#ninjalab — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #ninjalab, aggregated by home.social.
-
#Ninjalab also has their own site about their #EUCLEAK research: https://ninjalab.io/eucleak/
-
Side-channel #EUCLEAK attack discovered on devices using the Infineon cryptographic library, like the YubiKey 5 series (firmware <5.7) and Feitian A22 JavaCard.
But it does require a fair amount of factors to succeed: username, password, physical access, additional equipment, and for the cryptographic operations to involve modular inversions, like ECDSA.
There are two phases to the attack:
(1) The online phase requires opening the device to access the microcontroller, then using an electromagnetic probe, an oscilloscope, and a computer to capture the electromagnetic side-channel signals during operation.
(2) The offline phase (physical access no longer necessary) supposedly takes time varying from one hour to one day for each secret to uncover.
https://ninjalab.io/wp-content/uploads/2024/09/20240903_eucleak.pdf
#ninjalab #eucleak #sidechannel #attack #infineon #yubikey #feitian
-
Des clés de sécurité #Yubico peuvent être clonées par canal auxiliaire - https://next.ink/148837/des-cles-de-securite-yubico-peuvent-etre-clonees-par-canal-auxiliaire/
> Les chercheurs français de #NinjaLab (Montpellier) ont découvert qu’il était possible de cloner des clés de sécurité #YubiKey 5 en utilisant un canal auxiliaire. La probabilité d’une attaque de grande ampleur est très faible, notamment car il faut posséder de nombreux éléments, du matériel spécifique et un accès à la machine visée.
Y'a des alternatives à ça ? J'en cherche.
-
YubiKeys are vulnerable to cloning attacks thanks to newly discovered side channel
https://arstechnica.com/?p=2046777
#Yubikey #Yubikey5 #Security #SideChannel #Hacking #Hack #SecOps #ninjalab