YubiKey 還在出清有問題的版本

在「YubiKey still selling old stock with vulnerable firmware」這邊看到的，有人提到 YubiKey 還在賣有問題的版本，裡面提到的 blo

https://blog.gslin.org/archives/2024/11/15/12066/yubikey-%e9%82%84%e5%9c%a8%e5%87%ba%e6%b8%85%e6%9c%89%e5%95%8f%e9%a1%8c%e7%9a%84%e7%89%88%e6%9c%ac/

#Computer #Hardware #Murmuring #Security #Software #attack #channel #compliance #eucleak #fips #firmware #hardware #security #side #sidechannel #sidechannel #vulnerability #vulnerable #yubico #yubikey

Side-channel #EUCLEAK attack discovered on devices using the Infineon cryptographic library, like the YubiKey 5 series (firmware <5.7) and Feitian A22 JavaCard.

But it does require a fair amount of factors to succeed: username, password, physical access, additional equipment, and for the cryptographic operations to involve modular inversions, like ECDSA.

There are two phases to the attack:

(1) The online phase requires opening the device to access the microcontroller, then using an electromagnetic probe, an oscilloscope, and a computer to capture the electromagnetic side-channel signals during operation.

(2) The offline phase (physical access no longer necessary) supposedly takes time varying from one hour to one day for each secret to uncover.

https://ninjalab.io/wp-content/uploads/2024/09/20240903_eucleak.pdf

#ninjalab #eucleak #sidechannel #attack #infineon #yubikey #feitian

We've update our security keys guide in light of the #Eucleak attack. Given the complexity of the attack, we think most people can continue using their security keys. But if you're a high-risk individual, you may want to consider buying a new one.

https://www.nytimes.com/wirecutter/reviews/best-security-keys/

USB MFA SCA😱: #Infineon hardware and software blamed for timing side-channel attack on popular auth tokens.

The most widely used #FIDO2 authentication device has a nasty flaw: It can be cloned. Other uses of #YubiKey’s vulnerable Infineon embedded chip might also be at risk—such as passports and credit cards.

But is the sky really falling? In #SBBlogwatch, we dig into the nuance. At @TechstrongGroup⁠’s @SecurityBlvd: https://securityboulevard.com/2024/09/fwbifx/?utm_source=richisoc&utm_medium=social&utm_content=richisoc&utm_campaign=richisoc #EUCLEAK

Można klonować klucze Yubikey 5. Podatne są klucze z firmware < 5.7. Wymagany fizyczny dostęp.

Piekło zamarzło, Yubikey’e zhackowane – tak moglibyśmy opisać wczorajszy komunikat wydany przez Yubico, czyli producenta najpopularniejszych na świecie fizycznych kluczy bezpieczeństwa. Moglibyśmy, ale pomimo że jest w tym nieco prawdy, to nie ma powodu do paniki, przynajmniej dla większości użytkowników popularnych yubikey’ów. Dlaczego nie ma? Zacznijmy od teorii. Badacze z...

#WBiegu #Atak #EUCLEAK #Infineon #Klonowanie #SideChannel #U2f #Yubikey

https://sekurak.pl/mozna-klonowac-klucze-yubukey-5-podatne-sa-klucze-z-firmware-5-7-wymagany-fizyczny-dostep/