GPN18:U2Fishing: Potential Security Threat Introduced by U2F Key Wrapping Mechanism
Ein Vortrag von Wang Kang auf der GPN18.
More details
Basically, it's because FIDO standard allows Key Wrapping Mechanism. So that the U2F device can only keep a master secret when secure storage capacity has a limit.
My attack scenario is:
1. The attacker extracts the master key during the manufacturing process of an open-source U2F key, in my case is U2F Zero. 2. Attacker clone this U2F key. (In my case, I integrated it with a software U2F implementation.) 3. Attacker gives this U2F key to a victim. 4. assume the victim use this U2F key to register with Google. 5. Attacker gets to know the password from another source. (such as social engineering, or other ways of password phishing) 6. Login.
You can find my PoC here:
https://github.com/scateu/U2Fishing/blob/master/03-key-wrapping.py
In fact, this attack can be detected when an anti-clone counter is well checked, because:
1. It's needed that attacker chooses a bigger counter number so that it's bigger than the last counter number that victim used to login. The best luck of the attack is choosing a counter number only 1 bigger than the counter number in the victim's device. 2. The next time when the victim login, his counter number is smaller than the number recorded on the website. 3.1 Maybe the victim think it is just a matter of network issue, and ignore it. And try again (the counter will increase by 1), and login successfully. In this case, the attacker will not be noticed. 3.2 When the counter number chosen by the attacker is much bigger, the victim will never login to the website again. Because the victim has to press the button on the U2F device a lot of times to make the counter bigger than the last success counter recorded on the website. 3.3 Another chance is that the website doesn't check the counter at all.
After some investigation, I found out that when a counter number revert incident occurs:
1. Some website like Gmail doesn't give a prompt, the webpage doesn't even blink. I don't think a victim will notice anything when this happens. 2. Worse, my email provider Fastmail.com doesn't check the counter at all. That means, at first victim login with a counter number (say 123), then the attacker login with a bigger counter number (say 9999) to pass the counter check, then victim login with a counter number plus one (this time, 124). Fastmail.com will not check. I have already written to them, and get confirmed.
A quick view of my experiment on youtube:
https://www.youtube.com/watch?v=axKrtrOTfcY
Yubikey doesn't offer secret key regeneration. You can see an official answer from https://forum.yubico.com/viewtopic.php?f=33&t=2484
As for other U2F keys, https://github.com/hillbrad/U2FReviews provides a glance at Yubico U2F Security Key, Thetis U2F Security Key, Feitian ePass, Bluink, KEY-ID FIDO U2F Security Key, HyperFIDO Mini, HyperFIDO U2F Security Key, Plug-Up Card Key, Fidesmo Card, SurePassID TapID Card, Feitian MultiPass and VASCO DigiPass SecureClick. At least none of them allegedly supports secret key regeneration.
Links
Fahrplan |
Hauptseite | Feedback | FAQ
What to hack Seitenkanal-Angriffe innerhalb FPGA-Chips RFID/NFC-Grundlagen - A Pentesters Perspective Einführung: Schlangenprogrammiernacht 2018 GameJam Einführung Sprich mit uns! Eine Ermunterung für neue Speaker. Einführung in die Chaosvermittlung Meltdown and Spectre for normal people Channelizing with GnuRadio HTTP Security & Headers Good Patterns for Deep Learning with Tensorflow How we CARE OpenPGP Keys anstarren faheus Finally - Venenerkennung hacken. Practical Cryptography Patterns Automatically Assessing Security and Privacy Properties of Web Sites Concepts and Tooling in Reverse Engineering Deep Learning with Tensorflow from Zero to Hero in 60 Minutes Can you hug yourself? Alles was ihr schon immer über Glasfasern wissen wolltet robotcowboy: A Wearable One-Man-Band Cyborg Performance Project Binary Ninja plugin development Domain-Automatisierung mit cryptdomainmgr Recht auf (k)ein Geschlecht Offenheit der IT Supply Chain einschließlich Tools und Fabs pluto - a not so smart smart watch Persistance of Vision Generative Kunst mit paper.js tuwat:Bildung im Gespräch Hacking a 15$ Quadcop for Adding a Computer Interface for Flight Control How the Internet has changed being Intersex HowTo: Moving Objects Gimmicks into Augmented reality Sysadmin Nightmares 2018 Key to Historical Object Juxtaposition Using and creating console oriented services (such as wttr.in, cheat.sh, rate.sx, etc) Vorlesungsaufzeichnung an der Uni - vollautomatisch Mitgliederverwaltung mit byro Git from the inside Frida - (Game)Hacking mit JavaScript Open Source in High-Performance Networks Language Without Code: The Extremes of Nonprogrammable and Conceptual Programming Languages The Death of Localhost - Hands-on Cloud Development with node.js, PHP, python or your favorite language.. CCCamp 2019 Badge Ideen und Konzepte $QL from Hell Logbuch:Netzpolitik 253 tmux - Warum ein schwarzes Fenster am Bildschirm reicht Go für ProgrammiererInnen automated number plate readers How to ... conflict Crypto für CTFs MicroOrchestra: Electroacoustic Laptop Performance using Pure Data Latin Lounge One Brain, One Keyboard, One Editor Hacking relationships Backstage of the Web: Analysis of IoT Firmwares to Find Web 0-Days Computational Narratives - Philosophical perspectives on Jupyter Notebook Geschichte_n der Informatik Kausalität, nichtlineare Systeme und ein Spiel gr-iridium: Unter der Haube Hold Steering Wheel! Autopilots and Autonomous Driving. Beziehungsnormativität hacken - Workshop zum Thema Polyamorie Editieren unter Unix mit ed(1) That time my great grandfather didn't die Ich komme aus einem anderen Land - Telematik in der Medizin Building security - Coding "Nicht mitten auf der Straße!" oder was bringt die OSM für uns Fußgänger? Build your own Twitter bot! F.U.C.K. Germany - FLTI* und Computer Kram Disintegrating Rockets - Softwarefehler in der Raumfahrt (und wie wir versuchen sie zu vermeiden) Moderne Stoffwindelsysteme Cloud Security Suite - One stop tool for AWS & GCP Security Audit Warum Henry Ford die besseren Web Applikationen gebaut hätte Datacenter in a Box - High Performance Computing mobil Lightning Talks für Fragen AUR Pakete bauen für Anfänger Laserlabyrinth Aerodynamics 101 ada_conf - the making of a separatistic IT conference The Basics Of Audio Compressors an introduction into digital model railroads Ein Exzellenzkodex für den Congress Building your Pen & Paper world Märchenhafte Protokolle kinX: keyboard hacking Pilot I: Decentralised Autonomous Organisation eine Diskussion Die Katze ist der Chef im Haus... Und der Geek muss es ausbaden. Security Champions Interfacedesign aus Designersicht World Domination - more achievable than ever? - GameJam@GPN U2Fishing: Potential Security Threat Introduced by U2F Key Wrapping Mechanism AI and the End of the World horizon EDA - ein Jahr später Moderne Kommandozeilen Werkzeuge Lasst uns Massenverschlüsslung ausrollen! DSGVO - Was bedeutet das für uns? Cthulhu Pen&Paper Session Standards - Gut, dass so Viele zur Auswahl stehen Linux Network Namespaces vs. VRFs Publish your research! - Warum öffentlich finanzierte Forschung nicht veröffentlicht wird Lightning Talks Demoshow SSH Certificates Dezentrale soziale Netzwerke – Theorie und Praxis Hackerspaces.org - Quo vadis? Infrastructure Review and Closing