9 ms·
This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the
by crispyporkbites 9y ago
This is the attack:
> If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account.
So basically they are somehow able to trick the yubikey neo into accepting a challenge from a different domain, by using the webusb API.
Reading further:
> The technique would only work with U2F keys that offer protocols for connecting to a browser other than the usual way U2F tokens communicate with a computer, known as the Human Interface Device or HID, which isn't vulnerable to the attack. The Yubikey Neo, for instance, can also connect via the CCID interface used by smartcard readers
> An assumption was made by Chrome that all U2F is HID, which doesn't hold for the Neo, whereas Yubico made an assumption that USB will never be accessible by web pages directly
So:
- Don't use a Yubikey Neo anymore
- Don't use Chrome
- Don't use U2F because FireFox doesn't support it
- Never use your yubikey because hardly anything supports it
Sigh
- m-p-3 9y agoHopefully better support for U2F devices is on the way at both the browser and website level. I wish more websites offered the option to use it.
- ilikepi 9y agoPresumably you are referring to WebAuthn[1]. I am optimistic that this will lead to better browser support, and consequently better website support. IIRC it's expected to reach Firefox stable in the May release. Hopefully the various sites that currently only support U2F in Chrone will move to this new standard. [1]: https://www.w3.org/Webauthn https://www.w3.org/Webauthn
- SahAssar 9y agoOr disable webusb
- Ajedi32 9y agoOr just don't click "Connect" on the USB access permissions prompt when it pops up. Unfortunately though, as with any phishing attack, this flaw is most likely to be effective against uninformed users, and those users are the least likely to take proactive measures to protect themselves beforehand. Fortunately: > "We will have a short term mitigation in place in the upcoming version of Chrome, and we're working closely with the FIDO Alliance to develop a longer-term solution as well."
- crispyporkbites 9y agoWhat kind of uniformed user uses a YubiKey? I supposed you could trick them by saying that the login process has changed and they need to enable WebUSB to let their YubiKey work
- jessaustin 9y agoThis seems to indicate that DoD uses them. Perhaps it's mostly contractors, but there are probably some liaison-type uniformed people too: https://www.yubico.com/about/reference-customers/department-defense/ https://www.yubico.com/about/reference-customers/department-...
- x0x0 9y agotqbf, pinboard, and zeynep are handing them out to journalists. There is an enormous need for some solution resistant to users who aren't good at identifying legitimate vs phishing sites. U2F as it stands is the only practical and deployed solution to that problem. It's infuriating that chrome broke this security promise to compete with microsoft.
- tedunangst 9y agoUninformed users who have an informed friend looking out for them but not looking over their shoulder every single minute.
- cjcfjrf 9y ago
- mfontani 9y ago> - Don't use U2F because FireFox doesn't support it It does! Open about:config and switch security.webauth.u2f to true. It'll Just Work. I've in the recent past modified a barebones Perl webapp to try and understand U2F better, see https://u2fdemo.darkpan.com/ https://u2fdemo.darkpan.com/ I've been able to log in / use U2F from: * FF on Windows and OSX * Chrome on Windows, OSX * Chrome on Android using either a OTG cable for a U2F USB key, a Bluetooth U2F key, and a NFC U2F key (works if you install Google Authenticator) * Unfortunately, not FF on Android as I can't find how to enable U2F there yet :/
- crispyporkbites 9y agook scratch that, use firefox then but still hardly anything supports U2f :-(
- Slansitartop 9y agoNot everything supports U2F, but plenty of things do, many of them high value services: http://www.dongleauth.info/ http://www.dongleauth.info/
- mondoshawan 9y agoIt works, but only partially, and is still very very broken, which is why it is disabled in the first place. See also this bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1065729 https://bugzilla.mozilla.org/show_bug.cgi?id=1065729
- phyzome 9y agoNonsense. It works fine on Github, Fastmail, Gandi... it doesn't work on Google because Google uses a different spec. That bug is about making Firefox compatible with the variation that Chrome/Google uses.
- uiri 9y agoThat bug mentions that Facebook is also broken. I am kind of surprised that the sites you mention can implement the spec correctly but Facebook and Google can't.
- skybrian 9y agoMore importantly: "the phishing site would also have to ask the user's permission to enable WebUSB access to their Yubikey, and then tap the physical button on the key." So don't do that. It would be nice to know exactly what this dialog looks like, but it seems low risk?
- pfg 9y agoConvincing users to grant access to a USB device when they're attempting to log in to a service using said USB device sounds like something that would work more often than not. We wouldn't need phishing-resistant authentication methods if humans were good enough at making those kinds of decisions.
- stevehawk 9y agoI have to admit that in all of my use of my Yubikey Neo in Chrome I don't recall ever being asked for permission to access the device. Firefox hasn't asked either.
- pfg 9y agoI'm not saying that you need to grant any kind of permission in order to use U2F tokens, but rather that a user thinking "I want to login to Google" and "I need to use that USB key thingy to do that" is quite likely to accept a prompt that requests access to the U2F device.
- stevehawk 9y agoSorry, I guess what I was getting at is that in hindsight I'm surprised no browser ever explicitly asked me for access to the Yubikey or told me why it needed, I've just blindly trusted it because of the few sites I use it with. On the other hand, it's basically functioning as another keyboard device and not a special USB device so it shouldn't be that surprising, right? (serious question)
- Buge 9y ago>So don't do that. How about you tell users to simply not enter their password into phishing sites? When users want to do something (sign in) and there are instructions on the page telling them to do something (enter password or accept usb) then the users will do it.
- Sir_Cmpwn 9y agoThe existence of WebUSB is awful. Why anyone ever thought it was a good idea to let JavaScript touch your USB devices is beyond me.
- emilfihlman 9y ago...Wat. What you said is wrong on so many levels.
- omni 9y agoThis comment added nothing, in the future please consider offering substantive criticisms.
- Ajedi32 9y agoIt's simple: allowing sandboxed code to request limited access to a USB device is more secure than having users install native, unsandboxed code with access to everything on their PC.
- tedunangst 9y agoAssuming the sandbox works. If the sandbox is porous, the attack surface balloons from apps I choose to install to every link I click.
- Ajedi32 9y agoNot every link you click. Only sites that you grant access to the necessary attack surface. The Web USB API can't be attacked by sites that you haven't granted access to it.
- codedokode 9y agoWhat if that privileged website has XSS vulnerability?
- 9y ago
- ravenstine 9y agoI didn't even realize web USB was a thing now. I remember it being talked about, but I must have missed the HN conversation when Chrome implemented it. So does Chrome ask for permission to allow USB access? Or maybe there's something about this I'm not getting.
- pfg 9y agoThere is a permission prompt, but it's fairly easy to convince users to accept it during a login attempt when they're expecting their USB U2F device to be used.
- Shoothe 9y agoIt's surprising that this works. Last time I checked WebUSB the device would have to have a descriptor allowing its use via web page effectively white listing what can be used on the web.
- Ajedi32 9y agoLooks like they changed it: https://wicg.github.io/webusb/#attacking-a-device https://wicg.github.io/webusb/#attacking-a-device While I understand the reasoning behind that move, I'm not sure I fully agree with it. I don't think users will necessarily understand the implications of granting a site access to a device that wasn't designed with attacks from malicious code as part of its threat model. At the very least, the wording on the permissions dialog should be changed to indicate that the user is granting the site _full control_ over the device they're connecting it to.
- deleted 9y ago[deleted]
- tyler_larson 9y agoIt sounds like the report glossed over a rather important bit of ux: If, when logging in, you see a big modal dialog asking if you want to grant webusb access to the site, then DONT select your yubikey out of the list of connected USB devices and click "Allow". As long as you can convince yourself to avoid taking that particular unusual action, it sounds like you're fine.
- tinus_hn 9y agoIf the user thinks the site is Google it’s not that strange they’d give them access to the key.
- decko 9y agoYou can disable CCID, does that not solve the issue?