Ranljivost vdelane programske opreme v čipih pomaga hekerjem prevzeti nadzor nad sistemi

Varnostno podjetje je odkrilo ranljivosti strojne opreme, ki lahko hekerjem omogočijo nadzor nad sistemi, če jih vdrejo.

Ranljivost, ki jo je razkril Binarly Research, omogoča napadalcu, da pridobi nadzor nad sistemom s spreminjanjem spremenljivke v obstojnem pomnilniku, ki trajno shranjuje podatke, tudi ko je sistem izklopljen.

Spremenjena spremenljivka bo ogrozila fazo varnega zagona sistema in napadalec lahko pridobi trajen dostop do ogroženih sistemov, ko je izkoriščanje na mestu, je dejal Alex Matrosov, ustanovitelj in izvršni direktor podjetja Binarly, ki ponuja odprtokodna orodja za odkrivanje ranljivosti vdelane programske opreme.

“Basically, the attacker can manipulate variables from the operating system level,” Matrosov said.

Ranljivost vdelane programske opreme odpira vrata

Varni zagon je sistem, nameščen v večini osebnih računalnikov in strežnikov, ki zagotavlja pravilen zagon naprav. Hekerji lahko prevzamejo nadzor nad sistemom, če je proces zagona zaobdan ali pod njihovim nadzorom.

Toda za manipulacijo spremenljivk bi uporabnik potreboval privilegiran dostop do sistema. Uporabniki bodo morda morali imeti skrbniški dostop do sistemov Linux ali Windows. Zlonamerna koda se izvede, preden se naloži operacijski sistem.

“The firmware piece is important because the attacker can gain very, very interesting persistence capabilities, so they can play for the long term on the device,” Matrosov said.

Ranljivost je, kot bi pustili odprta vrata - heker lahko pridobi dostop do sistemskih virov, ko in ko hoče, ko je sistem vklopljen, je dejal Matrosov.

Ranljivost je opazna, ker vpliva na procesorje, ki temeljijo na arhitekturi ARM, ki se uporabljajo v osebnih računalnikih, strežnikih in mobilnih napravah. Na čipih x86 so odkrili številne varnostne težave Intel in AMD, vendar je Matrosov opozoril, da je to razkritje zgodnji pokazatelj varnostnih napak, ki obstajajo v zasnovah čipov ARM.

Qualcomm opozarja na Snapdragon

The problem springs from a vulnerability affecting Qualcomm’s Snapdragon chipsets, which the podjetje za čipe razkrito 5. januarja.

Qualcomm’s Snapdragon chips are used in laptops and mobile devices. The vulnerabilities could affect a wide range of those devices using Unified Extensible Firmware Interface (UEFI) firmware with Snapdragon chips. A few devices, including PCs from Lenovo and Microsoft, have already been identified.

Lenovo v a varnostni bilten issued last week said that the vulnerability affected the BIOS of the ThinkPad X13s laptop, which is based on Qualcomm’s Snapdragon chipset. The company has issued a BIOS update to patch the vulnerability.

Microsoft’s Windows Dev Kit 2023, which is code-named Project Volterra, is also impacted by the vulnerability, Binarly said in a research note. Project Volterra is designed for programmers to write and test code for the Windows 11 operating system. Microsoft is using the Project Volterra device to lure conventional x86 Windows developers into the ARM software ecosystem, and the device’s release was a top announcement at Microsoft’s Build and ARM’s DevSummit conferences last year.

AMD pomeni, da so mobilne naprave ranljive

The Meltdown and Spectre vulnerabilities largely affected x86 chips in server and PC infrastructures. But the discovery of vulnerabilities in ARM’s boot layer is particularly concerning because the architecture is driving a low-power mobile ecosystem, which includes 5G smartphones and base stations. The base stations are increasingly at the center of communications for edge devices and cloud infrastructures. Attackers could behave like operators, and they will have persistence at base stations and nobody will know, Matrosov said.

Sistemski skrbniki morajo dati prednost popravkom napak v strojni programski opremi, tako da razumejo tveganje za svoje podjetje in ga hitro obravnavajo, je dejal.

“Not every company has policies to deliver firmware fixes to their devices. I have worked for large companies in the past, and before I started my own company, none of them — even these hardware-related companies — had an internal policy to update the firmware on employee laptops and devices. This is not right,” Matrosov said.

Razvijalci vdelane programske opreme morajo prav tako razviti miselnost, ki je na prvem mestu varnost, je dejal. Številni osebni računalniki se danes zaženejo na podlagi specifikacij, ki jih ponuja forum UEFI, ki ponuja kaveljčke za interakcijo med programsko in strojno opremo.

“We found that OpenSSL, which is used in UEFI firmware — it’s in the ARM version — is very outdated. As an example, one of the major TPM providers called Infineon, they use an eight-year-old OpenSSL version,” Matrosov said.

• Distribucija vsebine in PR s pomočjo SEO. Okrepite se še danes.
• Platoblockchain. Web3 Metaverse Intelligence. Razširjeno znanje. Dostopite tukaj.
• vir: https://www.darkreading.com/dr-tech/firmware-vulnerability-in-chips-helps-hackers-take-control-of-systems