Chrome lets hackers phish even 'Unphishable' Yubikey users
1–10 of 113 posts
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#2This is the attack:
> If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account.
So basically they are somehow able to trick the yubikey neo into accepting a challenge from a different domain, by using the webusb API.
Reading further:
> The technique would only work with U2F keys that offer protocols for connecting to a browser other than the usual way U2F tokens communicate with a computer, known as the Human Interface Device or HID, which isn't vulnerable to the attack. The Yubikey Neo, for instance, can also connect via the CCID interface used by smartcard readers
> An assumption was made by Chrome that all U2F is HID, which doesn't hold for the Neo, whereas Yubico made an assumption that USB will never be accessible by web pages directly
So:
- Don't use a Yubikey Neo anymore
- Don't use Chrome
- Don't use U2F because FireFox doesn't support it
- Never use your yubikey because hardly anything supports it
Sigh
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#3This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…
Hopefully better support for U2F devices is on the way at both the browser and website level.
I wish more websites offered the option to use it.
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#4It's almost as if browsers are slowing reinventing Java applets while ignoring all of the security implications that go along with it.
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#5The Yubikey is great and has uses outside of U2F, which I've never had much faith in.
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#6This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…
Hopefully better support for U2F devices is on the way at both the browser and website level. I wish more websites offered the option to use it.
Presumably you are referring to WebAuthn[1]. I am optimistic that this will lead to better browser support, and consequently better website support. IIRC it's expected to reach Firefox stable in the May release. Hopefully the various sites that currently only support U2F in Chrone will move to this new standard.
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#7It's almost as if browsers are slowing reinventing Java applets while ignoring all of the security implications that go along with it.
They're slowly inventing operating systems, complete with hypervisor technology, with all the gargantuan complexity that it implies, to please big business that wants the client OS to essentially become obsolete.
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#8It's almost as if browsers are slowing reinventing Java applets while ignoring all of the security implications that go along with it.
They're slowly inventing operating systems, complete with hypervisor technology, with all the gargantuan complexity that it implies, to please big business that wants the client OS to essentially become obsolete.
The web browsers are so much more secure than what we had before (just accepting executable binaries from other people), so I look at this as a way forward.
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#9I'm unclear as to how this would work in practice. Chrome supports U2F out of the box, so getting a big weird pop-up asking to access your USB device, you'd at least be suspicious.
Upon registration, the server also collects a nonce, which is used for verification[0]. The attackers would need to get that nonce from the site. Hopefully, the site disables CORS so a phishing site cannot request a challenge.
Lastly, on Linux (I know, a minority), you need to make an entry in rules.d[1] to even allow Chromium to access USB devices.
I can see how this potentially maybe could catch someone, but I don't see it as much of a risk.
[0]: https://blog.fastmail.com/2016/07/23/how-u2f-security-keys-w... [1]: https://developers.google.com/web/updates/2016/03/access-usb...
Re: Chrome lets hackers phish even 'Unphishable' Yubikey users
#10This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…
Or disable webusb