืกืŸ ื‘ืื–ื™ืจื˜ ืื•ื™ืฃ ืึทื ืึทืœื™ืกื™ืก ืคื•ืŸ ื“ื™ ื˜ืขื˜ื™ืงื™ื™ื˜ ืคื•ืŸ ื“ื™ ืฆื•ื•ื™ื™ึทื’ ืคึผืจืึธื’ื ืึธื– ื‘ืœืึธืง ืื•ืŸ ืขื ื“ืขืจื•ื ื’ืขืŸ ืื™ืŸ ื“ื™ ืึทืงืกืขืก ืฆื™ื™ื˜ ืฆื• ื“ืึทื˜ืŸ ืื™ืŸ ื–ื›ึผืจื•ืŸ. ืื™ืŸ ื“ืขืจ ืขืงืกืคึผืขืจื™ืžืขื ื˜, ื“ื™ ืจื™ืกืขืจื˜ืฉืขืจื– ื”ืฆืœื—ื” ื“ืขืžืึทื ืกื˜ืจื™ื™ื˜ื™ื“ ื“ื™ ืึธืคึผื–ื•ืš ืคื•ืŸ 224- ืื•ืŸ 256-ื‘ื™ืกืœ ECDSA ืฉืœื™ืกืœืขืŸ ืคื•ืŸ ื“ื™ ื™ื™ึทื–ื ื•ื•ืึทืจื’-ืืคื’ืขื–ื•ื ื“ืขืจื˜ ืฉืœื™ืกืœ ืงืจืึธื ื’ืขื ื™ืฆื˜ ืื™ืŸ ื“ื™ Nexus 5X ืกืžืึทืจื˜ืคืึธื ืข. ืฆื•ืจื™ืงืงืจื™ื’ืŸ ื“ืขื ืฉืœื™ืกืœ ืคืืจืœืื ื’ื˜ ืฆื• ื“ื–ืฉืขื ืขืจื™ื™ื˜ ื•ื•ืขื’ืŸ 12 ื˜ื•ื™ื–ื ื˜ ื“ื™ื’ื™ื˜ืึทืœ ืกื™ื’ื ืึทื˜ืฉืขืจื–, ื•ื•ืึธืก ื’ืขื ื•ืžืขืŸ ืžืขืจ ื•ื•ื™ 14 ืฉืขื”. ืžื›ืฉื™ืจื™ื ื’ืขื ื™ืฆื˜ ืฆื• ื“ื•ืจื›ืคื™ืจืŸ ื“ื™ ื‘ืึทืคืึทืœืŸ ืงืึทื˜ืฉืขื’ืจืึทื‘.

ื“ื™ ื”ื•ื™ืคึผื˜ ื’ืจื•ื ื˜ ืคื•ืŸ ื“ืขื ืคึผืจืึธื‘ืœืขื ืื™ื– ื“ื™ ื™ื™ึทื ื˜ื™ื™ืœื•ื ื’ ืคื•ืŸ ืคึผืจืึธืกื˜ ื™ื™ึทื–ื ื•ื•ืึทืจื’ ืงืึทืžืคึผืึธื•ื ืึทื ืฅ ืื•ืŸ ืงืึทืฉ ืคึฟืึทืจ ื—ืฉื‘ื•ื ื•ืช ืื™ืŸ ื“ื™ TrustZone ืื•ืŸ ืื™ืŸ ื“ื™ ื”ื•ื™ืคึผื˜ ืกื™ืกื˜ืขื - ืืคื’ืขื–ื•ื ื“ืขืจื˜ืงื™ื™ื˜ ืื™ื– ื“ื•ืจื›ื’ืขืงืึธื›ื˜ ืื•ื™ืฃ ื“ืขืจ ืžื“ืจื’ื” ืคื•ืŸ ืœืึทื“ื–ืฉื™ืงืึทืœ ืฆืขืฉื™ื™ื“ื•ื ื’, ืึธื‘ืขืจ ืžื™ื˜ ืคึผืจืึธืกื˜ ืงืึทืžืคึผื™ื•ื˜ื™ื ื’ ื•ื ื™ืฅ ืื•ืŸ ืžื™ื˜ ื˜ืจืึทืกืขืก ืคื•ืŸ ื—ืฉื‘ื•ื ื•ืช ืื•ืŸ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ืฆื•ื•ื™ื™ึทื’. ื•ื•ืขื ื“ื˜ ื–ืขื ืขืŸ ื“ืึทืคึผืึทื–ื™ื˜ื™ื“ ืื™ืŸ ื“ืขืจ ืคึผืจืึธืกื˜ ืคึผืจืึทืกืขืกืขืจ ืงืึทืฉ. ื ื™ืฆืŸ ื“ื™ Prime + Probe ืื•ืคึฟืŸ, ื‘ืื–ื™ืจื˜ ืื•ื™ืฃ ืึทืกืกืขืกืกื™ื ื’ ืขื ื“ืขืจื•ื ื’ืขืŸ ืื™ืŸ ืึทืงืกืขืก ืฆื™ื™ื˜ ืฆื• ืงืึทืฉื˜ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข, ืขืก ืื™ื– ืžืขื’ืœืขืš, ื“ื•ืจืš ืงืึธื ื˜ืจืึธืœื™ืจืŸ ื“ื™ ื‘ื™ื™ึทื–ื™ื™ึทืŸ ืคื•ืŸ ื–ื™ื›ืขืจ ืคึผืึทื˜ืขืจื ื– ืื™ืŸ ื“ื™ ืงืึทืฉ, ืฆื• ืžืึธื ื™ื˜ืึธืจ ื“ืึทื˜ืŸ ืคืœืึธื•ื– ืื•ืŸ ื•ื•ืื•ื ื“ืขืจ ืคื•ืŸ ืงืึธื“ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืคึฟืึทืจื‘ื•ื ื“ืŸ ืžื™ื˜ ื“ื™ ื—ืฉื‘ื•ื ื•ืช ืคื•ืŸ ื“ื™ื’ื™ื˜ืึทืœ ืกื™ื’ื ืึทื˜ืฉืขืจื–. TrustZone ืžื™ื˜ ืคืขืจืœื™ ื”ื•ื™ืš ืึทืงื™ืขืจืึทืกื™.

ืจื•ื‘ึฟ ืคื•ืŸ ื“ื™ ืฆื™ื™ื˜ ืฆื• ื“ื–ืฉืขื ืขืจื™ื™ื˜ ืึท ื“ื™ื’ื™ื˜ืึทืœ ื›ืกื™ืžืข ื ื™ืฆืŸ ECDSA ืฉืœื™ืกืœืขืŸ ืื™ืŸ Qualcomm ื˜ืฉื™ืคึผืก ืื™ื– ืคืืจื‘ืจืื›ื˜ ืฆื• ื“ื•ืจื›ืคื™ืจืŸ ืงื™ื™ืคืœ ืึทืคึผืขืจื™ื™ืฉืึทื ื– ืื™ืŸ ืึท ืฉืœื™ื™ืฃ ืžื™ื˜ ืึทืŸ ื™ื ื™ื˜ื™ืึทืœื™ื–ืึทื˜ื™ืึธืŸ ื•ื•ืขืงื˜ืึธืจ ื•ื•ืึธืก ืื™ื– ืึทื ื˜ืฉื™ื™ื ื“ื–ืฉื“ ืคึฟืึทืจ ื™ืขื“ืขืจ ื›ืกื™ืžืข (ื ื•ื ืกื™ืึธ). ืื•ื™ื‘ ื“ืขืจ ืึทื˜ืึทืงืขืจ ืงืขื ืขืŸ ืฆื•ืจื™ืงืงืจื™ื’ืŸ ืœืคึผื—ื•ืช ืึท ื‘ื™ืกืœ ื‘ื™ื˜ืŸ ืžื™ื˜ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ื“ืขื ื•ื•ืขืงื˜ืึธืจ, ืขืก ืื™ื– ืžืขื’ืœืขืš ืฆื• ื“ื•ืจื›ืคื™ืจืŸ ืึท ื‘ืึทืคืึทืœืŸ ืฆื• ืกืึทืงื•ื•ืขื ื˜ืฉืึทืœื™ ืฆื•ืจื™ืงืงืจื™ื’ืŸ ื“ื™ ื’ืื ืฆืข ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ.

ืื™ืŸ ื“ืขื ืคืึทืœ ืคื•ืŸ Qualcomm, ืฆื•ื•ื™ื™ ืขืจื˜ืขืจ ื•ื•ื• ืึทื–ืึท ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ืื™ื– ืœื™ืงื˜ ื–ืขื ืขืŸ ื™ื™ื“ืขื ืึทืคื™ื™ื“ ืื™ืŸ ื“ื™ ืงื™ื™ืคืœ ืึทืœื’ืขืจื™ื“ืึทื: ื•ื•ืขืŸ ืคึผืขืจืคืึธืจืžื™ื ื’ ืœื•ืงืึทืคึผ ืึทืคึผืขืจื™ื™ืฉืึทื ื– ืื™ืŸ ื˜ื™ืฉืŸ ืื•ืŸ ืื™ืŸ ื“ื™ ืงืึทื ื“ื™ืฉืึทื ืึทืœ ื“ืึทื˜ืŸ ืจื™ื˜ืจื™ื•ื•ืึทืœ ืงืึธื“ ื‘ืื–ื™ืจื˜ ืื•ื™ืฃ ื“ื™ ื•ื•ืขืจื˜ ืคื•ืŸ ื“ื™ ืœืขืฆื˜ืข ื‘ื™ืกืœ ืื™ืŸ ื“ื™ "ื ืึธื ืก" ื•ื•ืขืงื˜ืึธืจ. ื˜ืจืึธืฅ ื“ืขืจ ืคืึทืงื˜ ืึทื– Qualcomm ืงืึธื“ ื›ึผื•ืœืœ ืžื™ื˜ืœืขืŸ ืฆื• ืึทื ื˜ืงืขื’ื ืฉื˜ืขืœื  ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ืœื™ืงืก ื“ื•ืจืš ื“ืจื™ื˜-ืคึผืึทืจื˜ื™ื™ ื˜ืฉืึทื ืึทืœื–, ื“ื™ ื“ืขื•ื•ืขืœืึธืคึผืขื“ ืึทื˜ืึทืง ืื•ืคึฟืŸ ืึทืœืึทื•ื– ืื™ืจ ืฆื• ื‘ื™ื™ืคึผืึทืก ื“ื™ ืžื™ื˜ืœืขืŸ ืื•ืŸ ื‘ืึทืฉื˜ื™ืžืขืŸ ืขื˜ืœืขื›ืข ื‘ื™ื˜ืŸ ืคื•ืŸ ื“ื™ "ื ืึธื ืก" ื•ื•ืขืจื˜, ื•ื•ืึธืก ื–ืขื ืขืŸ ื’ืขื ื•ื’ ืฆื• ืฆื•ืจื™ืงืงืจื™ื’ืŸ 256-ื‘ื™ืกืœ ECDSA ืฉืœื™ืกืœืขืŸ.

ืžืงื•ืจ: opennet.ru

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’