GPN18:U2Fishing: Potential Security Threat Introduced by U2F Key Wrapping Mechanism
Ein Vortrag von Wang Kang auf der GPN17.
More details
Basically, it's because FIDO standard allows Key Wrapping Mechanism. So that the U2F device can only keep a master secret when secure storage capacity has a limit.
My attack scenario is:
1. The attacker extracts the master key during the manufacturing process of an open-source U2F key, in my case is U2F Zero. 2. Attacker clone this U2F key. (In my case, I integrated it with a software U2F implementation.) 3. Attacker gives this U2F key to a victim. 4. assume the victim use this U2F key to register with Google. 5. Attacker gets to know the password from another source. (such as social engineering, or other ways of password phishing) 6. Login.
You can find my PoC here:
https://github.com/scateu/U2Fishing/blob/master/03-key-wrapping.py
In fact, this attack can be detected when an anti-clone counter is well checked, because:
1. It's needed that attacker chooses a bigger counter number so that it's bigger than the last counter number that victim used to login. The best luck of the attack is choosing a counter number only 1 bigger than the counter number in the victim's device. 2. The next time when the victim login, his counter number is smaller than the number recorded on the website. 3.1 Maybe the victim think it is just a matter of network issue, and ignore it. And try again (the counter will increase by 1), and login successfully. In this case, the attacker will not be noticed. 3.2 When the counter number chosen by the attacker is much bigger, the victim will never login to the website again. Because the victim has to press the button on the U2F device a lot of times to make the counter bigger than the last success counter recorded on the website. 3.3 Another chance is that the website doesn't check the counter at all.
After some investigation, I found out that when a counter number revert incident occurs:
1. Some website like Gmail doesn't give a prompt, the webpage doesn't even blink. I don't think a victim will notice anything when this happens. 2. Worse, my email provider Fastmail.com doesn't check the counter at all. That means, at first victim login with a counter number (say 123), then the attacker login with a bigger counter number (say 9999) to pass the counter check, then victim login with a counter number plus one (this time, 124). Fastmail.com will not check. I have already written to them, and get confirmed.
A quick view of my experiment on youtube:
https://www.youtube.com/watch?v=axKrtrOTfcY
Yubikey doesn't offer secret key regeneration. You can see an official answer from https://forum.yubico.com/viewtopic.php?f=33&t=2484
As for other U2F keys, https://github.com/hillbrad/U2FReviews provides a glance at Yubico U2F Security Key, Thetis U2F Security Key, Feitian ePass, Bluink, KEY-ID FIDO U2F Security Key, HyperFIDO Mini, HyperFIDO U2F Security Key, Plug-Up Card Key, Fidesmo Card, SurePassID TapID Card, Feitian MultiPass and VASCO DigiPass SecureClick. At least none of them allegedly supports secret key regeneration.
Links
Fahrplan |
Hauptseite | Feedback | FAQ
2³² Stars In The Sky Abschlussrunde mit Vorstellung FreifunkBW::Camp Alice explodiert! Begrüßung und Einleitung Bondage-Workshop BorgBackup Treffen Build yourself a SNMP replacement Building a Photobooth Closing und Review Combining the Intertubes using Multipath TCP Critical Mass CyberMorning Show Cybern Demoshow Die manpages.debian.org-Modernisierung Digitalisierte Stromnetze und Smart Meter in Deutschland Einführung Infotresen Einführung in Onshape Einführung in die Chaosvermittlung Electronic GeekBag Esoterische Programmiersprachen FreeBSD: The Power to Serve a Community Freifunk Interconnectivity Freifunk-Admin-Talkrunde From Mirai to Apple Guerilla Stricken Gulasch Karaoke Gulaschausgabe HTTP Security Header Hack the Badge - Preisverleihung Hackertours Haecksenfryhstyck How to fly to the Moon How we bodged the Badge Improving the Web of Trust with GNOME Keysign Introduction to Automated Binary Analysis Jonglier-Workshop Lightning Talks Lossless Data Compression Mammut statt Vogel Mate Making DIY McFly McFly Menstruation Matters Mitgliederverwaltung für Erfas My Little Pony - Videoanalyse ist Magie Network Flow Analysis using Netflow protocols and tflow2 Neues ECAD-Programm horizon OWASP TOP 10 OWASP Top 10 Privacy Risks Project PGP Keysigning Panik überall Pixel-Art Workshop Playing Studio Sets Live with Ableton Podcasten QR-Codes SHA2017 Orga Meet @ GPN17 Salt-Orchestrated Software Defined Freifunk Backbone im Hochstift Smarthome mit ioBroker Sysadmin Nightmares The Elektr0nic Window Towards a more secure operating system without sacrificing usability Vertrauen ist gut, Kontrolle ist besser. Virtual Reality mit Freier Software WCW 2017 Livestream Webserversecurity 101 Werwölfe von Düsterwald What to hack Wie kommt eigentlich das Internet von Hamburg nach Stuttgart? ZFS replication with zrepl ffbw.de Workshop git-dit gokrazy: ein Go userland für Raspberry Pi 3 appliances hacking galaxy S8 iris recognition small modifications and embodied connectivity the dark side of the wifi Æ-DIR Installation Workshop