#infineon — Public Fediverse posts

https://www.reddit.com/r/yubikey/comments/1f83qv4/eucleak_sidechannel_attack_on_the_yubikey_5_series/

Infineon:
?

Yubico (affected):
https://www.yubico.com/support/security-advisories/ysa-2024-03/
https://support.yubico.com/hc/en-us/articles/15705749884444-Infineon-ECDSA-Private-Key-Recovery-Customer-Resources

Google (write their own firmware?):
?

FEITIAN (Unaffected?):
From NinjaLAb writeup PDF: "Feitian explains that the Feitian A22 JavaCard has been updated years ago and
none of their products is impacted."

Google (vulnerable hardware?)
https://infosec.exchange/@maxeddy/113092117674749246
"Also, Google confirmed to us that the current version of its Titan keys uses the SLE78 that NinjaLabs used in their attack. Google told us that it will start providing a version of the Titan that won't be vulnerable to the attack 'soon.' "

HID (?):
?

Kensington(?):
?

Ledger (at least one report of using STMicroeelctronics, not Infineon):
?

NitroKey (stated as unaffected in email):
https://gist.github.com/roycewilliams/4d100719f033cc1b1aa9fad084b74a97

Nordic (?):
?

Solo Keys (?):
?

Thales (?):
?

Thetis: (?):
?

Trezor (at least one report of using Infineon):
?

TrustKey (formerly eWBM)
(probably unaffected, own MCU)
https://www.trustkeysolutions.com/en/sub/product.form
(No official response link)

Commentary:
https://abyssdomain.expert/@filippo/113074626948195938

News/threads:

https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/

"The attacks require about $11,000 worth of equipment and a sophisticated understanding of electrical and cryptographic engineering. The difficulty of the attack means it would likely be carried out by nation-states or other entities with comparable resources and then only in highly targeted scenarios. The likelihood of such an attack being used widely in the wild is extremely low."

https://infosec.exchange/@dangoodin/113074992609951759

"While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven’t tested other devices using the microcontroller, which is SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contains the same vulnerability."

https://www.theverge.com/2024/9/4/24235635/yubikey-unfixable-security-vulnerability-side-channel-explot

https://shkspr.mobi/blog/2024/09/some-thoughts-on-the-yubikey-eucleak-vulnerability/

https://www.bleepingcomputer.com/news/security/new-eucleak-attack-lets-threat-actors-clone-yubikey-fido-keys/

https://www.tomshardware.com/tech-industry/cyber-security/older-yubikeys-compromised-by-unpatchable-2fa-bug-side-channel-attack-is-critical-but-expensive-and-difficult-to-execute

https://www.wired.com/story/yubikey-vulnerability-cloning/

https://www.nytimes.com/wirecutter/reviews/best-security-keys/

Wallets and their secure element hardware:
https://bitcointalk.org/index.php?topic=5304483.0

#YubiKey #EUCLeak #Infineon #YSA202403 #YSA_2024_03

#yubikey #eucleak #infineon #ysa202403 #ysa_2024_03

Royce Williams @[email protected] · 2024-09-03 · 16:38 UTC

(2 of 2) An outstanding question is: which other keys / firmware versions are affected? Likely any keys using Infineon SLE78, Optiga Trust M, orInfineon Optiga TPM plus the Infineon crypto libraries. I assume that Google's Titan keys have Google's own crypto libraries (but I don't actually know that).

Links:

https://www.reddit.com/r/yubikey/comments/1f83qv4/eucleak_sidechannel_attack_on_the_yubikey_5_series/

Infineon:
?

Yubico (affected):
https://www.yubico.com/support/security-advisories/ysa-2024-03/
https://support.yubico.com/hc/en-us/articles/15705749884444-Infineon-ECDSA-Private-Key-Recovery-Customer-Resources

Google (write their own firmware?):
?

FEITIAN (Unaffected?):
From NinjaLAb writeup PDF: "Feitian explains that the Feitian A22 JavaCard has been updated years ago and
none of their products is impacted."

Google (vulnerable hardware?)
https://infosec.exchange/@maxeddy/113092117674749246
"Also, Google confirmed to us that the current version of its Titan keys uses the SLE78 that NinjaLabs used in their attack. Google told us that it will start providing a version of the Titan that won't be vulnerable to the attack 'soon.' "

HID (?):
?

Kensington(?):
?

Ledger (at least one report of using STMicroeelctronics, not Infineon):
?

NitroKey (stated as unaffected in email):
https://gist.github.com/roycewilliams/4d100719f033cc1b1aa9fad084b74a97

Nordic (?):
?

Solo Keys (?):
?

Thales (?):
?

Thetis: (?):
?

Trezor (at least one report of using Infineon):
?

TrustKey (formerly eWBM)
(probably unaffected, own MCU)
https://www.trustkeysolutions.com/en/sub/product.form
(No official response link)

Commentary:
https://abyssdomain.expert/@filippo/113074626948195938

News/threads:

https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/

"The attacks require about $11,000 worth of equipment and a sophisticated understanding of electrical and cryptographic engineering. The difficulty of the attack means it would likely be carried out by nation-states or other entities with comparable resources and then only in highly targeted scenarios. The likelihood of such an attack being used widely in the wild is extremely low."

https://infosec.exchange/@dangoodin/113074992609951759

"While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven’t tested other devices using the microcontroller, which is SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contains the same vulnerability."

https://www.theverge.com/2024/9/4/24235635/yubikey-unfixable-security-vulnerability-side-channel-explot

https://shkspr.mobi/blog/2024/09/some-thoughts-on-the-yubikey-eucleak-vulnerability/

https://www.bleepingcomputer.com/news/security/new-eucleak-attack-lets-threat-actors-clone-yubikey-fido-keys/

https://www.tomshardware.com/tech-industry/cyber-security/older-yubikeys-compromised-by-unpatchable-2fa-bug-side-channel-attack-is-critical-but-expensive-and-difficult-to-execute

https://www.wired.com/story/yubikey-vulnerability-cloning/

https://www.nytimes.com/wirecutter/reviews/best-security-keys/

Wallets and their secure element hardware:
https://bitcointalk.org/index.php?topic=5304483.0

#YubiKey #EUCLeak #Infineon #YSA202403 #YSA_2024_03

#yubikey #eucleak #infineon #ysa202403 #ysa_2024_03

Royce Williams @[email protected] · 2024-09-03 · 16:38 UTC

(2 of 2) An outstanding question is: which other keys / firmware versions are affected? Likely any keys using Infineon SLE78, Optiga Trust M, orInfineon Optiga TPM plus the Infineon crypto libraries. I assume that Google's Titan keys have Google's own crypto libraries (but I don't actually know that).

Links:

https://www.reddit.com/r/yubikey/comments/1f83qv4/eucleak_sidechannel_attack_on_the_yubikey_5_series/

Infineon:
?

Yubico (affected):
https://www.yubico.com/support/security-advisories/ysa-2024-03/
https://support.yubico.com/hc/en-us/articles/15705749884444-Infineon-ECDSA-Private-Key-Recovery-Customer-Resources

Google (write their own firmware?):
?

FEITIAN (Unaffected?):
From NinjaLAb writeup PDF: "Feitian explains that the Feitian A22 JavaCard has been updated years ago and
none of their products is impacted."

Google (vulnerable hardware?)
https://infosec.exchange/@maxeddy/113092117674749246
"Also, Google confirmed to us that the current version of its Titan keys uses the SLE78 that NinjaLabs used in their attack. Google told us that it will start providing a version of the Titan that won't be vulnerable to the attack 'soon.' "

HID (?):
?

Kensington(?):
?

Ledger (at least one report of using STMicroeelctronics, not Infineon):
?

NitroKey (stated as unaffected in email):
https://gist.github.com/roycewilliams/4d100719f033cc1b1aa9fad084b74a97

Nordic (?):
?

Solo Keys (?):
?

Thales (?):
?

Thetis: (?):
?

Trezor (at least one report of using Infineon):
?

TrustKey (formerly eWBM)
(probably unaffected, own MCU)
https://www.trustkeysolutions.com/en/sub/product.form
(No official response link)

Commentary:
https://abyssdomain.expert/@filippo/113074626948195938

News/threads:

https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/

"The attacks require about $11,000 worth of equipment and a sophisticated understanding of electrical and cryptographic engineering. The difficulty of the attack means it would likely be carried out by nation-states or other entities with comparable resources and then only in highly targeted scenarios. The likelihood of such an attack being used widely in the wild is extremely low."

https://infosec.exchange/@dangoodin/113074992609951759

"While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven’t tested other devices using the microcontroller, which is SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contains the same vulnerability."

https://www.theverge.com/2024/9/4/24235635/yubikey-unfixable-security-vulnerability-side-channel-explot

https://shkspr.mobi/blog/2024/09/some-thoughts-on-the-yubikey-eucleak-vulnerability/

https://www.bleepingcomputer.com/news/security/new-eucleak-attack-lets-threat-actors-clone-yubikey-fido-keys/

https://www.tomshardware.com/tech-industry/cyber-security/older-yubikeys-compromised-by-unpatchable-2fa-bug-side-channel-attack-is-critical-but-expensive-and-difficult-to-execute

https://www.wired.com/story/yubikey-vulnerability-cloning/

https://www.nytimes.com/wirecutter/reviews/best-security-keys/

Wallets and their secure element hardware:
https://bitcointalk.org/index.php?topic=5304483.0

#YubiKey #EUCLeak #Infineon #YSA202403 #YSA_2024_03

#ysa_2024_03 #ysa202403 #infineon #eucleak #yubikey

Royce Williams @[email protected] · 2024-09-03 · 16:38 UTC

(2 of 2) An outstanding question is: which other keys / firmware versions are affected? Likely any keys using Infineon SLE78, Optiga Trust M, orInfineon Optiga TPM plus the Infineon crypto libraries. I assume that Google's Titan keys have Google's own crypto libraries (but I don't actually know that).

Links:

https://www.reddit.com/r/yubikey/comments/1f83qv4/eucleak_sidechannel_attack_on_the_yubikey_5_series/

Infineon:
?

Yubico (affected):
https://www.yubico.com/support/security-advisories/ysa-2024-03/
https://support.yubico.com/hc/en-us/articles/15705749884444-Infineon-ECDSA-Private-Key-Recovery-Customer-Resources

Google (write their own firmware?):
?

FEITIAN (Unaffected?):
From NinjaLAb writeup PDF: "Feitian explains that the Feitian A22 JavaCard has been updated years ago and
none of their products is impacted."

Google (vulnerable hardware?)
https://infosec.exchange/@maxeddy/113092117674749246
"Also, Google confirmed to us that the current version of its Titan keys uses the SLE78 that NinjaLabs used in their attack. Google told us that it will start providing a version of the Titan that won't be vulnerable to the attack 'soon.' "

HID (?):
?

Kensington(?):
?

Ledger (at least one report of using STMicroeelctronics, not Infineon):
?

NitroKey (stated as unaffected in email):
https://gist.github.com/roycewilliams/4d100719f033cc1b1aa9fad084b74a97

Nordic (?):
?

Solo Keys (?):
?

Thales (?):
?

Thetis: (?):
?

Trezor (at least one report of using Infineon):
?

TrustKey (formerly eWBM)
(probably unaffected, own MCU)
https://www.trustkeysolutions.com/en/sub/product.form
(No official response link)

Commentary:
https://abyssdomain.expert/@filippo/113074626948195938

News/threads:

https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/

"The attacks require about $11,000 worth of equipment and a sophisticated understanding of electrical and cryptographic engineering. The difficulty of the attack means it would likely be carried out by nation-states or other entities with comparable resources and then only in highly targeted scenarios. The likelihood of such an attack being used widely in the wild is extremely low."

https://infosec.exchange/@dangoodin/113074992609951759

"While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven’t tested other devices using the microcontroller, which is SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contains the same vulnerability."