Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/17/2017
04:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Factorization Bug Exposes Millions Of Crypto Keys To 'ROCA' Exploit

Products from Lenovo, HPE, Google, Microsoft, and others impacted by flaw in Infineon chipset.

The set of key reinstallation vulnerabilities disclosed Monday in the WPA2 protocol is actually the second disclosure in recent days to hammer home just how difficult it can be getting cryptography right.

Last week a team of security researchers from Masaryk University in the Czech Republic and other organizations disclosed a bug in a Trusted Platform Module (TPM) chipset from Infineon Technologies AG that some believe is worse than the KRACK WiFi flaws.

The factorization vulnerability gives attackers a way to recover the private half of any RSA encryption key generated by the chipset, using only the public key. Unlike the KRACK flaws, an attacker does not need to be close to a vulnerable device or have access to it, in order to exploit the flaw. Any RSA key generated by a vulnerable Infineon chipset is open to attack, the researchers said in an alert.

"It's a huge deal in terms of the integrity of the infrastructure. Once the private key is derived, integrity is lost." says Scott Petry CEO and Founder of Authentic8.

"The practical nature of the vulnerability is a function of how broad the TPM installed base is and whether an attacker can determine a vulnerable private key from the public part — in other words, can an attacker determine if a key was generated by the chipset or not," he says.

According to the researchers, the bug makes factorization of 1024 and 2048 bit key lengths practically possible in terms of time and cost. "The worst cases for the factorization of 1024-bit and 2048-bit keys are less than 3 CPU-months and 100 CPU-years, respectively, on a single core of a common recent CPU, while the expected time is half of that of the worst case," the researchers said.

Using multiple CPUs to do the factorization can reduce the time significantly. At current prices, an attacker would spend about $76 to do the factorization for a 1024-bit key using an Amazon AWS c4 instance and roughly $40,000 to do the same with a 2,048-bit key.  Currently, at least 760,000 keys generated by the chipset are confirmed to be vulnerable. But it is quite possible that between two and three magnitudes more keys are broken.

The researchers will present a research paper titled "The Return of Coppersmith's Attack: Practical Factorization of Widely Used RSA Moduli' (ROCA) that will describe the attack more in detail Nov. 2 at the ACM CCS conference in Dallas.

The ROCA issue impacts any product in which the buggy chipset is integrated. The list includes products from Google, Microsoft, HPE, Lenovo and Fujitsu as well as trusted boot devices, authentication tokens and software package signing tools from other vendors. All of the vendors have released updates and advice to mitigate the issue. Infineon itself was informed about the bug in February and given time to address the issue before public disclosure. The company has developed firmware updates and made it available to OS and device makers.

"Cryptography is undoubtedly the most difficult problem to get right when it comes to information security," says Sean Dillon, senior security researcher at RiskSense.

If the number of cryptographic weaknesses that have been discovered in once widely trusted algorithms in recent years is any indication, more related vulnerabilities continue to be found for years to come, he predicts.

Vulnerabilities such as the ROCA flaw suggest the use of quantum computing and large prime factorization is not just a research concept, he says. Rather they portend "practical attack(s) that can break the entire trust model, even amongst big players such as governments and financial institutions," Dillon says.

Related content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
For Cybersecurity to Be Proactive, Terrains Must Be Mapped
Craig Harber, Chief Technology Officer at Fidelis Cybersecurity,  10/8/2019
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17545
PUBLISHED: 2019-10-14
GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.
CVE-2019-17546
PUBLISHED: 2019-10-14
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
CVE-2019-17547
PUBLISHED: 2019-10-14
In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free.
CVE-2019-17501
PUBLISHED: 2019-10-14
Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen).
CVE-2019-17539
PUBLISHED: 2019-10-14
In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.