这是微魔第一次发这样的“安全报告”相关的文章，如果有什么错漏，欢迎大家批评指正，首先，前天WHMCS发布的安全预警，修复了黑客可以通过键入特定值致使Credit系统执行数据库操作（2013-010详情），大家可以通过升级最新版的5.2.15来解决问题；另外，最近国外有人实现了通过音频破解GnuPG（Linux下的一款加密软件）并提取RSA（加密算法）的密钥（查看），目前Debian官方已经通过升级GnuPG包对此漏洞进行修复（查看）
第二个漏洞说起来比较有意思，微魔简单和大家分享一下，首先不同的RSA密钥会诱发不同声音（但是声音频率非常的低），而通过Acoustic Cryptanalysis Key Extraction（声学分析密钥提取）的攻击方式可以再1小时内破解4096位加密的RSA密钥。而实施的方法“简单”到将手机放置在电脑旁边，当然微魔在“简单”两个字打了个引号，主要是因为对于VPS用户而言，这种顾虑较小，当一个人能够将手机放置在你机器旁边的时候，与其花1个小时破解你的密码，不如直接偷走你的硬盘~
RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis eavesdrop on computer Many computers emit a high-pitched noise during operation, due to vibration in some of their electronic components. These acoustic emanations are more than a nuisance: they can convey information about the software running on the computer and, in particular, leak sensitive information about security-related computations. In a preliminary presentation, we have shown that different RSA keys induce different sound patterns, but it was not clear how to extract individual key bits. The main problem was the very low bandwidth of the acoustic side channel (under 20 kHz using common microphones, and a few hundred kHz using ultrasound microphones), many orders of magnitude below the GHz-scale clock rates of the attacked computers. Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG's current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away. Beyond acoustics, we demonstrate that a similar low-bandwidth attack can be performed by measuring the electric potential of a computer chassis. A suitably-equipped attacker need merely touch the target computer with his bare hand, or get the required leakage information from the ground wires at the remote end of VGA, USB or Ethernet cables.
