September 4, 2024 at 12:12PM
Security researchers have discovered a vulnerability in YubiKey 5 that could allow skilled hackers to clone the device, due to a cryptographic flaw. This could impact millions of users relying on YubiKeys for secure authentication. Exploiting the vulnerability demands significant time, expertise, and costly equipment, making it a complex and unlikely occurrence.
From the meeting notes, it is clear that security researchers have discovered a vulnerability in the YubiKey 5 that could allow a dedicated and resourceful hacker to clone the device. This vulnerability is due to a cryptographic flaw, known as a side channel, in the microcontroller of the devices.
The impact of this vulnerability is that, with substantial time, resources, and specialized equipment, an attacker with physical possession of the YubiKey and knowledge of the targeted accounts could potentially recover affected private keys. However, it is important to note that exploiting this vulnerability requires extraordinary resources and the costs involved in setting up such an operation are significant, estimated at about $10,000, with potential to increase by an additional $30,000 for more advanced equipment.
The vulnerability affects YubiKey 5s using firmware 5.7 or below, as well as all Infineon security microcontrollers running the Infineon cryptographic security library. It is emphasized that exploiting this vulnerability would require significant knowledge and sophisticated equipment, making it a highly resource-intensive and difficult endeavor.
NinjaLab, the security researchers who discovered the vulnerability, have highlighted the extensive resources and equipment required to exploit this vulnerability, and stressed that for now, it is still safer to use the impacted products as FIDO hardware authentication tokens.
To summarize, the vulnerability poses a potential risk to the security of YubiKey 5 devices, but exploiting it would necessitate significant time, knowledge, and financial resources, making it a challenging task for potential attackers.