13 ms·

Vendors, Disclosure, and a bit of WebUSB Madness

175 points by jwildeboer 8y ago

moepstar 8y ago
If that account is true, this definitively has some "smell" to it...
mehrdadn 8y ago
Ouch. > Also there seems to be a kind of relationship between Google and Yubico that I would love to know more about. I've gotten this impression too, though looking back, it may be because Google suggests you Google for U2F, and every time I search for U2F I see Yubico. Anyone know more about this?
- kaendfinger 8y ago
  The real reason is Google buys YubiKeys enmasse from them for employee use (every employee has one), and works with them closely on in various ways. In fact, they were closely involved when developing the USB Type-C variant.
  - baybal2 8y ago
    Can you elaborate more on that? To my knowledge, it was the Intel, TI, Tyco, STM quadriga who was responsible for the nearly complete standard of USB Type-C, with software/consumer industry being given "eat or die" choice, with Apple's engineers apparently actually trying to stall the standard release.
    - kaendfinger 8y ago
      If you meant to reply to my comment, Google is perhaps the largest deployer of Yubico products, and that is where their collaboration holds the most weight. If there is a security issue with YubiKeys, it puts Google's corporate systems at risk.
      - baybal2 8y ago
        I was asking about Usb type c. To my knowledge, Apple, MS, and Google were there just to give blessings on RFCs
    - HALtheWise 8y ago
      I think he tried to say that Google was heavily involved with the development of the USB-C variant of the Ubikey (for example, for use with MacBook pros) rather than with the USB-C standard itself.
- geofft 8y ago
  Yes, the U2F spec was developed by Google and Yubico, founding members of the FIDO Alliance. Google seems happy to have more companies on board—their Advanced Protection Program, which requires getting two security keys, suggests buying a Feitian device (which supports U2F as well as Google Smart Lock on iOS via a non-U2F Bluetooth protocol) and a Yubico one.
crunchlibrarian 8y ago
I am starting to wonder how many breaches there have actually been of Google user data, they are so secretive and insular it wouldn't surprise me in the least if it has happened multiple times and was covered up. In the future, as these mega corporations become even larger and more powerful, brave employees who are willing to violate NDAs are the only source of info we will have at all.
geofft 8y ago
> Also there seems to be a kind of relationship between Google and Yubico that I would love to know more about. Google and Yubico developed U2F, so.... Still, precisely because of this, I would say it's poor form for Google to award Yubico a bug bounty relating to U2F (would they award a bug bounty to an Android manufacturer for a kernel bug?). It also seems like poor form for Yubico not to disclose their research when asking about the same topic to another researcher, and poor form for Google to be unwilling to award two bounties (this isn't the patent office, acknowledging and even incentivizing multiple discovery is fine).
anfedorov 8y ago
Was there some work-around I'm missing or did they literally go "yeah this website can send anything to the YK device directly, waht could go wrong?". Because the folks at Google Security are definitely smart and many orders of magnitude more experienced than me, and that's a vuln even I can understand / see the problem with so something institutional must have gone way wrong if WebUSB shipped on the stable release without some kind of block-U2F-forgery filter. As far as Yubico, I get that they are doing something pretty hard in the hardware / product-market-fit domains, and I respect that and I want them to succeed, but they appear to be seriously dropping the ball on the software part of their product [1], as well as "simplicity breeds security". They could do so much better on the actual UI/UX if they piece-by-piece copied the setup UX of a "smart" vacuum cleaner. 1. I emailed & on-site support ticket submitted them days ago about some of their certs having expired on 2017-05-10, and have gotten not a peep in response & no fix in sight. Did nobody set a team calendar reminder and is nobody responsible for checking it on a monthly / quarterly / at the very least end-of-year cycle? That seems pretty elementary "underwear goes inside the pants" kind of security competence. https://i.imgur.com/bOCfXJ2.png https://i.imgur.com/bOCfXJ2.png https://developers.yubico.com/yubikey-neo-manager/Releases/yubikey-neo-manager-1.4.0-mac.pkg https://developers.yubico.com/yubikey-neo-manager/Releases/y...
- michaelt 8y ago
  did they literally go "yeah this website can send anything to the YK device directly, waht could go wrong?". WebUSB displays a prompt, albeit an uninformative one [1]. The idea is to trick the user into enabling WebUSB when they think they're enabling U2F. [1] https://developers.google.com/web/updates/images/2016-03-02-access-usb-devices-on-the-web/usb-device-chooser.png https://developers.google.com/web/updates/images/2016-03-02-...
  - floatboth 8y ago
    Well that clearly doesn't look like a U2F prompt. Of course U2F devices should be excluded from the list, and there should be some warning text about "do not allow important devices on random websites", but that doesn't seem like a huge deal.
WhatsName 8y ago
This is what bugs me a lot, when it comes to bugbounties including HackerOne. The absolute lack of accountability and transparency. One can only hope the companies act in good faith. In my opinion this should rather be handled by an independet organisaton like the CERT community or since it's a vital security interest at state level. Though latter might be prone to conflicting interests as well.
curiousgal 8y ago
>To make it clear: I’m not after fame, credits, or want to take some bounty away from @girlswhocode! Why mention them then, if not to pressure them into refunding the donation?
- rrix2 8y ago
  Or to point out that the researchers’ beef is with Google and Yubico and not the nonprofit? To correct an injustice of two corporations who are collaborating to shaft an independent researcher? There’s a lot of reasons if you give even a shred of benefit of the doubt to the author of the piece.
- philliphaydon 8y ago
  I assume to call them out. If someone pulls a dick move once and gets away with it. They will do it again. If they get called out they will think twice next time.
  - curiousgal 8y ago
    The charity had nothing to do with this. They didn't choose to be the recipients of a 'stolen' bounty.
    - philliphaydon 8y ago
      I'm not sure where I mentioned charity? I wrote an assumption based on what i read in the article.
pdkl95 8y ago
> We realized this is not limited to U2F / FIDO and developed a generic proxy that allows to forward any USB device exposed to WebUSB to a remote system. ~sigh~ It's really depressing to learn that reality was much worst than any of my "this is going to end badly" predictions[1]. I originally thought[2] the problems would start on the hardware side with devices that were never designed for security. Forwarding everything with a proxy is shockingly worse. [1] https://news.ycombinator.com/item?id=11466197 https://news.ycombinator.com/item?id=11466197 [2] https://news.ycombinator.com/item?id=11466415 https://news.ycombinator.com/item?id=11466415
- anfedorov 8y ago
  Aside from the "no HID" (does a YK even count as a HID if you turn off the default slot 1 functionality?), was the proxy designed to have a firewall / sandboxing of some sort? Google engineers have done some incredible things and while ambitious, it seems this kind of thing is well within their reach.
mtgx 8y ago
WebUSB was an obviously bad idea right from the start, just like Web Bluetooth was, both of which I believe were proposed by Google. It all comes from this nonsense idea from Google that "all devices should be directly connected to the internet" (and thus owned by botnets). Mozilla team, if you're reading, please reject implementing or at least enabling such APIs with extremely high-risk to the user by default in your browser - "sandbox" or not.
- baybal2 8y ago
  I'm seconding that with demand to sanitize all useless, bug prone APIs google introduced solely for own use.
- anfedorov 8y ago
  Why is it an obviously bad idea? In light of the work on NaCL, is there still no way you can imagine it could ever work?
  - pjc50 8y ago
    What does NaCL have to do with this, it's a cryptography library? The issue is that 99.99% of USB devices aren't designed with the possibility of hostile payloads coming from the host, so the security rests entirely on the webusb permission dialog. Which should be presented as "grant this website administrative access to your computer" but isn't.
    - rrix2 8y ago
      > What does NaCL have to do with this, it's a cryptography library? The other NaCl https://developer.chrome.com/native-client https://developer.chrome.com/native-client
    - anfedorov 8y ago
      Could the browser create a tight whitelist of payloads that are definitely not hostile, then expand it slowly to add functionality?
  - 8y ago

175 points by jwildeboer 8y ago

If that account is true, this definitively has some "smell" to it...

Ouch. > Also there seems to be a kind of relationship between Google and Yubico that I would love to know more about. I've gotten this impression too, though looking back, it may be because Google suggests you Google for U2F, and every time I search for U2F I see Yubico. Anyone know more about this?

kaendfinger 8y ago
The real reason is Google buys YubiKeys enmasse from them for employee use (every employee has one), and works with them closely on in various ways. In fact, they were closely involved when developing the USB Type-C variant.
- baybal2 8y ago
  Can you elaborate more on that? To my knowledge, it was the Intel, TI, Tyco, STM quadriga who was responsible for the nearly complete standard of USB Type-C, with software/consumer industry being given "eat or die" choice, with Apple's engineers apparently actually trying to stall the standard release.
  - kaendfinger 8y ago
    If you meant to reply to my comment, Google is perhaps the largest deployer of Yubico products, and that is where their collaboration holds the most weight. If there is a security issue with YubiKeys, it puts Google's corporate systems at risk.
    - baybal2 8y ago
      I was asking about Usb type c. To my knowledge, Apple, MS, and Google were there just to give blessings on RFCs
  - HALtheWise 8y ago
    I think he tried to say that Google was heavily involved with the development of the USB-C variant of the Ubikey (for example, for use with MacBook pros) rather than with the USB-C standard itself.
geofft 8y ago
Yes, the U2F spec was developed by Google and Yubico, founding members of the FIDO Alliance. Google seems happy to have more companies on board—their Advanced Protection Program, which requires getting two security keys, suggests buying a Feitian device (which supports U2F as well as Google Smart Lock on iOS via a non-U2F Bluetooth protocol) and a Yubico one.

crunchlibrarian 8y ago

I am starting to wonder how many breaches there have actually been of Google user data, they are so secretive and insular it wouldn't surprise me in the least if it has happened multiple times and was covered up. In the future, as these mega corporations become even larger and more powerful, brave employees who are willing to violate NDAs are the only source of info we will have at all.

geofft 8y ago

> Also there seems to be a kind of relationship between Google and Yubico that I would love to know more about. Google and Yubico developed U2F, so.... Still, precisely because of this, I would say it's poor form for Google to award Yubico a bug bounty relating to U2F (would they award a bug bounty to an Android manufacturer for a kernel bug?). It also seems like poor form for Yubico not to disclose their research when asking about the same topic to another researcher, and poor form for Google to be unwilling to award two bounties (this isn't the patent office, acknowledging and even incentivizing multiple discovery is fine).

anfedorov 8y ago

Was there some work-around I'm missing or did they literally go "yeah this website can send anything to the YK device directly, waht could go wrong?". Because the folks at Google Security are definitely smart and many orders of magnitude more experienced than me, and that's a vuln even I can understand / see the problem with so something institutional must have gone way wrong if WebUSB shipped on the stable release without some kind of block-U2F-forgery filter. As far as Yubico, I get that they are doing something pretty hard in the hardware / product-market-fit domains, and I respect that and I want them to succeed, but they appear to be seriously dropping the ball on the software part of their product [1], as well as "simplicity breeds security". They could do so much better on the actual UI/UX if they piece-by-piece copied the setup UX of a "smart" vacuum cleaner. 1. I emailed & on-site support ticket submitted them days ago about some of their certs having expired on 2017-05-10, and have gotten not a peep in response & no fix in sight. Did nobody set a team calendar reminder and is nobody responsible for checking it on a monthly / quarterly / at the very least end-of-year cycle? That seems pretty elementary "underwear goes inside the pants" kind of security competence. https://i.imgur.com/bOCfXJ2.png https://i.imgur.com/bOCfXJ2.png https://developers.yubico.com/yubikey-neo-manager/Releases/yubikey-neo-manager-1.4.0-mac.pkg https://developers.yubico.com/yubikey-neo-manager/Releases/y...

michaelt 8y ago
did they literally go "yeah this website can send anything to the YK device directly, waht could go wrong?". WebUSB displays a prompt, albeit an uninformative one [1]. The idea is to trick the user into enabling WebUSB when they think they're enabling U2F. [1] https://developers.google.com/web/updates/images/2016-03-02-access-usb-devices-on-the-web/usb-device-chooser.png https://developers.google.com/web/updates/images/2016-03-02-...
- floatboth 8y ago
  Well that clearly doesn't look like a U2F prompt. Of course U2F devices should be excluded from the list, and there should be some warning text about "do not allow important devices on random websites", but that doesn't seem like a huge deal.

WhatsName 8y ago

This is what bugs me a lot, when it comes to bugbounties including HackerOne. The absolute lack of accountability and transparency. One can only hope the companies act in good faith. In my opinion this should rather be handled by an independet organisaton like the CERT community or since it's a vital security interest at state level. Though latter might be prone to conflicting interests as well.

curiousgal 8y ago

>To make it clear: I’m not after fame, credits, or want to take some bounty away from @girlswhocode! Why mention them then, if not to pressure them into refunding the donation?

rrix2 8y ago
Or to point out that the researchers’ beef is with Google and Yubico and not the nonprofit? To correct an injustice of two corporations who are collaborating to shaft an independent researcher? There’s a lot of reasons if you give even a shred of benefit of the doubt to the author of the piece.
philliphaydon 8y ago
I assume to call them out. If someone pulls a dick move once and gets away with it. They will do it again. If they get called out they will think twice next time.
- curiousgal 8y ago
  The charity had nothing to do with this. They didn't choose to be the recipients of a 'stolen' bounty.
  - philliphaydon 8y ago
    I'm not sure where I mentioned charity? I wrote an assumption based on what i read in the article.

pdkl95 8y ago

> We realized this is not limited to U2F / FIDO and developed a generic proxy that allows to forward any USB device exposed to WebUSB to a remote system. ~sigh~ It's really depressing to learn that reality was much worst than any of my "this is going to end badly" predictions[1]. I originally thought[2] the problems would start on the hardware side with devices that were never designed for security. Forwarding everything with a proxy is shockingly worse. [1] https://news.ycombinator.com/item?id=11466197 https://news.ycombinator.com/item?id=11466197 [2] https://news.ycombinator.com/item?id=11466415 https://news.ycombinator.com/item?id=11466415

anfedorov 8y ago
Aside from the "no HID" (does a YK even count as a HID if you turn off the default slot 1 functionality?), was the proxy designed to have a firewall / sandboxing of some sort? Google engineers have done some incredible things and while ambitious, it seems this kind of thing is well within their reach.

mtgx 8y ago

WebUSB was an obviously bad idea right from the start, just like Web Bluetooth was, both of which I believe were proposed by Google. It all comes from this nonsense idea from Google that "all devices should be directly connected to the internet" (and thus owned by botnets). Mozilla team, if you're reading, please reject implementing or at least enabling such APIs with extremely high-risk to the user by default in your browser - "sandbox" or not.

baybal2 8y ago
I'm seconding that with demand to sanitize all useless, bug prone APIs google introduced solely for own use.
anfedorov 8y ago
Why is it an obviously bad idea? In light of the work on NaCL, is there still no way you can imagine it could ever work?
- pjc50 8y ago
  What does NaCL have to do with this, it's a cryptography library? The issue is that 99.99% of USB devices aren't designed with the possibility of hostile payloads coming from the host, so the security rests entirely on the webusb permission dialog. Which should be presented as "grant this website administrative access to your computer" but isn't.
  - rrix2 8y ago
    > What does NaCL have to do with this, it's a cryptography library? The other NaCl https://developer.chrome.com/native-client https://developer.chrome.com/native-client
  - anfedorov 8y ago
    Could the browser create a tight whitelist of payloads that are definitely not hostile, then expand it slowly to add functionality?
- 8y ago