'cpu'에 해당되는 글 10건

  1. 2018.01.05 CPU 칩셋 취약점 보안 업데이트
  2. 2013.12.20 Researchers crack the world’s toughest encryption by listening to the tiny sounds made by your computer’s CPU
  3. 2013.04.23 2013년 4월 Oracle Critical Patch Update
2018.01.05 14:12

CPU 칩셋 취약점 보안 업데이트

□ 개요
 o Google社 Project Zero는 Intel社, AMD社, ARM社 CPU 제품의 취약점을 발표[1]
 o 영향 받는 버전 사용자는 해결방안에 따라 최신버전으로 업데이트 권고
 
□ 내용
 o CPU의 부채널 공격(side channel attack)으로 인해 캐시 메모리의 저장된 정보가 노출되는 취약점
  - 스펙터(Spectre, CVE-2017-5753, CVE-2017-5715)
  - 멜트다운(Meltdown, CVE-2017-5754)
 
□ 해결 방안
  - 아래 칩셋 제조사 및 OS 개발사를 확인하여 최신 업데이트 적용
     ※ 최신 업데이트가 미 제공된 제품을 사용할 경우 패치 예정일을 확인하여 신속하게 패치하는 것을 권고

구분패치 현황배포 여부
Intel장비 제조사 및 OS 개발사를 통해 패치 권고 [2]배포중
AMD장비 제조사 및 OS 개발사를 통해 패치 권고 [3]배포중
ARM패치 버전 배포(’18.1.4) [4]배포중
Linux레드햇, 데비안 등 패치 버전 배포(’18.1.4) [5]배포중
윈도우(PC) Windows 7, 8.1, 10
(Server) 2008, 2008 R2, 2012, 2012 R2, 2016
대상 패치 배포(’18.1.4) [6]
배포중
MacOS,
iOS
멜트다운 취약점에 대한 패치버전 배포(’17.12.7)배포중
스펙터 취약점에 대한 패치버전 배포 예정 [7]배포예정
Android패치버전 배포 예정(’18.1.6) [8]배포예정
VMware패치버전 배포(’18.1.4) [9]배포중

 ※ 보안 패치 이후 시스템 성능의 영향을 미치는 이슈가 발생할 수 있으므로 설치 전 해당 제조사의 보안 공지 내용을 상세히
     검토하는 것이 필요
 
□ 용어설명
 o 부채널 공격(side channel attack) : 특수한 상황에서 처리 시간 차이의 특성을 이용한 공격 방식 중 하나

□ 기타 문의사항
 o 한국인터넷진흥원 인터넷침해대응센터: 국번없이 118
 
[참고사이트]
[1] https://googleprojectzero.blogspot.kr/2018/01/reading-privileged-memory-with-side.html
[2] https://newsroom.intel.com/news/intel-responds-to-security-research-findings/
[3] http://www.amd.com/en/corporate/speculative-execution
[4] https://developer.arm.com/support/security-update
[5] https://lkml.org/lkml/2017/12/4/709
[6] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002
[7] https://support.apple.com/en-us/HT208394
[8] https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html
[9] https://www.vmware.com/us/security/advisories/VMSA-2018-0002.html


Trackback 0 Comment 0
2013.12.20 19:33

Researchers crack the world’s toughest encryption by listening to the tiny sounds made by your computer’s CPU

Security researchers have successfully broken one of the most secure encryption algorithms, 4096-bit RSA, by listening – yes, with a microphone — to a computer as it decrypts some encrypted data. The attack is fairly simple and can be carried out with rudimentary hardware. The repercussions for the average computer user are minimal, but if you’re a secret agent, power user, or some other kind of encryption-using miscreant, you may want to reach for the Rammstein when decrypting your data.

This acoustic cryptanalysis, carried out by Daniel Genkin, Adi Shamir (who co-invented RSA), and Eran Tromer, uses what’s known as a side channel attack. A side channel is an attack vector that is non-direct and unconventional, and thus hasn’t been properly secured. For example, your pass code prevents me from directly attacking your phone — but if I could work out your pass code by looking at the greasy smudges on your screen, that would be a side channel attack. In this case, the security researchers listen to the high-pitched (10 to 150 KHz) sounds produced by your computer as it decrypts data.

This might sound crazy, but with the right hardware it’s actually not that hard. For a start, if you know exactly what frequency to listen out for, you can use low- and high-pass filters to ensure that you only have the sounds that emanate from your PC while the CPU decrypts data. (In case you were wondering, the acoustic signal is actually generated by the CPU’s voltage regulator, as it tries to maintain a constant voltage during wildly varied and bursty loads). Then, once you have the signal, it’s time for the hard bit: Actually making sense of it.

Here you can see the frequency spectrogram of various CPU instructions (down the right hand side)


Without going into too much detail, the researchers focused on a very specific encryption implementation: The GnuPG (an open/free version of PGP) 1.x implementation of the RSA cryptosystem. With some very clever cryptanalysis, the researchers were able to listen for telltale signs that the CPU was decrypting some data, and then listening to the following stream of sounds to divine the decryption key. The same attack would not work on different cryptosystems or different encryption software — they’d have to start back at the beginning and work out all of the tell-tale sounds from scratch.

The researchers successfully extracted decryption keys over a distance of four meters (13 feet) with a high-quality parabolic microphone. Perhaps more intriguingly, though, they also managed to pull of this attack with a smartphone placed 30 centimeters (12 inches) away from the target laptop. The researchers performed the attack on different laptops and desktops, with varying levels of success. For what it’s worth, the same kind of electrical data can also be divined from many other sources — the power socket on the wall, the remote end of an Ethernet cable, or merely by touching the computer (while measuring your body’s potential relative to the room’s ground potential).

In this light-weight setup, only the microphone (B) needs to be positioned correctly — everything else could be hidden away, for stealthy snooping


In terms of real-world repercussions, acoustic cryptanalysis is actually surprisingly dangerous. Imagine if you were decrypting some files in a library, coffee shop, or other public space — someone could obtain your decryption key just by placing their phone near your computer. Alternatively, an attacker could use spear phishing to put malware on yourphone that listens for the decryption key. With HTML5 and Flash able to access the microphone, it would be possible to build a website that listens for encryption keys too. The researchers propose one particularly nefarious scenario: Put a microphone into a co-located server, slot it into a rack in a data center, and then scoop up the encryption keys from hundreds of nearby servers.

If you want to keep your data secure, you only really have two viable options: Heavy-duty encryption, physical security, and ideally both at the same time. If an attacker can’t get physically close to your data, it instantly becomes much harder to steal it. As far as mitigating acoustic cryptanalysis attacks, you either implement physical security — keep your laptop in a sound-tight box, or never let anyone near your computer when you’re decrypting data — or you need to use a “sufficiently strong wide-band noise source.” Something like a swooping, large-orchestra classical concerto would probably do it.

Research paper:

acoustic-20131218.pdf



출처 : www.extremetech.com


Trackback 0 Comment 0
2013.04.23 18:07

2013년 4월 Oracle Critical Patch Update

개요

  • Oracle Critical Patch Update(CPU)는 Oracle사의 제품을 대상으로 다수의 보안 패치를 발표하는 주요 수단임
  • Oracle CPU 발표 이후, 관련 공격코드의 출현으로 인한 피해가 예상되는 바 Oracle 제품의 다중 취약점에 대한 패치를 권고함

 

설명

  • 2013년 4월 Oracle CPU에서는 Oracle 자사 제품의 보안취약점 128개에 대한 패치를 발표함
    • 원격 및 로컬 공격을 통하여 취약한 서버를 공격하는데 악용될 가능성이 있는 취약점을 포함하여 DB의 가용성 및 기밀성/무결성에 영향을 줄 수 있는 취약점 존재

 

영향받는 시스템

  • Oracle Database 11g Release 2, versions 11.2.0.2, 11.2.0.3 Database
  • Oracle Database 11g Release 1, version 11.1.0.7 Database
  • Oracle Database 10g Release 2, versions 10.2.0.4, 10.2.0.5 Database
  • Oracle Application Express, versions prior to 4.2.1 Database
  • Oracle Containers for J2EE, version 10.1.3.5 Fusion Middleware
  • Oracle COREid Access, version 10.1.4.3 Fusion Middleware
  • Oracle GoldenGate Veridata, version 3.0.0.11 Fusion Middleware
  • Oracle HTTP Server, versions 10.1.3.5.0, 11.1.1.5.0, 11.1.1.6.0 Fusion Middleware
  • Oracle JRockit, versions R27.7.4 and earlier, R28.2.6 and earlier Fusion Middleware
  • Oracle Outside In Technology, versions 8.3.7, 8.4.0 Fusion Middleware
  • Oracle WebCenter Capture, version 10.1.3.5.1 Fusion Middleware
  • Oracle WebCenter Content, versions 10.1.3.5.1, 11.1.1.6.0 Fusion Middleware
  • Oracle WebCenter Interaction, versions 6.5.1, 10.3.3.0 Fusion Middleware
  • Oracle WebCenter Sites, versions 7.6.2, 11.1.1.6.0, 11.1.1.6.1 Fusion Middleware
  • Oracle WebLogic Server, versions 10.0.2, 10.3.5, 10.3.6, 12.1.1 Fusion Middleware
  • Oracle Web Services Manager, version 11.1.1.6 Fusion Middleware
  • Oracle E-Business Suite Release 12i, versions 12.0.6, 12.1.1, 12.1.2, 12.1.3 E-Business Suite
  • Oracle E-Business Suite Release 11i, version 11.5.10.2 E-Business Suite
  • Oracle Agile EDM, versions 6.1.1.0, 6.1.2.0, 6.1.2.2 Supply Chain
  • Oracle Transportation Management, versions 5.5.05, 6.2 Supply Chain
  • Oracle PeopleSoft HRMS, version 9.1 PeopleSoft
  • Oracle PeopleSoft PeopleTools, versions 8.51, 8.52, 8.53 PeopleSoft
  • Oracle Siebel CRM, versions 8.1.1, 8.2.2 Siebel
  • Oracle Clinical Remote Data Capture Option, versions 4.6.0, 4.6.6 Health Sciences
  • Oracle Retail Central Office, versions 13.1, 13.2, 13.3, 13.4 Retail
  • Oracle Retail Integration Bus, versions 13.0, 13.1, 13.2 Retail
  • Oracle FLEXCUBE Direct Banking, versions 2.8.0 - 12.0.1 Oracle FLEXCUBE
  • Primavera P6 Enterprise Project Portfolio Management, versions 7.0, 8.1, 8.2 Primavera
  • Oracle and Sun Systems Product Suite Oracle and Sun Systems Product Suite
  • Oracle Sun Middleware Products Fusion Middleware
  • Oracle MySQL Server, versions 5.1, 5.5, 5.6 Oracle MySQL Product Suite
  • Oracle Automatic Service Request, versions prior to 4.3.2

       ※ 영향받는 시스템의 상세 정보는 참고사이트[1]를 참조

 

해결방안

  •  해결방안으로서 "Oracle Critical Patch Update Advisory - April 2013" 문서를 검토하고 벤더사 및 유지보수업체와 협의/검토 후 패치적용 요망[1]

 

[참고사이트]
[1] http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html


Trackback 0 Comment 0