•

YubiKeys are vulnerable to cloning attacks thanks to newly discovered side channel

https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/

Sophisticated attack breaks security assurances of the most popular FIDO key.

Edit: Yubico has issued a security advisory on the vulnerability https://www.yubico.com/support/security-advisories/ysa-2024-03/

8 comments

Alphane_Moon

•

“The attacker would need physical possession of the YubiKey, Security Key, or YubiHSM, knowledge of the accounts they want to target, and specialized equipment to perform the necessary attack. Depending on the use case, the attacker may also require additional knowledge including username, PIN, account password, or authentication key.”

jelloeater85

•

Seems like a "blast door" type problem...

01189998819991197253

•

That sounds like the attacker would need to basically already know how to unlock it...

Desistance

•

Not much of a vulnerability when you need physical access.

jewbacca117

•

It's like saying a bank is vulnerable if you have enough drills and guns

lemmyng

•

On the contrary. China for example is known for accessing traveler electronics both during customs/immigration checks and in their hotels. Unless the victim carries their key on their person at all times without fault it can be cloned without them knowing.

eyeon

•

i have physical access to my own yubikey and can't make a backup copy. someone else who only temporarily has access to it being able to do so is definitely a vulnerability.

higgsboson

•

I mean it is a physical security device, so it seems relevant.

WolvenSpectre

•

Its not much of a vulnerability, like locks, its not if it can be picked, it is how difficult it is to be picked, but the difference here is that the vulnerability is that a nation state actor, or a high capability actor can compromise it, and "it" being the thing that keeps your accounts safe.

So this is like the lock that protects all your accounts can be shimmed if it ever gets out of your control type of an issue, so not to stop using them, but to keep them secured or on your person at all times.

I hope YubiKey offers a fair upgrade program for their next series of keys and maybe a new FIDO Standard.