#ysa202403 — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #ysa202403, aggregated by home.social.
-
(2 of 2) An outstanding question is: which other keys / firmware versions are affected? Likely any keys using Infineon SLE78, Optiga Trust M, orInfineon Optiga TPM plus the Infineon crypto libraries. I assume that Google's Titan keys have Google's own crypto libraries (but I don't actually know that).
Links:
Researcher:
https://ninjalab.io/eucleak/Infineon:
?Yubico (affected):
https://www.yubico.com/support/security-advisories/ysa-2024-03/
https://support.yubico.com/hc/en-us/articles/15705749884444-Infineon-ECDSA-Private-Key-Recovery-Customer-ResourcesGoogle (write their own firmware?):
?FEITIAN (Unaffected?):
From NinjaLAb writeup PDF: "Feitian explains that the Feitian A22 JavaCard has been updated years ago and
none of their products is impacted."Google (vulnerable hardware?)
https://infosec.exchange/@maxeddy/113092117674749246
"Also, Google confirmed to us that the current version of its Titan keys uses the SLE78 that NinjaLabs used in their attack. Google told us that it will start providing a version of the Titan that won't be vulnerable to the attack 'soon.' "HID (?):
?Kensington(?):
?Ledger (at least one report of using STMicroeelctronics, not Infineon):
?NitroKey (stated as unaffected in email):
https://gist.github.com/roycewilliams/4d100719f033cc1b1aa9fad084b74a97Nordic (?):
?Solo Keys (?):
?Thales (?):
?Thetis: (?):
?Trezor (at least one report of using Infineon):
?TrustKey (formerly eWBM)
(probably unaffected, own MCU)
https://www.trustkeysolutions.com/en/sub/product.form
(No official response link)Commentary:
https://abyssdomain.expert/@filippo/113074626948195938News/threads:
"The attacks require about $11,000 worth of equipment and a sophisticated understanding of electrical and cryptographic engineering. The difficulty of the attack means it would likely be carried out by nation-states or other entities with comparable resources and then only in highly targeted scenarios. The likelihood of such an attack being used widely in the wild is extremely low."
https://infosec.exchange/@dangoodin/113074992609951759
"While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven’t tested other devices using the microcontroller, which is SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contains the same vulnerability."
https://news.ycombinator.com/item?id=41434500
https://securityboulevard.com/2024/09/fwbifx/
https://shkspr.mobi/blog/2024/09/some-thoughts-on-the-yubikey-eucleak-vulnerability/
https://www.wired.com/story/yubikey-vulnerability-cloning/
https://www.nytimes.com/wirecutter/reviews/best-security-keys/
Wallets and their secure element hardware:
https://bitcointalk.org/index.php?topic=5304483.0 -
(2 of 2) An outstanding question is: which other keys / firmware versions are affected? Likely any keys using Infineon SLE78, Optiga Trust M, orInfineon Optiga TPM plus the Infineon crypto libraries. I assume that Google's Titan keys have Google's own crypto libraries (but I don't actually know that).
Links:
Researcher:
https://ninjalab.io/eucleak/Infineon:
?Yubico (affected):
https://www.yubico.com/support/security-advisories/ysa-2024-03/
https://support.yubico.com/hc/en-us/articles/15705749884444-Infineon-ECDSA-Private-Key-Recovery-Customer-ResourcesGoogle (write their own firmware?):
?FEITIAN (Unaffected?):
From NinjaLAb writeup PDF: "Feitian explains that the Feitian A22 JavaCard has been updated years ago and
none of their products is impacted."Google (vulnerable hardware?)
https://infosec.exchange/@maxeddy/113092117674749246
"Also, Google confirmed to us that the current version of its Titan keys uses the SLE78 that NinjaLabs used in their attack. Google told us that it will start providing a version of the Titan that won't be vulnerable to the attack 'soon.' "HID (?):
?Kensington(?):
?Ledger (at least one report of using STMicroeelctronics, not Infineon):
?NitroKey (stated as unaffected in email):
https://gist.github.com/roycewilliams/4d100719f033cc1b1aa9fad084b74a97Nordic (?):
?Solo Keys (?):
?Thales (?):
?Thetis: (?):
?Trezor (at least one report of using Infineon):
?TrustKey (formerly eWBM)
(probably unaffected, own MCU)
https://www.trustkeysolutions.com/en/sub/product.form
(No official response link)Commentary:
https://abyssdomain.expert/@filippo/113074626948195938News/threads:
"The attacks require about $11,000 worth of equipment and a sophisticated understanding of electrical and cryptographic engineering. The difficulty of the attack means it would likely be carried out by nation-states or other entities with comparable resources and then only in highly targeted scenarios. The likelihood of such an attack being used widely in the wild is extremely low."
https://infosec.exchange/@dangoodin/113074992609951759
"While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven’t tested other devices using the microcontroller, which is SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contains the same vulnerability."
https://news.ycombinator.com/item?id=41434500
https://securityboulevard.com/2024/09/fwbifx/
https://shkspr.mobi/blog/2024/09/some-thoughts-on-the-yubikey-eucleak-vulnerability/
https://www.wired.com/story/yubikey-vulnerability-cloning/
https://www.nytimes.com/wirecutter/reviews/best-security-keys/
Wallets and their secure element hardware:
https://bitcointalk.org/index.php?topic=5304483.0 -
(2 of 2) An outstanding question is: which other keys / firmware versions are affected? Likely any keys using Infineon SLE78, Optiga Trust M, orInfineon Optiga TPM plus the Infineon crypto libraries. I assume that Google's Titan keys have Google's own crypto libraries (but I don't actually know that).
Links:
Researcher:
https://ninjalab.io/eucleak/Infineon:
?Yubico (affected):
https://www.yubico.com/support/security-advisories/ysa-2024-03/
https://support.yubico.com/hc/en-us/articles/15705749884444-Infineon-ECDSA-Private-Key-Recovery-Customer-ResourcesGoogle (write their own firmware?):
?FEITIAN (Unaffected?):
From NinjaLAb writeup PDF: "Feitian explains that the Feitian A22 JavaCard has been updated years ago and
none of their products is impacted."Google (vulnerable hardware?)
https://infosec.exchange/@maxeddy/113092117674749246
"Also, Google confirmed to us that the current version of its Titan keys uses the SLE78 that NinjaLabs used in their attack. Google told us that it will start providing a version of the Titan that won't be vulnerable to the attack 'soon.' "HID (?):
?Kensington(?):
?Ledger (at least one report of using STMicroeelctronics, not Infineon):
?NitroKey (stated as unaffected in email):
https://gist.github.com/roycewilliams/4d100719f033cc1b1aa9fad084b74a97Nordic (?):
?Solo Keys (?):
?Thales (?):
?Thetis: (?):
?Trezor (at least one report of using Infineon):
?TrustKey (formerly eWBM)
(probably unaffected, own MCU)
https://www.trustkeysolutions.com/en/sub/product.form
(No official response link)Commentary:
https://abyssdomain.expert/@filippo/113074626948195938News/threads:
"The attacks require about $11,000 worth of equipment and a sophisticated understanding of electrical and cryptographic engineering. The difficulty of the attack means it would likely be carried out by nation-states or other entities with comparable resources and then only in highly targeted scenarios. The likelihood of such an attack being used widely in the wild is extremely low."
https://infosec.exchange/@dangoodin/113074992609951759
"While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven’t tested other devices using the microcontroller, which is SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contains the same vulnerability."
https://news.ycombinator.com/item?id=41434500
https://securityboulevard.com/2024/09/fwbifx/
https://shkspr.mobi/blog/2024/09/some-thoughts-on-the-yubikey-eucleak-vulnerability/
https://www.wired.com/story/yubikey-vulnerability-cloning/
https://www.nytimes.com/wirecutter/reviews/best-security-keys/
Wallets and their secure element hardware:
https://bitcointalk.org/index.php?topic=5304483.0 -
(2 of 2) An outstanding question is: which other keys / firmware versions are affected? Likely any keys using Infineon SLE78, Optiga Trust M, orInfineon Optiga TPM plus the Infineon crypto libraries. I assume that Google's Titan keys have Google's own crypto libraries (but I don't actually know that).
Links:
Researcher:
https://ninjalab.io/eucleak/Infineon:
?Yubico (affected):
https://www.yubico.com/support/security-advisories/ysa-2024-03/
https://support.yubico.com/hc/en-us/articles/15705749884444-Infineon-ECDSA-Private-Key-Recovery-Customer-ResourcesGoogle (write their own firmware?):
?FEITIAN (Unaffected?):
From NinjaLAb writeup PDF: "Feitian explains that the Feitian A22 JavaCard has been updated years ago and
none of their products is impacted."Google (vulnerable hardware?)
https://infosec.exchange/@maxeddy/113092117674749246
"Also, Google confirmed to us that the current version of its Titan keys uses the SLE78 that NinjaLabs used in their attack. Google told us that it will start providing a version of the Titan that won't be vulnerable to the attack 'soon.' "HID (?):
?Kensington(?):
?Ledger (at least one report of using STMicroeelctronics, not Infineon):
?NitroKey (stated as unaffected in email):
https://gist.github.com/roycewilliams/4d100719f033cc1b1aa9fad084b74a97Nordic (?):
?Solo Keys (?):
?Thales (?):
?Thetis: (?):
?Trezor (at least one report of using Infineon):
?TrustKey (formerly eWBM)
(probably unaffected, own MCU)
https://www.trustkeysolutions.com/en/sub/product.form
(No official response link)Commentary:
https://abyssdomain.expert/@filippo/113074626948195938News/threads:
"The attacks require about $11,000 worth of equipment and a sophisticated understanding of electrical and cryptographic engineering. The difficulty of the attack means it would likely be carried out by nation-states or other entities with comparable resources and then only in highly targeted scenarios. The likelihood of such an attack being used widely in the wild is extremely low."
https://infosec.exchange/@dangoodin/113074992609951759
"While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven’t tested other devices using the microcontroller, which is SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contains the same vulnerability."
https://news.ycombinator.com/item?id=41434500
https://securityboulevard.com/2024/09/fwbifx/
https://shkspr.mobi/blog/2024/09/some-thoughts-on-the-yubikey-eucleak-vulnerability/
https://www.wired.com/story/yubikey-vulnerability-cloning/
https://www.nytimes.com/wirecutter/reviews/best-security-keys/
Wallets and their secure element hardware:
https://bitcointalk.org/index.php?topic=5304483.0