Public
- Public
- Network
- Groups
- Featured
- Popular
- People

Conversation

Notices

Embed this notice
Joe Ortiz (joeo10@mastodon.sdf.org)'s status on Wednesday, 04-Sep-2024 05:54:38 JST Joe Ortiz

If you have a #YubiKey, this is a must-read and it's not good at all as it's prone to cloning attacks with no fix in sight.
More here: https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/
#security #privacy
In conversation about 2 months ago from mastodon.sdf.org permalink
Attachments
1. YubiKey-maker Yubico issued an advisory in coordination with a detailed disclosure report from NinjaLab, the security firm that reverse-engineered the YubiKey 5 series and devised the cloning attack. All YubiKeys running firmware prior to version 5.7—which was released in May and replaces the Infineon cryptolibrary with a custom one—are vulnerable. Updating key firmware on the YubiKey isn’t possible. That leaves all affected YubiKeys permanently vulnerable. “An attacker could exploit this issue as part of a sophisticated and targeted attack to recover affected private keys,” the advisory confirmed. “The attacker would need physical possession of the YubiKey, Security Key, or YubiHSM, knowledge of the accounts they want to target, and specialized equipment to perform the necessary attack. Depending on the use case, the attacker may also require additional knowledge including username, PIN, account password, or authentication key.”
  https://mastodon.sdf.org/system/media_attachments/files/113/075/601/209/906/369/original/4fef65f38156af26.png
2. Domain not in remote thumbnail source whitelist: cdn.arstechnica.net
  
  YubiKeys are vulnerable to cloning attacks thanks to newly discovered side channel
  
  Sophisticated attack breaks security assurances of the most popular FIDO key.
- Embed this notice
  Joe Ortiz (joeo10@mastodon.sdf.org)'s status on Wednesday, 04-Sep-2024 06:13:03 JST Joe Ortiz
  in reply to
  - Christopher Evans
  @becomingwisest I'm sure newer made Yubikeys are going to be patched but the ones already in the wild (like all of them) aren't.
  
  In conversation about 2 months ago permalink
- Embed this notice
  Christopher Evans (becomingwisest@hachyderm.io)'s status on Wednesday, 04-Sep-2024 06:13:04 JST Christopher Evans
  in reply to
  
  @joeo10 fix in sight with new firmware used on hardware made since May.
  
  In conversation about 2 months ago permalink
- Embed this notice
  Joe Ortiz (joeo10@mastodon.sdf.org)'s status on Wednesday, 04-Sep-2024 06:17:26 JST Joe Ortiz
  in reply to
  - Christopher Evans
  - Gavin
  @gavin57 @becomingwisest That makes replacing existing Yubikeys ever more important. Like I said, I'm sure newly made units are going to be patched but the ones already in the wild aren't.
  
  In conversation about 2 months ago permalink
- Embed this notice
  Gavin (gavin57@toot.wales)'s status on Wednesday, 04-Sep-2024 06:17:27 JST Gavin
  in reply to
  - Christopher Evans
  @becomingwisest @joeo10 Yup, it also requires the user to be really careless with their key around someone capable of fabricating a clone, whilst also handing that person their password. A bit of a storm in a teacup and they’re still safer than not using one.
  
  In conversation about 2 months ago permalink
- Embed this notice
  Joe Ortiz (joeo10@mastodon.sdf.org)'s status on Wednesday, 04-Sep-2024 10:17:26 JST Joe Ortiz
  in reply to
  - Christopher Evans
  - Gavin
  @gavin57 @becomingwisest https://infosec.exchange/@dangoodin/113076276124429268
  In conversation about 2 months ago permalink
  Attachments
  1. No result found on File_thumbnail lookup.
    
    Dan Goodin (@dangoodin@infosec.exchange)
    
    from Dan Goodin
    
    @rysiek@mstdn.social @thetechtutor@me.dm Thanks for coming to my defense Michal. The statement that only brief access is required comes from the ninjalab researcher. He believes a nation state attacker could devise a streamlined way to quickly tear down the YubiKey, extract the electromagnetic emanations needed, physically reconstruct it and return it to the target. The remaining key extraction would happen off-line in the hours following that. This scenario may or may not be realistic, so I have changed the word "brief' to "temporary." Also, if anyone claims I said this attack is cheap, they're putting words in my mouth. The article makes clear in the cloning requires a tremendous amount of cryptographic and electric engineering expertise and $11,000 worth of equipment.
- Embed this notice
  Gavin (gavin57@toot.wales)'s status on Wednesday, 04-Sep-2024 10:17:28 JST Gavin
  in reply to
  - Christopher Evans
  @joeo10 @becomingwisest
  https://mstdn.social/@rysiek/113075472648375180
  In conversation about 2 months ago permalink
  Attachments
  1. No result found on File_thumbnail lookup.
    
    Michał "rysiek" Woźniak · 🇺🇦 (@rysiek@mstdn.social)
    
    from Michał "rysiek" Woźniak · 🇺🇦
    
    Ok, here's the deal on the "YubiKey cloning attack" stuff: :eyes_opposite: Yes, a way to recover private keys from #YubiKey 5 has been found by researchers. But the attack *requires*: 👉 *physically opening the YubiKey enclosure* 👉 physical access to the YubiKey *while it is authenticating* 👉 non-trivial electronics lab equipment I cannot stress this enough: ✨ In basically every possible scenario you are safer using a YubiKey or a similar device, than not using one. ✨ #InfoSec #YubiKey5
- Embed this notice
  Gavin (gavin57@toot.wales)'s status on Wednesday, 04-Sep-2024 10:17:29 JST Gavin
  in reply to
  - Christopher Evans
  @joeo10 @becomingwisest The unaffected firmware has been available for months. Worth upgrading for the first extra capacity anyway, but mine are thankfully unaffected —not that I plan to leave them lying around.
  
  In conversation about 2 months ago permalink

Public

Conversation

Notices

Feeds