• smeg@feddit.uk
    link
    fedilink
    English
    arrow-up
    96
    ·
    2 months ago

    The attacker would need physical possession of the YubiKey, Security Key, or YubiHSM, knowledge of the accounts they want to target and specialized equipment to perform the necessary attack. Depending on the use case, the attacker may also require additional knowledge including username, PIN, account password, or authentication key.

    The attacks require about $11,000 worth of equipment and a sophisticated understanding of electrical and cryptographic engineering. The difficulty of the attack means it would likely be carried out only by nation-states or other entities with comparable resources and then only in highly targeted scenarios. The likelihood of such an attack being used widely in the wild is extremely low.

    Given this massive caveat I’d almost call that headline misleading

    • Tinks@lemmy.world
      link
      fedilink
      English
      arrow-up
      19
      ·
      2 months ago

      I would argue that if the attacker has physical possession of my yubikey, that alone means the accounts tied to it are vulnerable. While the information isn’t technically wrong, I feel like that headline is misleading and this isn’t as big of a deal as some would like to make it out as.

    • Hirom@beehaw.org
      link
      fedilink
      English
      arrow-up
      11
      ·
      edit-2
      2 months ago

      Knowledge of the account is an obvious caveat. Yubikey-based MFA is an added layer of protection for accounts, so any kind of attack against MFA assumes the attacker already knows which account to target.

      It’s like saying “our door lock is flawed, but the attacker would need to have knowledge of the door”.

      The cost and complexity is what’s noteworthy and is more relevant. Although attack cost and complexity usuallu goes down with advances in tooling and research. So it may be a good idea to plan a progressive retirement of affected keys.

      • Zwiebel@feddit.org
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        2 months ago

        “Our door lock is flawed, but the attacker would need physical access to the key”

    • bean@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      2 months ago

      The fact that this happened is surprising in general, but not super practical.

      What’s the big deal? A: It affects other types of hardware which also used these crypto libraries. Some are easier to address than others.