YubiKey Cloning Attack

2024-12-18T20:31:13Z

LTrifunovic:

== Summary ==

A YubiKey is a hardware authentication device (Hardware-Token) produced by Yubico. It provides an additional Layer of security for logging into online accounts. It functions as a physical security token for 2-Factor-Authentication (2FA) or Multi-Factor-Authentication (MFA).
The Hardware-Token uses the Elliptic Curve Digital Signature Algorithm (ECDSA) and stores the private-key locally on the device. Before being able to log in, the user has to input the YubiKey into the USB-port and prove the possession of the private-key.
However, attackers have found a way to extract this private-key with a Side-Channel-Attack and clone the YubiKey, enabling unauthorized authentication. The affected device is the YubiKey 5-Series with a firmware version before 5.7.

== General ==

=== Passwords ===

Passwords have been fundamental for authentication for decades and are still the most used authentication method. However, they come with a few weaknesses, which make them vulnerable to data leaks, phishing and identity theft.
Users frequently reuse the same password across multiple accounts. That means, that one single data breach can compromise several accounts.
Also, many create short or predictable passwords, like "123456" or "password". This makes it an easy target for brute-force attacks. Even long passwords with special characters lose their effectiveness if they are reused many times or remain unchanged for long periods.

=== Modern Authentication Methods ===

To address the issues of passwords, other authentication methods were introduced, which offer better security.
*One example are One-Time-Passwords (OTPs): The offer a higher level of protection by generating unique passwords for each login attempt. E.g.: When trying to log in, the user has to input an OTP which was received by E-mail or SMS.
*A variation of OTPs are Time-Based-One-Time-Passwords (TOTPs): These are generated on e.g a Smartphone through some Authenticator Application, like Google Authenticator. TOTPs are created constantly and valid for around 30 seconds, before changed. Because TOTPs are created locally on a user's device, they are harder for attackers to intercept.
*Biometric authentication: Authentication via Biometrics has become increasingly popular, especially on the phones nowadays. This method relies on unique physical characteristics, like fingerprint, facial recognition and iris-scanning. Biometrics are enhancing security by making it difficult for attackers to replicate or steal such information.
*Hardware-Tokens: Finally, small physical devices, which connect to a website login and create a private-key. YubiKey is such a device and allows users to authenticate by physically inputting the Hardware-Token into the Computer and pressing a button, which calculates the private-key and allows authentication. These are seen as very secure and protective against phishing attacks, because they are physical.
Here a picture of a YubiKey:

[[File:Yubi_1.PNG]]

== YubiKey Cloning Attack ==

=== Security of YubiKeys ===
Although YubiKeys are widely trusted for their security, a critical vulnerability was discovered that remained undetected for over 14 years. It was discovered by the security research team NinjaLab, who documented their findings in a 90 page document.
The vulnerability is related to a Side-Channel-Attack, which allows users to extract the private-key and thus clone the YubiKey.

=== Side-Channel-Measurements/Attack ===
The Side-Channel-Attack primarily relies on analyzing the timing behaviour of a device. During cryptographic operations, a YubiKey consumes power and requires a certain amount of time to process each operation. By measuring factors such as power consumption and timing behaviour, patterns can be identified which potentially reveal the private-key.

Before being able to do an attack, it is necessary to perform Side-Channel-Measurements. These measurements focus on various physical properties, such as power consumption, heat dissipation, electromagnetic radiation, acoustic emissions and the timing behaviour.
In the case of a YubiKey, the primary measurements involve timing data, power consumption and electromagnetic singals, which are being measured while sending authentication requests to the device.

Specialized and expensive equipment, such as an oscilloscope (first picture below) and near-field probes (second picture below), are required. The oscilloscope captures precise electrical signals and the near field probes detec electromagnetic emissions.

[[File:Yub_2.PNG]]

[[File:Yub_3.PNG]]

After measuring enough data, the next step is to analyze and interpret these. This involves removing unwanted noise and identifying patterns. By using mathematical algorithms and a trial-and-error approach, the private-key can be extracted.

=== ECDSA ===

Elliptic Curve Digital Signature Algorithm (ECDSA) is one of the most used cryptographic methods encountered daily.
The Concept of ECDSA is a curve that is symmetric about the x-axis. The process begins with selecting a starting point G on this curve and drawing a straight line through G, intersecting the curve in another point. The intersected point is then reflected across the x-axis and producing a new point G2. This procedure continues for k-times, where k is a very large number.

The general equation for an elliptic curve is:

[[File:Yubi4.PNG|200px]]

[[File:Curve_self.PNG|400px]]

The final point after k iterations is denoted as kG, which is important for generating keys and signatures.

A fundamental aspect of ECDSA is its one-way nature: It is easy to compute kG but extremely difficult to determine k if only kG is known.

The private-key d can be calculated using following formula, in which only k and d are unknown:

[[File:Yubi5.PNG|200px]]

After analyzing the Side-Channel-Measurements, the attackers try to extract the variable k, with which they can then calculate the Private-key d.

To verify, whether the extraction of k was successful, the public-key can be validated with following formula:

[[File:Yubi6.PNG|200px]]

=== Practical Execution of an Attack ===

=== Affected Versions ===

== Counter-Measurements==

=== Recommendation for Users ===

=== Recommendation for Manufactures ===

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

File:Yubi5.PNG

2024-12-18T20:28:38Z

LTrifunovic:

YubiKey Cloning Attack

2024-12-18T20:26:48Z

LTrifunovic:

== Summary ==

A YubiKey is a hardware authentication device (Hardware-Token) produced by Yubico. It provides an additional Layer of security for logging into online accounts. It functions as a physical security token for 2-Factor-Authentication (2FA) or Multi-Factor-Authentication (MFA).
The Hardware-Token uses the Elliptic Curve Digital Signature Algorithm (ECDSA) and stores the private-key locally on the device. Before being able to log in, the user has to input the YubiKey into the USB-port and prove the possession of the private-key.
However, attackers have found a way to extract this private-key with a Side-Channel-Attack and clone the YubiKey, enabling unauthorized authentication. The affected device is the YubiKey 5-Series with a firmware version before 5.7.

== General ==

=== Passwords ===

Passwords have been fundamental for authentication for decades and are still the most used authentication method. However, they come with a few weaknesses, which make them vulnerable to data leaks, phishing and identity theft.
Users frequently reuse the same password across multiple accounts. That means, that one single data breach can compromise several accounts.
Also, many create short or predictable passwords, like "123456" or "password". This makes it an easy target for brute-force attacks. Even long passwords with special characters lose their effectiveness if they are reused many times or remain unchanged for long periods.

=== Modern Authentication Methods ===

To address the issues of passwords, other authentication methods were introduced, which offer better security.
*One example are One-Time-Passwords (OTPs): The offer a higher level of protection by generating unique passwords for each login attempt. E.g.: When trying to log in, the user has to input an OTP which was received by E-mail or SMS.
*A variation of OTPs are Time-Based-One-Time-Passwords (TOTPs): These are generated on e.g a Smartphone through some Authenticator Application, like Google Authenticator. TOTPs are created constantly and valid for around 30 seconds, before changed. Because TOTPs are created locally on a user's device, they are harder for attackers to intercept.
*Biometric authentication: Authentication via Biometrics has become increasingly popular, especially on the phones nowadays. This method relies on unique physical characteristics, like fingerprint, facial recognition and iris-scanning. Biometrics are enhancing security by making it difficult for attackers to replicate or steal such information.
*Hardware-Tokens: Finally, small physical devices, which connect to a website login and create a private-key. YubiKey is such a device and allows users to authenticate by physically inputting the Hardware-Token into the Computer and pressing a button, which calculates the private-key and allows authentication. These are seen as very secure and protective against phishing attacks, because they are physical.
Here a picture of a YubiKey:

[[File:Yubi_1.PNG]]

== YubiKey Cloning Attack ==

=== Security of YubiKeys ===
Although YubiKeys are widely trusted for their security, a critical vulnerability was discovered that remained undetected for over 14 years. It was discovered by the security research team NinjaLab, who documented their findings in a 90 page document.
The vulnerability is related to a Side-Channel-Attack, which allows users to extract the private-key and thus clone the YubiKey.

=== Side-Channel-Measurements/Attack ===
The Side-Channel-Attack primarily relies on analyzing the timing behaviour of a device. During cryptographic operations, a YubiKey consumes power and requires a certain amount of time to process each operation. By measuring factors such as power consumption and timing behaviour, patterns can be identified which potentially reveal the private-key.

Before being able to do an attack, it is necessary to perform Side-Channel-Measurements. These measurements focus on various physical properties, such as power consumption, heat dissipation, electromagnetic radiation, acoustic emissions and the timing behaviour.
In the case of a YubiKey, the primary measurements involve timing data, power consumption and electromagnetic singals, which are being measured while sending authentication requests to the device.

Specialized and expensive equipment, such as an oscilloscope (first picture below) and near-field probes (second picture below), are required. The oscilloscope captures precise electrical signals and the near field probes detec electromagnetic emissions.

[[File:Yub_2.PNG]]

[[File:Yub_3.PNG]]

After measuring enough data, the next step is to analyze and interpret these. This involves removing unwanted noise and identifying patterns. By using mathematical algorithms and a trial-and-error approach, the private-key can be extracted.

=== ECDSA ===

Elliptic Curve Digital Signature Algorithm (ECDSA) is one of the most used cryptographic methods encountered daily.
The Concept of ECDSA is a curve that is symmetric about the x-axis. The process begins with selecting a starting point G on this curve and drawing a straight line through G, intersecting the curve in another point. The intersected point is then reflected across the x-axis and producing a new point G2. This procedure continues for k-times, where k is a very large number.

The general equation for an elliptic curve is:

[[File:Yubi4.PNG|200px]]

[[File:Curve_self.PNG|400px]]

The final point after k iterations is denoted as kG, which is important for generating keys and signatures.

A fundamental aspect of ECDSA is its one-way nature: It is easy to compute kG but extremely difficult to determine k if only kG is known.

=== Practical Execution of an Attack ===

=== Affected Versions ===

== Counter-Measurements==

=== Recommendation for Users ===

=== Recommendation for Manufactures ===

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

YubiKey Cloning Attack

Zphisher - Phishing Website Tool

2024-12-18T13:45:39Z

LTrifunovic:

File:Zphisher 8.PNG

2024-12-18T13:42:00Z

LTrifunovic:

Zphisher - Phishing Website Tool

2024-12-18T13:40:11Z

2024-12-18T13:25:37Z

LTrifunovic: Zphisher Git clone command.

== Summary ==
Zphisher Git clone command.

File:Zphisher 1.PNG

2024-12-18T13:23:39Z

LTrifunovic: How to clone Zphisher GitHub.

== Summary ==
How to clone Zphisher GitHub.

Zphisher - Phishing Website Tool

2024-12-16T15:10:27Z

LTrifunovic:

== Summary ==

Zphisher is a Software-Tool that allows users to create and host fake website like Netflix.com, Linkedin.com and many more. Once created, a phishing can be shared with others. If victims put in their credentials in the fake website, the tool will capture and save them.

== Requirements ==

* Operating system: Ubuntu 22.04 LTS (Jammy Jellyfish) 64-bit - (it does work on other versions too, this was the used one)

== Description ==

=== Step 1 ===

The tool is available on GitHub. Thus, we have to clone it on our machine with following command:

*git clone https://github.com/htr-tech/zphisher.git

=== Step 2 ===

A "Zphisher" directory will appear. If we navigate two times into this directory (with cd command), we will see following bash file:

*zphisher.sh

=== Step 3 ===

With this command:

*bash zphisher.sh

the tool can be started. Following page will appear, where we can select a website to clone:

=== Step 4 ===

For this example, we will input the number 8 in order to clone Twitter. The next question is the port forwarding service, for which we will use Cloudflared, thus number 2. We will be asked whether we want a custom port. This is not neccessary, so input "N". The same applies for the question if we want to mask the URL or not -> "N"

=== Step 5 ===

The setup is now finished and we get a page with the link, with which we can access the fake website on any machine.
The fake Twitter website looks like following:

When entering credentials and pressing "Log in", the tool will detect these and print them out. They are saved in a file "auth/usernames.dat". Besides the credentials, the IP-address of the victim is printed out too and saved in "auth/ip-txt".

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Zphisher - Phishing Website Tool

2024-12-16T15:08:20Z

LTrifunovic:

== Summary ==

Zphisher is a Software-Tool that allows users to create and host fake website like Netflix.com, Linkedin.com and many more. Once created, a phishing can be shared with others. If victims put in their credentials in the fake website, the tool will capture and save them.

== Requirements ==

* Operating system: Ubuntu 22.04 LTS (Jammy Jellyfish) 64-bit - (it does work on other versions too, this was the used one)

== Description ==

=== Step 1 ===

The tool is available on GitHub. Thus, we have to clone it on our machine with following command:

*git clone https://github.com/htr-tech/zphisher.git

=== Step 2 ===

A "Zphisher" directory will appear. If we navigate two times into this directory (with cd command), we will see following bash file:

*zphisher.sh

=== Step 3 ===

With this command:

*bash zphisher.sh

the tool can be started. Following page will appear, where we can select a website to clone:

=== Step 4 ===

For this example, we will input the number 8 in order to clone Twitter. The next question is the port forwarding service, for which we will use Cloudflared, thus number 2. We will be asked whether we want a custom port. This is not neccessary, so input "N". The same applies for the question if we want to mask the URL or not -> "N"

=== Step 5 ===

The setup is now finished and we get a page with the link, with which we can access the fake website on any machine.
The fake Twitter website looks like following:

When entering credentials and pressing "Log in", the tool will detect these and print them out. They are saved in a file named ""

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Zphisher - Phishing Website Tool

2024-12-16T14:49:44Z

LTrifunovic:

Zphisher - Phishing Website Tool

2024-12-16T14:30:46Z

LTrifunovic:

Zphisher - Phishing Website Tool

2024-12-16T14:08:35Z

LTrifunovic: Created page with "== Summary == This Tool allows users to create phishing Websites and steal the inputted credentials. == Requirements == * Operating system: Ubuntu 18.04 bionic amd64 * Packages: git emacs In order to complete these steps, you must have followed Some Other Documentation before. == Description == === Step 1 === Enter these commands in the shell echo foo echo bar === Step 2 === Make sure to read * War and Peace * Lord of the Rings * The Baroque Cycle == U..."

== Summary ==

This Tool allows users to create phishing Websites and steal the inputted credentials.

== Requirements ==

* Operating system: Ubuntu 18.04 bionic amd64
* Packages: git emacs

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]