CyberSecurity updates
Updated: 2024-09-12 18:45:19 Pacfic

Flag This

YubiKey Vulnerability: Cloning Flaw Exposes Security Risk - 6d

Security researchers have identified a critical vulnerability in YubiKeys, widely used hardware security keys that enhance authentication security. The flaw allows attackers to potentially clone YubiKeys, undermining their intended security purpose. The vulnerability arises from a cryptographic flaw that permits attackers to replicate YubiKey functionality. The cloning process potentially allows attackers to bypass security protocols and gain unauthorized access to user accounts and systems. Organizations and individuals who rely on YubiKeys for security should take immediate action to mitigate the risk. Patching the vulnerability and updating YubiKey firmware are critical steps to address the issue. Implement multi-factor authentication and other security measures to bolster security posture.

References

  • @filippo - The vulnerability exists within the SLE78 microcontroller, used in several popular physical security keys. The attack allows attackers to extract sensitive cryptographic data from the device, making it possible to clone the YubiKey and potentially other devices that use the affected microcontroller.
  • @tychotithonus - Any word on other vendors/keys affected by EUCLeak other than Yubico? Since the library was Infineon's, in theory other key families could be impacted. I'm somewhat sure Google writes their own Titan firmware, but not sure about others.
  • ninjalab.io - The attacks require about $11,000 worth of equipment and a sophisticated understanding of electrical and cryptographic engineering. The difficulty of the attack means it would likely be carried out by nation-states or other entities with comparable resources and then only in highly targeted scenarios. The likelihood of such an attack being used widely in the wild is extremely low.
  • www.yubico.com - Yubico has issued a security advisory regarding a newly discovered side-channel attack that can be used to potentially clone YubiKey 5 series devices. The attack, named EUCLeak, exploits a vulnerability in the Infineon SLE78 microcontroller and its cryptographic library.
  • Wired - Are a Gold Standard—but They Can Be Cloned

Classification:

  • Type: Vulnerability
  • Severity: Medium
  • Company: Yubico
  • Target: YubiKey Users
  • Product: YubiKey
  • Feature: Security Key






This site is an experimental news aggregator using feeds I personally follow. You can reach me using contacts here if you have feedback. You can also find Flathis at Mastodon.