Hardware

637 readers

248 users here now

All things related to technology hardware, with a focus on computing hardware.

Rules (Click to Expand):

Follow the Lemmy.world Rules - https://mastodon.world/about
Be kind. No bullying, harassment, racism, sexism etc. against other users.
No Spam, illegal content, or NSFW content.
Please stay on topic, adjacent topics (e.g. software) are fine if they are strongly relevant to technology hardware. Another example would be business news for hardware-focused companies.
Please try and post original sources when possible (as opposed to summaries).
If posting an archived version of the article, please include a URL link to the original article in the body of the post.

Some other hardware communities across Lemmy:

Icon by "icon lauk" under CC BY 3.0

founded 1 year ago

MODERATORS

Alphane_Moon

CSFFlame

YubiKeys are vulnerable to cloning attacks thanks to newly discovered side channel (arstechnica.com)

submitted 2 months ago* (last edited 2 months ago) by GreenEngineering3475 to c/hardware

8 comments fedilink hide all child comments

Edit: Yubico has issued a security advisory on the vulnerability https://www.yubico.com/support/security-advisories/ysa-2024-03/

all 9 comments

sorted by: hot top controversial new old

[–] Alphane_Moon 29 points 2 months ago (2 children)

“The attacker would need physical possession of the YubiKey, Security Key, or YubiHSM, knowledge of the accounts they want to target, and specialized equipment to perform the necessary attack. Depending on the use case, the attacker may also require additional knowledge including username, PIN, account password, or authentication key.”

[–] jelloeater85 10 points 2 months ago

Seems like a "blast door" type problem...

[–] [email protected] 4 points 2 months ago

That sounds like the attacker would need to basically already know how to unlock it...

[–] Desistance 15 points 2 months ago (4 children)

Not much of a vulnerability when you need physical access.

[–] jewbacca117 10 points 2 months ago

It's like saying a bank is vulnerable if you have enough drills and guns

[–] [email protected] 8 points 2 months ago

On the contrary. China for example is known for accessing traveler electronics both during customs/immigration checks and in their hotels. Unless the victim carries their key on their person at all times without fault it can be cloned without them knowing.

[–] eyeon 5 points 2 months ago

i have physical access to my own yubikey and can't make a backup copy. someone else who only temporarily has access to it being able to do so is definitely a vulnerability.

[–] [email protected] 7 points 2 months ago

Its not much of a vulnerability, like locks, its not if it can be picked, it is how difficult it is to be picked, but the difference here is that the vulnerability is that a nation state actor, or a high capability actor can compromise it, and "it" being the thing that keeps your accounts safe.

So this is like the lock that protects all your accounts can be shimmed if it ever gets out of your control type of an issue, so not to stop using them, but to keep them secured or on your person at all times.

I hope YubiKey offers a fair upgrade program for their next series of keys and maybe a new FIDO Standard.