Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/17/2017
04:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Factorization Bug Exposes Millions Of Crypto Keys To 'ROCA' Exploit

Products from Lenovo, HPE, Google, Microsoft, and others impacted by flaw in Infineon chipset.

The set of key reinstallation vulnerabilities disclosed Monday in the WPA2 protocol is actually the second disclosure in recent days to hammer home just how difficult it can be getting cryptography right.

Last week a team of security researchers from Masaryk University in the Czech Republic and other organizations disclosed a bug in a Trusted Platform Module (TPM) chipset from Infineon Technologies AG that some believe is worse than the KRACK WiFi flaws.

The factorization vulnerability gives attackers a way to recover the private half of any RSA encryption key generated by the chipset, using only the public key. Unlike the KRACK flaws, an attacker does not need to be close to a vulnerable device or have access to it, in order to exploit the flaw. Any RSA key generated by a vulnerable Infineon chipset is open to attack, the researchers said in an alert.

"It's a huge deal in terms of the integrity of the infrastructure. Once the private key is derived, integrity is lost." says Scott Petry CEO and Founder of Authentic8.

"The practical nature of the vulnerability is a function of how broad the TPM installed base is and whether an attacker can determine a vulnerable private key from the public part — in other words, can an attacker determine if a key was generated by the chipset or not," he says.

According to the researchers, the bug makes factorization of 1024 and 2048 bit key lengths practically possible in terms of time and cost. "The worst cases for the factorization of 1024-bit and 2048-bit keys are less than 3 CPU-months and 100 CPU-years, respectively, on a single core of a common recent CPU, while the expected time is half of that of the worst case," the researchers said.

Using multiple CPUs to do the factorization can reduce the time significantly. At current prices, an attacker would spend about $76 to do the factorization for a 1024-bit key using an Amazon AWS c4 instance and roughly $40,000 to do the same with a 2,048-bit key.  Currently, at least 760,000 keys generated by the chipset are confirmed to be vulnerable. But it is quite possible that between two and three magnitudes more keys are broken.

The researchers will present a research paper titled "The Return of Coppersmith's Attack: Practical Factorization of Widely Used RSA Moduli' (ROCA) that will describe the attack more in detail Nov. 2 at the ACM CCS conference in Dallas.

The ROCA issue impacts any product in which the buggy chipset is integrated. The list includes products from Google, Microsoft, HPE, Lenovo and Fujitsu as well as trusted boot devices, authentication tokens and software package signing tools from other vendors. All of the vendors have released updates and advice to mitigate the issue. Infineon itself was informed about the bug in February and given time to address the issue before public disclosure. The company has developed firmware updates and made it available to OS and device makers.

"Cryptography is undoubtedly the most difficult problem to get right when it comes to information security," says Sean Dillon, senior security researcher at RiskSense.

If the number of cryptographic weaknesses that have been discovered in once widely trusted algorithms in recent years is any indication, more related vulnerabilities continue to be found for years to come, he predicts.

Vulnerabilities such as the ROCA flaw suggest the use of quantum computing and large prime factorization is not just a research concept, he says. Rather they portend "practical attack(s) that can break the entire trust model, even amongst big players such as governments and financial institutions," Dillon says.

Related content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...