M1チップの脆弱性M1raclesを読み解く / About the vulnerability on M1 chip called M1racles

Transcript

1. .νοϓͷ੬ऑੑ
   .SBDMFTΛಡΈղ͘
   f o r J 0 4 % $ +" 1" /
   

   View Slide

2. ..BDΛ࢖ͬͯΔํ!
   

   View Slide

3. N ?Ч?
   ϓΪϟʔ͆͆͆
   

   View Slide

4. ೥݄೔
   

   View Slide

5. ɹमਖ਼ෆՄೳͳ੬ऑੑ͕ൃ֮ʂ
   ͋ͷ νοϓʹ
   

   View Slide

6. View Slide

7. View Slide

8. $16
   ϝϞϦ ετϨʔδ
   ϓϩηε" ϓϩηε#
   σʔλ
   

   View Slide

9. $16
   ϝϞϦ ετϨʔδ
   ϓϩηε" ϓϩηε#
   σʔλ
   

   View Slide

10. $16
    ϝϞϦ ετϨʔδ
    Ϩδελ
    ϓϩηε" ϓϩηε#
    σʔλ
    "
    

    View Slide

11. ϓϩηεΛىಈͯ͠
    ඪ४ೖྗ͔Βೖྗ଴ͪʹ
    

    View Slide

12. ผͷಉ໊ʢ࿈ಈʣϓϩηε͔Β
    ϑΝΠϧͷσʔλΛಡΈࠐΜͰ
    Ϩδελʹૹ৴
    

    View Slide

13. ݩͷϓϩηε͕Ϩδελ͔Β
    ೖྗ͞ΕͨσʔλΛड৴͠
    

    View Slide

14. ݩͷϓϩηε͕
    ಈըΛ࠶ੜ࢝͠ΊΔ
    

    View Slide

15. IUUQTXXXOJDPWJEFPKQXBUDITN
    

    View Slide

16. IUUQTEVDLEVDLHPDPN RNSBDMFTUPTYJBXFC
    

    View Slide

17. IUUQTNSBDMFTDPN
    

    View Slide

18. '"2
    IUUQTNSBDMFTDPN
    

    View Slide

19. ҎԼɺ'"2ൈਮ
    

    View Slide

20. 2ɿ୭͕ӨڹΛड͚Δͷ͔
    શͯͷ.ϢʔβɻͲΜͳ04Ͱ΋௚઀ಈ͍ͯΔݶ
    ΓӨڹड͚·͢ɻ
    

    View Slide

21. 2ɿ΄͔ͷ"QQMFͷ$16΋ಉ͡੬ऑੑ͕͋Δ
    ͔
    ͸͍ɺগͳ͘ͱ΋ݱࡏ"͸֬ೝࡁΈͰ͢ɻ
    

    View Slide

22. 2ɿ"QQMFҎ֎ͷ$16͸ಉ͡੬ऑੑ͕͋Δ͔
    ͍͍͑ɻ
    

    View Slide

23. 2ɿͲ͏΍ͬͯࣗ෼΋कΕ͹͍͍͔
    །Ұͷղܾ๏͸7.Ͱ04Λ࣮ߦͤ͞Δ͜ͱͰ͢ɻ
    

    View Slide

24. 2ɿͦͷղܾ๏͸ύϑΥʔϚϯεʹӨڹ͋Δ͔
    ͸͍ɺ7.͔ͩΒ૬౰ͳύϑΥʔϚϯε໰୊͕ग़·
    ͢ɻ
    

    View Slide

25. 2ɿͦΕ͸΍͹ͦ͏ͩͶ
    ͦ͏Ͱ͢Ͷɺ͔ͩΒ7.Ͱ04ಈ͔͢ͷ΍Ί·͠ΐ
    ͏͔ɻ
    

    View Slide

26. 2ɿ͜ͷ੬ऑੑ͸࣍ͷ"QQMF4JMMJDPOͰमਖ਼͞
    ΕΔ͔
    Ξοϓ
    ϧͷϓϥϯʹ͍ͭͯ͸஌Γ·ͤΜ͕ɺҰൠత
    ͳ$16։ൃλΠϜϥΠϯ͔Βਪଌ͢Δʹ͸গͳ͘ͱ
    ΋࣍ͷੈ୅ͷ"QQMF4JMMJDPO΋͜ͷ໰୊͕͋ΔՄೳ
    ੑ͕ߴ͍Ͱ͢ɺͨͩͦͷ͞Βʹ࣍ͷ$16ͳΒଟ෼म
    ਖ਼͞ΕͯΔ͔΋͠Ε·ͤΜɻ
    

    View Slide

27. 2ɿϚϧ΢ΣΞ͸͜ͷ੬ऑੑΛར༻ͯ͠ࢲͷ
    1$Λ৐ͬऔΔՄೳੑ͸͋Δ͔
    ͍͍͑ɻ
    

    View Slide

28. 2ɿϚϧ΢ΣΞ͸͜ͷ੬ऑੑΛར༻ͯ͠ࢲͷݸ
    ਓ৘ใΛ౪ΊΔ͔
    ͍͍͑ɻ
    

    View Slide

29. 2ɿϚϧ΢ΣΞ͸͜ͷ੬ऑੑΛར༻ͯ͠ࢲʹ
    3JDLSPMMͱ͍͏ِϦϯΫΛ౿·ͤΔ͔
    ͸͍ɺͱݴ͏ΑΓͦΕ͸ผʹ͜ͷ੬ऑੑΛ࢖Θͳ͘
    ͯ΋؆୯ʹͰ͖ͪΌ͍·͢ɻ
    

    View Slide

30. 2ɿ͜ͷ੬ऑੑʹΑͬͯ#BE#*04ʹײછ͞Ε
    ΔՄೳੑ͕͋Δ͔
    ͍͍͑ɻ
    

    View Slide

31. 2ɿ͑ʁ͜Εຊ౰ʹ࣮ࡏ͢Δ੬ऑੑͳͷʁ
    ͸͍ɻ
    

    View Slide

32. 2ɿ͡Ό͋Կ͕໰୊ͳͷʁ
    ͋ͳͨͷ1$ʹطʹϚϧ΢ΣΞ͕જΜͩ৔߹ɺ͜ͷϚ
    ϧ΢ΣΞ͸ଞͷϚϧ΢ΣΞͱ૝ఆ֎ͷ௨৴͕ՄೳͰ
    ͢ɻ
    

    View Slide

33. 2ɿͳΜͩ͜ΕͳΜ͔ͦΜͳʹେͨ͠໰୊͡Ό
    ͳͦ͞͏͡ΌΜ
    ͿͬͪΌ͚͜Ε޿ࠂձ͕ࣾ͜ͷ੬ऑੑΛ࢖ͬͯΞϓ
    ϦؒͷτϥοΩϯάΛ͢Δํ͕ଟ෼൜ࡑʹ࢖͏ΑΓ
    ༗ҙ͔ٛͱࢥ͍·͢͠ɺͦΕʹ"QQ4UPSFͰ഑৴͞
    ΕͯΔΞϓϦͳΒ"QQMF͸΍Ζ͏ͱ͢Ε͹͜Μͳѱ
    ߦΩϟονͰ͖·͢Αɻ
    

    View Slide

34. 2ɿ͡Ό͋"15߈ܸ͸ʁ
    "15߈ܸ͸΋ͬͱผͷ࢖͍΍͍͢खஈ͕͋Δ͔Β͜
    Μͳ੬ऑੑͳΜͯ൴Βʹͱͬͯҙຯͳ͍Ͱ͢Ͷɻ
    

    View Slide

35. 2ɿ͑ʁͭ·ΓԶ͸͜ͷ໰୊Λؾʹ͢΂͖Ͱ͸
    ͳ͍ͱݴͬͯΔʁ
    ͸͍ɻ
    

    View Slide

36. 2ɿͩͬͨΒ͜ͷ8FCϖʔδͷϙΠϯτ͸
    Կʁ
    ࠷ۙͷ17Ք͗ͷͨΊͷ੬ऑੑใࠂ͕ͲΜͳʹഅࣛ
    അ͍͔ࣛ͠Λᅑস͏ͨΊͰ͢ɻ͜Μͳʹཱ೿ͳ8FC
    ϖʔδ͕͋ͬͨΓ͋ͬͪͬͪ͜ͰχϡʔεʹͳͬͯΔ
    ͔Βͱ͍ͬͯɺͦΕΛຊؾͰؾʹ͢΂͖ͱ͸ݶΓ·
    ͤΜɻ
    

    View Slide

37. 2ɿͱ͋ΔχϡʔεαΠτ͔Βདྷ͚ͨͲ͜͜·
    Ͱͷ͜ͱʹ͍ͭͯԿ΋ڭ͑ͯ͘Εͳ͔ͬͨͧʂ
    Ͱͨ͠Βଟ෼ࠓޙ͸ͦͷχϡʔεαΠτΛಡΉͷ΍Ί
    Δ΂͖Ͱ͢Ͷɺ൴Β͕͜ͷ8FCϖʔδͷ࠷ॳͷ
    ஈམ͚ͩಡΜͰ΍Ίͨͷͱಉ͡Α͏ʹɻ
    

    View Slide

38. 2ɿχϡʔεαΠτ͕શ෦μϝͳͷ͔
    ͦ͏Ͱ΋ͳ͍Ͱ͢ɺҰ෦ͷϝσΟΞ͸هࣄॻ͘લʹ
    ͪΌΜͱࢲͱ࿈བྷͯ͠ϑΝΫτνΣοΫΛ͠·ͨ͠ͷ
    ͰΑ͘Ͱ͖ͯ·ͨ͠Αɻ
    

    View Slide

39. ੈͷதʹ͸ɺ17Ք͗ͷͨΊʹ
    ͍͔ʹ΋΍͹ͦ͏ͳλΠτϧ΍಺༰Ͱ
    ௼ΓهࣄΛॻ͘هऀ΍Ϩϙʔλʔ͕
    ͨ͘͞Μ͍·͢ɻ
    

    View Slide

40. View Slide

41. }
    var employedBy = "YUMEMI Inc."
    var job = "iOS Tech Lead"
    var favoriteLanguage = "Swift"
    var twitter = "@lovee"
    var qiita = "lovee"
    var github = "el-hoshino"
    var additionalInfo = """
    5෼ͷLTͳͷʹεϥΠυ͕50ຕۙ͋͘ΔΜͩͥʁ
    """
    final class Me: Developable, Talkable {
    

    View Slide

42. ͜ΕͰऴΘΓͱࢥͬͨʁ
    

    View Slide

43. ·ͩ࣌ؒ͋Δ͔Β
    ऴΘΓͳΘ͚ͳ͍͡ΌΜ
    

    View Slide

44. 2
    IUUQTNSBDMFTDPN
    

    View Slide

45. 2ɿ΋͜͠ͷόά͕ຊ౰ʹແ֐ͳΒɺͳΜͰ͜
    Μͳ໘౗ͳ͜ͱͯ͠·Ͱ΢ΣϒϖʔδΛ࡞ͬͨ
    ΓσϞಈըΛ্͛ͨΓ͢Δͷʁ
    ਖ਼௚͍͏ͱࢲ͸୯७ʹ.ͷ੬ऑੑΛར༻ͯ͠#BE
    "QQMFΛ࠶ੜ͔͚ͨͬͨͩ͠Ͱ͢ɺ͜Ε͕ͲΜͳʹ
    Ϋʔϧͳ͜ͱ͕୭΋͕ೝΊΔͰ͠ΐ͏ɻ
    

    View Slide

46. View Slide

47. IUUQTUTVJPLVDJSDVJUCBOEDBNQDPN
    

    View Slide