Chrome lets hackers phish even 'Unphishable' Yubikey users

Post by rdtsc » Fri, Mar 02, 2018, 5:37 PM UTC

mfontani wrote: post #13

crispyporkbites wrote: post #2

This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…

> - Don't use U2F because FireFox doesn't support it It does! Open about:config and switch security.webauth.u2f to true. It'll Just Work. I've in the recent past modified a barebones Perl webapp to try and understand U2F better, see https://u2fdemo.darkpan.com/ I've been able to log in / use U2F from: * FF on Windows and OSX * Chrome on Windows, OSX * Chrome on Android using either a OTG cable for a U2F USB key, a Bl…

Post by Ajedi32 » Fri, Mar 02, 2018, 5:47 PM UTC

Sir_Cmpwn wrote: post #26

crispyporkbites wrote: post #2

This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…

The existence of WebUSB is awful. Why anyone ever thought it was a good idea to let JavaScript touch your USB devices is beyond me.

Post by x0x0 » Fri, Mar 02, 2018, 5:53 PM UTC

crispyporkbites wrote: post #16

Ajedi32 wrote: post #14

Earlier quoted context omitted.

Or just don't click "Connect" on the USB access permissions prompt when it pops up. Unfortunately though, as with any phishing attack, this flaw is most likely to be effective against uninformed users, and those users are the least likely to take proactive measures to protect themselves beforehand. Fortunately: > "We will have a short term mitigation in place in the upcoming version of Chrome, and we're working close…

What kind of uniformed user uses a YubiKey? I supposed you could trick them by saying that the login process has changed and they need to enable WebUSB to let their YubiKey work

Post by tedunangst » Fri, Mar 02, 2018, 5:57 PM UTC

crispyporkbites wrote: post #16

Ajedi32 wrote: post #14

Earlier quoted context omitted.

Or just don't click "Connect" on the USB access permissions prompt when it pops up. Unfortunately though, as with any phishing attack, this flaw is most likely to be effective against uninformed users, and those users are the least likely to take proactive measures to protect themselves beforehand. Fortunately: > "We will have a short term mitigation in place in the upcoming version of Chrome, and we're working close…

What kind of uniformed user uses a YubiKey? I supposed you could trick them by saying that the login process has changed and they need to enable WebUSB to let their YubiKey work

Post by Sir_Cmpwn » Fri, Mar 02, 2018, 6:51 PM UTC

Ajedi32 wrote: post #33

Sir_Cmpwn wrote: post #26

Earlier quoted context omitted.

The existence of WebUSB is awful. Why anyone ever thought it was a good idea to let JavaScript touch your USB devices is beyond me.

It's simple: allowing sandboxed code to request limited access to a USB device is more secure than having users install native, unsandboxed code with access to everything on their PC.