Slashdot Mirror
Yubikey Neo Teardown and Durability Review
An anonymous reader writes: Folks at HexView (disclaimer: I contract for the company) took apart Yubikey Neo and found out that, while the key uses solid hardware to ensure secure identity management, its physical anti-tamper measures and durability could be improved. The tear-down analysis is short, but to the point, and offers some very nice close-ups of the internals. One example of the design shortcomings they've identified: Contrary to Yubico's claims, Yubikey appears to be quite destructable. Do not push on it when you touch the sensor while the key is plugged in to a USB port. The point where it bends the most happens to be the point where USB vias are located and through which NFC antenna loop goes. To make things worse, the injection molding hole right next to the connector makes this area even more susceptible to bending.
The branding, "Yubikey Neo," means nothing to me. Sounds like an Asian version of the main character from The Matrix.
Do not look into laser with remaining eye.
I have one that I've carried and abused daily for years, still working, though I think it's getting close to needing a replacement. My biggest problem, because I wear it on a necklace chain, is that it's been getting sweat on the contacts which eventually have gunked up and corroded. I was able to scrape it off with a knife, but that scraped off the gold plating and exposed the copper underneath, which is of course corroding much worse. I've got the private key locked away here somewhere so I can flash one of my spares and be up and running quickly, or I can just add the new key to the places I use it before it croaks. I've had more problems with USB ports getting worn out.
Error 404 - Sig Not Found
Not sure what benefit "tampering" would provide. Why would you have to take it apart to extract its secrets, when you can just: steal the person's smartphone/computer and the yubikey, and use them in tandem to authenticate yourself as the user to whatever services they have locked behind it? You can use the Yubikey all by itself, assuming you have exclusive physical access to the device, to make it serve its purpose for you, the attacker.
Durability concerns are valid, but I keep it in my wallet, and it is working fine for me after some time (about a year and a half). I mainly use it NFC though. The USB connector being "raw" like that is probably more susceptible to damage than the NFC part which is hidden inside the plastic shell.
No they didn't. Unless Yubikey Neo is a person, they took apart a Yubikey Neo.
When you omit article, it make you sound like chinaman.
and Google even supports them for authentication. Unless you are a paying customer and use Google for Work (Google Apps), they don't support that yet. :/
The purpose of the thing is clear enough, but how exactly do you use it? The website implies that it only works with applications that know about it, but that would seem to limit its usefulness a lot. Still, the information on the manufacturer's site is anything but clear.
Enjoy life! This is not a dress rehearsal.
Wrong. On Slashdot we never read the article. We barely even scan the summary.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
I know, only because where I work is using them. Idea is it is a general two factor token. Can be programmed by the end user or their org. Also in theory a lot of companies could all use their platform and you have one two factor device for everything but in reality you use it for whatever your company does and nothing else.
Once programmed it acts like a HID class keyboard. You push the button, it spits out a string of characters, that being the two factor code for your account at the time.
Why didn't they at least pot the thing in epoxy. Sure makes it a lot harder to tamper with.
From TFA: For those interested, FIPS140-2 Level 1 means that a device has at least one standard ("approved") security algorithm or function and Level 2 means that physical design is tamper-evident.
He seems to think little of the product, but it appears to me it meets the requirements just fine. It's obvious that his key was tampered with, and nothing was done to try to extract key data from the device. Basically, he can take one apart, but there's little chance someone's going to take my Yubikey in the middle of the night, duplicate the key data, and put it back without me noticing something is wrong. Sure, the NSA could probably do it, but they can't have the time with listening to everyones grandmas phone calls. =)
Really guys,, Slow news day I guess..
if you can damage the device so that the user cannot detect the damage by visual inspection, you can perpetrate a denial of service attack because the user will no longer be able to use it to restart the service, they will have no idea it is broken and the service will not be able to be restarted until a replacement key is made.
I bought a couple of these keys a few years ago - they are still sitting around in a drawer somewhere. I wasn't too worried about the durability - it seems fine. When I tried it, my issues with were:
1) Very few websites supported it, and those that did made it a pain to set up. Looking at their website, it is supported by gmail, lastpass, dropbox, evernote. I suppose there is a complete list of supported websites and I'm too lazy to go look for it. Any banks support this?
2) Using it on Linux required installing additional software
3) Too expensive - $18 - $50 each. That's fine if I only needed one, but if I have to buy a few in case I lose or break one, then buy a few for the wife and the kid, and then it is only supported by a few websites... Well, not worth it for me.
4) The website is hard to read - written more for IT people than for the lay person. FIDO? OATH-TOPT? I've got no idea what they are talking about on most of their website. The "For Individuals" page is easy to read, but light on details and as soon as you leave it, you are in deep water. Also, can you get duplicate keys in case you lose one? I could never figure out this question from the website. Some sites like gmail allow you to associate more than one key. If there is a list of supported applications and websites, does it also state whether they allow a backup key? If the Yubico wants me to buy and use this thing, it needs to do the research for me and tell me exactly how and why I would want to use it. Something like this hypothetical example*:
1) Buy a Yubikey Neo to use wirelessly with your phone. Keep it on your keychain. Use it to access Lastpass on your phone.
2) Buy a Yubikey Standard for each computer at home and keep it plugged in. Associate it with the same Lastpass account as in #1 - for convenient use on your home computer and as a backup for the one on the keychain.
3) Associate the home Yubikey's with every family member's Lastpass account so that the whole family could share them.
*No idea if this scenerio is possible. Anyone? How would you use it with an ipad or iphone? (do the latest ones have NFC yet?)
EOM
"The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
Really addicted to mine. I have my private SSH key on there (via GPG/PGP), so that's never on my working machines. Use the standard OTP on several personally-run sites. Use U2F security for Google apps. Use the TOTP (a.k.a. Google Authenticator/Authy) app. Use the challenge-response mode as a second factor on my KeePass database. Amazing gadget.
The question regarding the teardown is... "so"? Even with full pin access to the A7005 chip, you *STILL* wouldn't have access to my GPG/SSH private key or my TOTP generators within it. That's the point of a secure element. You'd have to dissolve the casing of the A7005 chip and have a decent microscope lab to get those bits of data out of the chip. You would be able to use my U2F/OTP/TOTP-generated-code functionality. But, you could do that just by stealing my Neo and plugging it into a USB slot without any acetone bath involved.
There is little I can do in that regard.
In case anyone missed it, if you're using one for OpenPGP key use you might be vulnerable to a pin bypass attack. Details on how to check are on that page.
If you have a vulnerable device, YubiCo will send you a free replacement upon request - just open a ticket with your serial and order numbers.
The problem with the Yubi key is that it is too damn thin. I have to prop it up with my leg or use another finger to hold it up or my touch will register as multiple touches. A 3mm device simply doesn't securely fit into a USB port.