hmm. I assumed U2F does not protect you from phishing. It just adds a second layer of protection to your account. Protecting you from credential theft.
U2F antiphishing stuff implemented by chrome is just a neat little extra. Is this behaviour of checking the origin in the spec?
Chrome lets hackers phish even 'Unphishable' Yubikey users
11–20 of 113 posts
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#12Earlier quoted context omitted.
They're slowly inventing operating systems, complete with hypervisor technology, with all the gargantuan complexity that it implies, to please big business that wants the client OS to essentially become obsolete.
The web browsers are so much more secure than what we had before (just accepting executable binaries from other people), so I look at this as a way forward.
I'm not that confident. Browsers blindly accept and execute whatever they receive. The more features that get added, the larger surface there is to exploit. A case in point: WebUSB as mentioned in the article.
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#13This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…
> - Don't use U2F because FireFox doesn't support it
It does! Open about:config and switch security.webauth.u2f to true. It'll Just Work.
I've in the recent past modified a barebones Perl webapp to try and understand U2F better, see https://u2fdemo.darkpan.com/
I've been able to log in / use U2F from:
* FF on Windows and OSX
* Chrome on Windows, OSX
* Chrome on Android using either a OTG cable for a U2F USB key, a Bluetooth U2F key, and a NFC U2F key (works if you install Google Authenticator)
* Unfortunately, not FF on Android as I can't find how to enable U2F there yet :/
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#14This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…
Or disable webusb
Or just don't click "Connect" on the USB access permissions prompt when it pops up.
Unfortunately though, as with any phishing attack, this flaw is most likely to be effective against uninformed users, and those users are the least likely to take proactive measures to protect themselves beforehand.
Fortunately:
> "We will have a short term mitigation in place in the upcoming version of Chrome, and we're working closely with the FIDO Alliance to develop a longer-term solution as well."
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#15This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…
> - Don't use U2F because FireFox doesn't support it It does! Open about:config and switch security.webauth.u2f to true. It'll Just Work. I've in the recent past modified a barebones Perl webapp to try and understand U2F better, see https://u2fdemo.darkpan.com/ I've been able to log in / use U2F from: * FF on Windows and OSX * Chrome on Windows, OSX * Chrome on Android using either a OTG cable for a U2F USB key, a Bl…
ok scratch that, use firefox then
but still hardly anything supports U2f :-(
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#16Earlier quoted context omitted.
Or disable webusb
Or just don't click "Connect" on the USB access permissions prompt when it pops up. Unfortunately though, as with any phishing attack, this flaw is most likely to be effective against uninformed users, and those users are the least likely to take proactive measures to protect themselves beforehand. Fortunately: > "We will have a short term mitigation in place in the upcoming version of Chrome, and we're working close…
What kind of uniformed user uses a YubiKey?
I supposed you could trick them by saying that the login process has changed and they need to enable WebUSB to let their YubiKey work
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#17hmm. I assumed U2F does not protect you from phishing. It just adds a second layer of protection to your account. Protecting you from credential theft. U2F antiphishing stuff implemented by chrome is just a neat little extra. Is this behaviour of checking the origin in the spec?
The supposed ability to tap the yubikey button even on phishing sites and not actually give up working credentials was like the selling point.
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#18It's almost as if browsers are slowing reinventing Java applets while ignoring all of the security implications that go along with it.
But if we ever stopped adding features, things might start working as intended.
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#19Didn't lots of people suggest this kind of thing as a potential issue when WebUSB was first mooted?
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#20I'm unclear as to how this would work in practice. Chrome supports U2F out of the box, so getting a big weird pop-up asking to access your USB device, you'd at least be suspicious. Upon registration, the server also collects a nonce, which is used for verification[0]. The attackers would need to get that nonce from the site. Hopefully, the site disables CORS so a phishing site cannot request a challenge. Lastly, on L…
Part of the problem is that, assuming you didn't know much about how U2F works, it seems pretty natural for a site to request access to your YubiKey in order to use it to authenticate you.
While its obviously not a total solution, I do think that maybe the permissions prompt should be a bit more scary: https://developers.google.com/web/updates/images/2016-03-02-...
I'd rephrase that to something more along the lines of "example.com wants full control of". Maybe with an option for device manufacturers to opt-in to support for WebUSB, allowing for protocol enhancements to improve security and a less scary permissions prompt.