YubiKey Cloning Attack

Summary

A YubiKey is a hardware authentication device (Hardware-Token) produced by Yubico. It provides an additional Layer of security for logging into online accounts. It functions as a physical security token for 2-Factor-Authentication (2FA) or Multi-Factor-Authentication (MFA). The Hardware-Token uses the Elliptic Curve Digital Signature Algorithm (ECDSA) and stores the private-key locally on the device. Before being able to log in, the user has to input the YubiKey into the USB-port and prove the possession of the private-key. However, attackers have found a way to extract this private-key with a Side-Channel-Attack and clone the YubiKey, enabling unauthorized authentication. The affected device is the YubiKey 5-Series with a firmware version before 5.7.

General

Passwords

Passwords have been fundamental for authentication for decades and are still the most used authentication method. However, they come with a few weaknesses, which make them vulnerable to data leaks, phishing and identity theft. Users frequently reuse the same password across multiple accounts. That means, that one single data breach can compromise several accounts. Also, many create short or predictable passwords, like "123456" or "password". This makes it an easy target for brute-force attacks. Even long passwords with special characters lose their effectiveness if they are reused many times or remain unchanged for long periods.

Modern Authentication Methods

To address the issues of passwords, other authentication methods were introduced, which offer better security.

• One example are One-Time-Passwords (OTPs): The offer a higher level of protection by generating unique passwords for each login attempt. E.g.: When trying to log in, the user has to input an OTP which was received by E-mail or SMS.
• A variation of OTPs are Time-Based-One-Time-Passwords (TOTPs): These are generated on e.g a Smartphone through some Authenticator Application, like Google Authenticator. TOTPs are created constantly and valid for around 30 seconds, before changed. Because TOTPs are created locally on a user's device, they are harder for attackers to intercept.
• Biometric authentication: Authentication via Biometrics has become increasingly popular, especially on the phones nowadays. This method relies on unique physical characteristics, like fingerprint, facial recognition and iris-scanning. Biometrics are enhancing security by making it difficult for attackers to replicate or steal such information.
• Hardware-Tokens: Finally, small physical devices, which connect to a website login and create a private-key. YubiKey is such a device and allows users to authenticate by physically inputting the Hardware-Token into the Computer and pressing a button, which calculates the private-key and allows authentication. These are seen as very secure and protective against phishing attacks, because they are physical.

Here a picture of a YubiKey:

YubiKey Cloning Attack

Security of YubiKeys

Although YubiKeys are widely trusted for their security, a critical vulnerability was discovered that remained undetected for over 14 years. It was discovered by the security research team NinjaLab, who documented their findings in a 90 page document. The vulnerability is related to a Side-Channel-Attack, which allows users to extract the private-key and thus clone the YubiKey.

Side-Channel-Measurements/Attack

The Side-Channel-Attack primarily relies on analyzing the timing behaviour of a device. During cryptographic operations, a YubiKey consumes power and requires a certain amount of time to process each operation. By measuring factors such as power consumption and timing behaviour, patterns can be identified which potentially reveal the private-key.

Before being able to do an attack, it is necessary to perform Side-Channel-Measurements. These measurements focus on various physical properties, such as power consumption, heat dissipation, electromagnetic radiation, acoustic emissions and the timing behaviour. In the case of a YubiKey, the primary measurements involve timing data, power consumption and electromagnetic singals, which are being measured while sending authentication requests to the device.

Specialized and expensive equipment, such as an oscilloscope (first picture below) and near-field probes (second picture below), are required. The oscilloscope captures precise electrical signals and the near field probes detec electromagnetic emissions.

Courses

• A course where this documentation was used (2017, 2018)
• Another one (2018)

References

• https://wikipedia.org
• https://google.com