YubiKey Cloning Attack

Summary

A YubiKey is a hardware authentication device (Hardware-Token) produced by Yubico. It provides an additional Layer of security for logging into online accounts. It functions as a physical security token for 2-Factor-Authentication (2FA) or Multi-Factor-Authentication (MFA). The Hardware-Token uses the Elliptic Curve Digital Signature Algorithm (ECDSA) and stores the private-key locally on the device. Before being able to log in, the user has to input the YubiKey into the USB-port and prove the possession of the private-key. However, attackers have found a way to extract this private-key with a Side-Channel-Attack and clone the YubiKey, enabling unauthorized authentication. The affected device is the YubiKey 5-Series with a firmware version before 5.7.

General

Passwords

Passwords have been fundamental for authentication for decades and are still the most used authentication method. However, they come with a few weaknesses, which make them vulnerable to data leaks, phishing and identity theft. Users frequently reuse the same password across multiple accounts. That means, that one single data breach can compromise several accounts. Also, many create short or predictable passwords, like "123456" or "password". This makes it an easy target for brute-force attacks. Even long passwords with special characters lose their effectiveness if they are reused many times or remain unchanged for long periods.

Modern Authentication Methods

To address the issues of passwords, other authentication methods were introduced, which offer better security.

• One example are One-Time-Passwords (OTPs): The offer a higher level of protection by generating unique passwords for each login attempt. E.g.: When trying to log in, the user has to input an OTP which was received by E-mail or SMS.
• A variation of OTPs are Time-Based-One-Time-Passwords (TOTPs): These are generated on e.g a Smartphone through some Authenticator Application, like Google Authenticator. TOTPs are created constantly and valid for around 30 seconds, before changed. Because TOTPs are created locally on a user's device, they are harder for attackers to intercept.
• Biometric authentication: Authentication via Biometrics has become increasingly popular, especially on the phones nowadays. This method relies on unique physical characteristics, like fingerprint, facial recognition and iris-scanning. Biometrics are enhancing security by making it difficult for attackers to replicate or steal such information.
• Hardware-Tokens: Finally, small physical devices, which connect to a website login and create a private-key. YubiKey is such a device and allows users to authenticate by physically inputting the Hardware-Token into the Computer and pressing a button, which calculates the private-key and allows authentication. These are seen as very secure and protective against phishing attacks, because they are physical.

Courses

• A course where this documentation was used (2017, 2018)
• Another one (2018)

References

• https://wikipedia.org
• https://google.com