https://shkspr.mobi/blog/2022/03/whats-the-risk-from-fake-yubikeys/ Terence Eden's Blog Support This Site What's the risk from fake Yubikeys? 2022-03-06 by @edent | 2fa, security, yubikey | 6 comments | 300 words --------------------------------------------------------------------- I found this on a security-related Slack (shared with permission). [Fake] It launched an entertaining discussion about the risks of taking a potentially fake FIDO token. We all know the risks of taking a free USB drive and shoving it in our computer, right? Meme in the style of "You Wouldn't Download A Car" saying "You wouldn't take a free USB stick. USB sticks can install software, act as a keylogger, transmit data over WiFi, and even physically damage the electronics! So a USB Yubikey could do all those things - but could it do anything malicious as an MFA token? And - at the risk of invoking Cunningham's law - I think the answer is a cautious "no". Other than the risks inherent in any USB device, what's the worst that could happen? A cloned device might let an attacker have a duplicate key. But that's useless unless they also have your username and password. A device with a built in transmitter might send an OTP to an attacker but, again, useless without the other authentication factors. The devices could be set up to deliberately fail - or be revoked. That could work as a denial of service attack against users. But most services allow you to have a backup authentication method. There may be some sites which only use a token for login - eschewing passwords - but that's rare, I would hope. A Yubikey can be hacked to send arbitrary keystrokes - but that's of limited usefulness. I guess an attacker could force open a browser window to download malicious software, but that would be fairly obvious to a user. So, go on then, prove me wrong. What's the worst thing that can be done with a compromised Yubikey? --------------------------------------------------------------------- Share the love: * Twitter * Facebook * LinkedIn * Reddit * HackerNews * Lobsters * Email * Pocket * WhatsApp * Telegram * Like this: Like Loading... --------------------------------------------------------------------- More posts from around the site: 6 thoughts on "What's the risk from fake Yubikeys?" 1. [9599f899] Christopher M0YNG says: 2022-03-06 at 12:49 @Edent it could present as a Fido token, but also be a "traditional" malicious device? Reply 2. [G3sBtHlb] HackerNewsTop10 says: 2022-03-06 at 13:21 What's the Risk from Fake Yubikeys? Link: shkspr.mobi/blog/2022/03/w... Comments: news.ycombinator.com/item?id=305771... Reply 3. [50602f3f] Alex B says: 2022-03-06 at 13:57 I'd be most concerned about it having a dual role, e.g. as USB mass storage device that in turn causes the automatic installation of malware operating systems that autorun code from removable media. Reply 1. [114446a5] Leo says: 2022-03-06 at 18:37 operating systems that autorun code from removable media How many modern operating systems do that nowadays? Reply 4. [313c8a6e] Paul Bowsher says: 2022-03-06 at 19:30 It could have a very small (<10000) pre-defined private keys to dole out instead of generating a completely random one. You then give out a public key to someone who then assumes they're sending you something private, but if the attacker intercepts the ciphertext they have a very simple brute force run on their hands. Yubikeys aren't just MFA, they're tiny HSMs and used very widely in public key cryptography. Reply 5. [8f98c1db] ryan says: 2022-03-06 at 21:01 I've purchased more than one USB "WIFI" or "BT" or similar adapter from Aliexpress/Wish that will present as a USB hub of some sort, a ~64MB flash drive, and a USB HID that will try to rapidly run it or send keystrokes (I had one that would as soon as you plugged it in, open the Run window with Win+R and try to type in E:\setup.exe. Why E? No idea) Reply Leave a Reply Cancel reply Your email address will not be published. Required fields are marked * [ ] [ ] [ ] [ ] [ ] [ ] [ ] Comment *[ ] Name * [ ] Email * [ ] Website [ ] [ ] Notify me of follow-up comments by email. [ ] Notify me of new posts by email. [Post Comment] [ ] [ ] [ ] [ ] [ ] [ ] [ ] D[ ] To respond on your own website, enter the URL of your response which should contain a link to this post's permalink URL. Your response will then appear (possibly after moderation) on this page. Want to update or remove your response? Update or delete your post and re-enter your post's URL again. (Learn More) [ ] [Ping me!] Enjoyed this post? Claim your FREE email subscription Enter your email address to subscribe to this blog and receive brand new posts by email. (Or subscribe to this [rss]Atom Feed.) Join 12,972 other subscribers. Email Address [ ] Free Sign Up Search Blog Posts Search for: [ ] [Search] Explore The Archives 2022 January 30 posts February 23 posts March 3 posts April May June July August September October November December 2021 January 31 posts February 28 posts March 31 posts April 30 posts May 31 posts June 30 posts July 31 posts August 31 posts September 30 posts October 31 posts November 30 posts December 31 posts 2020 January 31 posts February 29 posts March 31 posts April 30 posts May 31 posts June 30 posts July 31 posts August 31 posts September 30 posts October 31 posts November 30 posts December 31 posts 2019 January 31 posts February 12 posts March 17 posts April 12 posts May 12 posts June 10 posts July 7 posts August 5 posts September 6 posts October 14 posts November 30 posts December 17 posts 2018 January 8 posts February 4 posts March 6 posts April 14 posts May 5 posts June 6 posts July 6 posts August 13 posts September 14 posts October 8 posts November 30 posts December 4 posts 2017 January 12 posts February 9 posts March 8 posts April 4 posts May 10 posts June 5 posts July 5 posts August 6 posts September 3 posts October 4 posts November 30 posts December 2016 January 10 posts February 10 posts March 11 posts April 9 posts May 8 posts June 9 posts July 6 posts August 9 posts September 4 posts October 2 posts November 30 posts December 14 posts 2015 January 8 posts February 11 posts March 10 posts April 4 posts May 9 posts June 3 posts July 7 posts August 9 posts September 10 posts October 2 posts November 30 posts December 4 posts 2014 January 13 posts February 13 posts March 14 posts April 14 posts May 8 posts June 7 posts July 9 posts August 5 posts September 5 posts October 1 post November 30 posts December 20 posts 2013 January 25 posts February 17 posts March 15 posts April 18 posts May 11 posts June 14 posts July 6 posts August 14 posts September 6 posts October 4 posts November 30 posts December 14 posts 2012 January 14 posts February 8 posts March 13 posts April 15 posts May 10 posts June 16 posts July 8 posts August 8 posts September 6 posts October 6 posts November 30 posts December 31 posts 2011 January 13 posts February 11 posts March 11 posts April 12 posts May 8 posts June 8 posts July 6 posts August 5 posts September 11 posts October 7 posts November 30 posts December 17 posts 2010 January 6 posts February 15 posts March 12 posts April 13 posts May 4 posts June 3 posts July 15 posts August 8 posts September 11 posts October 9 posts November 30 posts December 9 posts 2009 January 1 post February 5 posts March 3 posts April 7 posts May 12 posts June 8 posts July 10 posts August 10 posts September 12 posts October 22 posts November 31 posts December 15 posts 2008 January 2 posts February March 2 posts April 3 posts May 2 posts June July 1 post August 3 posts September 1 post October 3 posts November 2 posts December 1 post 2007 January February March April May June July August September October November 4 posts December 5 posts 2006 January February March April 1 post May June July August September October November 1 post December 2005 January February March 1 post April May June July August September 1 post October November December 2004 January February March April May 5 posts June 3 posts July 1 post August September October November December 2003 January February March 2 posts April May June July August September October November December 2002 January February 1 post March April 3 posts May June July August September October November December 2001 January February March April May June July 1 post August September October 1 post November December 2000 January February March 1 post April May June July August September October November 1 post December 1999 January February March April May June July August September 1 post October November December 1 post 1995 January February March 1 post April May June July August September October November December 1987 January February March April May June July August September October November December 1 post * (c) Terence Eden * Contact Me * Subscribe * Citations * Support My Blog * About Me ISSN 2753-1570 Send to Email Address [ ] Your Name [ ]Your Email Address [ ] [ ] loading [Send Email] Cancel Post was not sent - check your email addresses! Email check failed, please try again Sorry, your blog cannot share posts by email. %d bloggers like this: