https://ninjalab.io/wp-content/uploads/2024/09/20240903_eucleak.pdf
A new side-channel vulnerability has been discovered in the YubiKey 5, the most widely used hardware token for two-factor authentication based on the FIDO standard. This vulnerability allows attackers to clone the device when they have temporary physical access to it.
The cryptographic flaw resides in a small microcontroller used in many authentication devices, including smartcards and banking systems. Researchers have confirmed that all YubiKey 5 series models are susceptible to cloning. Unfortunately, there is no patch available to fix the vulnerability, leaving affected devices permanently vulnerable.
How the Attack Works
The attack exploits a side-channel vulnerability in the Infineon cryptographic library used in the YubiKey 5. By measuring electromagnetic radiation emitted by the device during authentication, attackers can extract the secret ECDSA key that underpins the token’s security.
The Threat
While the attack requires specialized equipment and expertise, it poses a significant threat to organizations using YubiKey 5 devices for secure authentication. Attackers could potentially use cloned YubiKeys to gain unauthorized access to sensitive systems and data.
Yubico’s Response
Yubico, the manufacturer of YubiKey, has issued an advisory regarding the vulnerability. The company recommends that users of affected devices consider replacing them with newer models that are not vulnerable.
The Importance of Physical Security
This discovery underscores the importance of protecting physical access to security tokens. Organizations should implement strict physical security measures to prevent unauthorized individuals from gaining access to devices.