Yubikey Neo Teardown and Durability Review 88
An anonymous reader writes: Folks at HexView (disclaimer: I contract for the company) took apart Yubikey Neo and found out that, while the key uses solid hardware to ensure secure identity management, its physical anti-tamper measures and durability could be improved. The tear-down analysis is short, but to the point, and offers some very nice close-ups of the internals. One example of the design shortcomings they've identified: Contrary to Yubico's claims, Yubikey appears to be quite destructable. Do not push on it when you touch the sensor while the key is plugged in to a USB port. The point where it bends the most happens to be the point where USB vias are located and through which NFC antenna loop goes. To make things worse, the injection molding hole right next to the connector makes this area even more susceptible to bending.
Okay, what is it? (Score:5, Insightful)
Re: (Score:2)
"Yubikey?" No, I walkie. She drovie.
Re:Okay, what is it? (Score:5, Insightful)
Try Google.
I have one on my keyring. I know exactly what it is, and what it is used for.
In other words you have prior information that makes sense out of the word salad that passes for summaries these days.
The rest of use just look at the summary and go WTF?!?!?!?
And yes, I have heard of that Google thing, but one of the prime tenets of good communication is to not make your audience go elsewhere for fundamental information. Because sooner or later they will be going to other sources for all of their information and will be by-passing you completely.
Re:Okay, what is it? (Score:5, Interesting)
Agh, wtf is a salad?
Apparently you need some help with understanding something. So here is a helpful link: Word salad [lmgtfy.com]
Re: (Score:2)
Re: (Score:1)
"World salad" is an established part of the English language. "Yubikey Neo" is some niche trademark neologism.
Re: (Score:2)
Try Google.
I have one on my keyring. I know exactly what it is, and what it is used for.
In other words you have prior information that makes sense out of the word salad that passes for summaries these days...
Quite true, especially in today's music climate where a tossed salad is served up hot and fresh with a side of truffle butter.
(Yeah, go ahead, take your own advice and enjoy Google on that one.)
Re: (Score:2)
Oddly enough, I was taking the last bite of a late lunch when I processed "truffle butter", and now I'm a bit ill. Thank you for that...
Re: (Score:2)
> And yes, I have heard of that Google thing, but one of the prime tenets of good communication is to not make your audience go elsewhere for fundamental information.
No, I don't think you quite got it there.
However the fundamental tennent of answering a question is actually answering it. If all you have to say is "I know, but I am not going to tell you", you haven't actually communicated anything because knowing that you know is, in every way, equivalent to not knowing at all.
Its not communication at all
Re: (Score:1)
Re: (Score:3, Funny)
Re:Okay, what is it? (Score:5, Informative)
It acts as an additional requirement to logging in to a computer, cellphone or network beyond a password.
YubiCo is a company that makes budget security tokens with the YubiKey Neo being their "top of the line" at a price of 50usd
One of the main security features of tokens of this nature is their inability to be tampered with since it is guaranteed to be connected to a computer.
Many manufacturers achieve this by "potting" the circuit board (coating it entirely in plastic rather than using a shell like most electronics) in some sort of difficult to remove chemically resistant plastic.
The YubiKey Neo was potted in a plastic that melted totally in nail polish remover
The fact that the plastic can be removed so easily along with a poor USB connector and keychain loop disprove YubiCo's claim that the YubiKey Neo is "virtually indestructible".
Re: (Score:3)
It acts as an additional requirement to logging in to a computer, cellphone or network beyond a password.
Actually, it supplies the password. When you plug it into an USB port, it acts as a keyboard, and "types" a one-time password as soon as you touch its button.
One of the main security features of tokens of this nature is their inability to be tampered with since it is guaranteed to be connected to a computer.
Huh? How does being connected to a computer guarantee that it is tamper proof? Or is that the other way round?
The YubiKey Neo was potted in a plastic that melted totally in nail polish remover
The fact that the plastic can be removed so easily
Actually, methinks the issue here is poor word choice. Yubi should have touted their product as "tamper evident" rather than "tamper proof".
For its main application, tamper evident is enough. If some ill intentioned third party wanted to read
Re: (Score:3)
Exactly. Even on a site for Computer Geeks and Nerds, It is silly to think we know of every new fangled device that is released, and their particular marketing claims of the day.
Being the poster contracted for the company, it probably means he is engulfed in the sales and marketing of the company and makes him believe that this is a really popular product. While it just covers a small niche.
Re: (Score:2)
The Article didn't make it clear it was an RSA token. It was just using the brand name.
And nothing of value was lost. (Score:5, Insightful)
Wrong. On Slashdot we never read the article. We barely even scan the summary.
Re: (Score:2, Insightful)
Wrong.
Incorrect. On Slashdot, we don't even fully read the comments. All I know is that I'm right, and you're attacking someone's opinion, maybe mine, maybe even yours, it doesn't matter. All that matters is that you said "wrong" and now we are arguing. You'll never change your mind, nor I mine. The readers though, and those rare but precious bestowers of mod points, those are the opinions to change.
Were you or I part of a shill argument whereby two extreme views are argued while a third shill shifts the Heg
Re: (Score:1)
Re:Okay, what is it? (Score:4, Insightful)
Line 1 from The Fine Article linked in summary: "Yubikey Neo is a $50 authentication token (with bells and whistles) from Yubico."
And the whole Slashdot summary: "An anonymous reader writes: Folks at HexView (disclaimer: I contract for the company) took apart Yubikey Neo and found out that, while the key uses solid hardware to ensure secure identity management, its physical anti-tamper measures and durability could be improved. The tear-down analysis is short, but to the point, and offers some very nice close-ups of the internals. One example of the design shortcomings they've identified: Contrary to Yubico's claims, Yubikey appears to be quite destructable. Do not push on it when you touch the sensor while the key is plugged in to a USB port. The point where it bends the most happens to be the point where USB vias are located and through which NFC antenna loop goes. To make things worse, the injection molding hole right next to the connector makes this area even more susceptible to bending."
Now imagine the Slashdot summary with something like the "Line 1 from The Fine Article linked in summary" that explains what the linked article is about...
Re: (Score:2)
Re: (Score:1)
Or even better: Yubikey is an authentication token that acts as a USB keyboard that "types" a long one-time password at the press of a button.
Imagine if someone could write something like this in a Slashdot summary - it would be the end of Slashdot as we know it...
A two factor device (Score:5, Informative)
I know, only because where I work is using them. Idea is it is a general two factor token. Can be programmed by the end user or their org. Also in theory a lot of companies could all use their platform and you have one two factor device for everything but in reality you use it for whatever your company does and nothing else.
Once programmed it acts like a HID class keyboard. You push the button, it spits out a string of characters, that being the two factor code for your account at the time.
Re: (Score:3)
Given that I didn't post the summary (Score:2)
There is little I can do in that regard.
Re: (Score:3)
I don't use it for the Yubikey auth stuff, I use it for my PGP/GPG key. My key was generated on the device, and can never leave it (firmware bugs aside), so I feel it's more secure than one where the private bit of the key is on a computer.
Re: (Score:1)
The easy solution to that is to always have two ubikeys registered with all apps/sites and keep one in a safe location. One breaks, disable it and order a new one to replace it, after which you add it. Sure it requires some amount of work to maintain and it'll cost double what you expected to pay originally but what do you want? Good security ain't cheap. Redundancy is a must.
Re: (Score:2)
I don't feel they really demonstrated such, but yeah, I've got a backup in a safe place and encrypt stuff with both keys.
Here's an anecdote to counter-example the article:
https://twitter.com/drunky_bea... [twitter.com]
Re: (Score:2)
The problem with generating the key on the device is that you can't back it up. Well, there is another issue, you don't know how good the RNG is. The cops won't be able to break it but the NSA/GCHQ might.
Re: (Score:2)
Once programmed it acts like a HID class keyboard. You push the button, it spits out a string of characters, that being the two factor code for your account at the time.
While this describes the original Yubikey, the Neo goes beyond that and acts as a legit security token / smart card which can perform various encryption functions. The only important thing it doesn't yet do is DH.
Re: (Score:2)
Then I guess it'll only be used in the National League.
Re: (Score:2)
The NEO is similar to the standard blue Yubikey, additionally supporting NFC for some protocols. Unfortunately, U2F is
Pretty durable in my real-world use. (Score:4, Interesting)
Re:Pretty durable in my real-world use. (Score:5, Interesting)
You might try using a pencil eraser next time instead of a knife. Wiping vigorously with an alcohol-saturated paper towel first (and really, any easily obtainable alcohol, whether vodka, rubbing alcohol, etc.) helps, too.
Re: (Score:2)
Sound advice, but why not just put a cap on the usb port to cover the sheer "undestructibleness" of the key of crap?
I'm sure this key-chain security dongle (heavy on the DONG) is as secure as it is indestructible. Like the RSA token is super secure, except from every three-letter asswipe with a badge, a gun, and a laptop running G-nessus
Re: (Score:2)
I recommend Deoxit for stuff like this. It not just de-gunks contacts, but leaves a coating of residue to help with further oxidation. I'd also find a way to cover the tip of it as well.
Re: (Score:2)
Durability concerns valid, but... Tampering? (Score:2)
Not sure what benefit "tampering" would provide. Why would you have to take it apart to extract its secrets, when you can just: steal the person's smartphone/computer and the yubikey, and use them in tandem to authenticate yourself as the user to whatever services they have locked behind it? You can use the Yubikey all by itself, assuming you have exclusive physical access to the device, to make it serve its purpose for you, the attacker.
Durability concerns are valid, but I keep it in my wallet, and it is w
Re: (Score:3)
Not sure what benefit "tampering" would provide. Why would you have to take it apart to extract its secrets, when you can just: steal the person's smartphone/computer and the yubikey, and use them in tandem to authenticate yourself as the user to whatever services they have locked behind it? You can use the Yubikey all by itself, assuming you have exclusive physical access to the device, to make it serve its purpose for you, the attacker.
Sure, but you can ONLY use it while it is under your control if the embedded keys cannot be extracted.
If they can, then you can duplicate the key and return the original, perhaps undetected. That gives you the ability to retain access to whatever was secured.
There is definitely value in tamper-resistant key vaults.
Re: (Score:2)
Sure, but if they have to destroy the key to get the secret, and are not just able to non-destructively (side-channel power attacks were published and Yubico added mitigations) get them, then I'd probably notice and use my offline revocation cert to revoke my credentials.
Re: (Score:2)
Good point; I didn't think of that.
It's a very, very rare situation where I have to actually surrender control of my key for long enough that a *physical* (mechanical) attack could take place, though. Even at airports, I just have to put my wallet through the X-ray scanner. A highly specialized robot designed explicitly for this purpose might be able to take apart the key, duplicate it and put it back together seamlessly in the few seconds it's under the hood there, but no human could. And it's apparently h
Re: (Score:2)
I'd love a yubikey neo (nfc) with the form factor of a Nike Fuel Band, but a bit lighter/slimmer. Something I could wear and even shower with, so I'd never worry about my auth token taking a walk. For bonus points make it difficult to unclip (so I'd wake if someone tried to take it off), and have a slide-switch to disable the NFC, so no one could read the auth token at a distance and replay it...
Re: (Score:2)
I use a Yubikey Neo mainly for 2FA with Google's services. The main security boost from it for me is that it is a physical object, and the main avenue of attack for my stuff is via remote. Same reason I use Google's Authenticator app as backup on my smartphone.
Since my Yubikey devices tend to be sessile resiliency isn't that important... but I am definitely not impressed with the durability. My eTokens [1] from SafeNet are far more durable, tamper resistant (once they started one piece epoxy manufacture)
Re: (Score:2)
I don't have one, I have a competitors product the RSA key, which has no USB port at all, you type in the numbers it gives you. Little LCD screen and a buttion. I don't keep mine on any chain, I carry it seperately from anything else.
However, I have to say, for what it is, I have been quite impressed with its durability, in fact, I would say it sets a standard that few devices I have encountered have met, but most all really should....has it ever been through the wash?
My wife has unceremoniously washed, and
Re: (Score:1)
Something you have and something you know... you need both.
*shrug
not that many of us could resist a $5 decryption device for very long
I've been meaning to get one ... (Score:2)
and Google even supports them for authentication. Unless you are a paying customer and use Google for Work (Google Apps), they don't support that yet. :/
Stupid question: how do you use it? (Score:3)
The purpose of the thing is clear enough, but how exactly do you use it? The website implies that it only works with applications that know about it, but that would seem to limit its usefulness a lot. Still, the information on the manufacturer's site is anything but clear.
Re: (Score:2)
I have one of the earlier devices. It generates a OTP that goes along with your normal password. So you plug the device into an SSH port, ssh somewhere, enter your username, then password, then press the button on the Yubikey. It emulates a keyboard and spits out the OTP directly to wherever the keyboard has focus.
Handy, but I have way too many systems to manage to add this in and have it make sense. I think the newer versions allow you to use NFC so you can put the OTP on a phone or tablet.
Re:Stupid question: how do you use it? (Score:4, Funny)
So you plug the device into an SSH port
Are you from TRON?
Re: (Score:2)
Yes. Sorry, meant USB.
Re: (Score:2)
Yes, he should definitely plug that sucker right into port 22 on the back of the Windows box in the lab and tell Dave afterwards and be sure and stop by the break room 'cus we have cake for birthdays today!
Re: (Score:2)
It also has a CCID compatible secure element, so you can use it to store your SSH keys. Instead of setting up OTP on each server and pressing the button, just add the NEO's key to .ssh/authorized_keys on each host. Much simpler.
It also acts as a OpenPGP Card and has support in Android for signing/decrypting email.
Re: (Score:2)
Oh nice. I think the one I have didn't support that functionality (or I missed it).
Re: (Score:2)
You can use it to store your GPG keys and then have GPG act as your SSH agent, so you can require the physical token to ssh to servers.
I've got my Mac setup so I need my Yubikey for sudo as well.
At work we use the GPG key on a Yubikey stashed _inside_ a server to sign our software releases. Someone could hack their way onto the server and if they became root could sign software with the key, but they couldn't copy the key to use later.
Re:Stupid question: how do you use it? (Score:4, Interesting)
The one I find to justify it entirely is LastPass. All of the random sites on the internet that need credentials can have automatically generated passwords that are stored encrypted and I never have to remember them. I just have to remember the LastPass password and have the Yubikey setup with my account. The Yubikey integration requires a LastPass Premium subscription.
Of course, nowadays you can use google authenticator without having a piece of custom hardware or paying for LastPass Premium. But I don't mind supporting good companies with useful products.
Re: (Score:2)
Re: (Score:1)
It has several possible methods that can be integrated: OAUTH-HOTP, TOTP (with software), static password, FIDO, or their own auth mechanism "Yubikey OTP".
Re: (Score:3)
RTFM! it IS potted in epoxy. Guess what? Nasty solvents will dissolve epoxy!
Re: (Score:3)
If you are serious, you at least use the same stuff that the ICs are packaged in, which tends toward the 'black as sin and harder to remove' school of adhesives. Hot nitric acid will usually
Tamper evident (Score:5, Interesting)
He seems to think little of the product, but it appears to me it meets the requirements just fine. It's obvious that his key was tampered with, and nothing was done to try to extract key data from the device. Basically, he can take one apart, but there's little chance someone's going to take my Yubikey in the middle of the night, duplicate the key data, and put it back without me noticing something is wrong. Sure, the NSA could probably do it, but they can't have the time with listening to everyones grandmas phone calls. =)
denial of service attack (Score:2)
if you can damage the device so that the user cannot detect the damage by visual inspection, you can perpetrate a denial of service attack because the user will no longer be able to use it to restart the service, they will have no idea it is broken and the service will not be able to be restarted until a replacement key is made.
Who is using this? (Score:3)
I bought a couple of these keys a few years ago - they are still sitting around in a drawer somewhere. I wasn't too worried about the durability - it seems fine. When I tried it, my issues with were:
1) Very few websites supported it, and those that did made it a pain to set up. Looking at their website, it is supported by gmail, lastpass, dropbox, evernote. I suppose there is a complete list of supported websites and I'm too lazy to go look for it. Any banks support this?
2) Using it on Linux required installing additional software
3) Too expensive - $18 - $50 each. That's fine if I only needed one, but if I have to buy a few in case I lose or break one, then buy a few for the wife and the kid, and then it is only supported by a few websites... Well, not worth it for me.
4) The website is hard to read - written more for IT people than for the lay person. FIDO? OATH-TOPT? I've got no idea what they are talking about on most of their website. The "For Individuals" page is easy to read, but light on details and as soon as you leave it, you are in deep water. Also, can you get duplicate keys in case you lose one? I could never figure out this question from the website. Some sites like gmail allow you to associate more than one key. If there is a list of supported applications and websites, does it also state whether they allow a backup key? If the Yubico wants me to buy and use this thing, it needs to do the research for me and tell me exactly how and why I would want to use it. Something like this hypothetical example*:
1) Buy a Yubikey Neo to use wirelessly with your phone. Keep it on your keychain. Use it to access Lastpass on your phone.
2) Buy a Yubikey Standard for each computer at home and keep it plugged in. Associate it with the same Lastpass account as in #1 - for convenient use on your home computer and as a backup for the one on the keychain.
3) Associate the home Yubikey's with every family member's Lastpass account so that the whole family could share them.
*No idea if this scenerio is possible. Anyone? How would you use it with an ipad or iphone? (do the latest ones have NFC yet?)
Re: (Score:1)
It's getting better, but this is still a problem. One option is to just set it up for LastPass and maybe Google. I agree that securing your online banking access would be a good idea, but very few bank websites support this.
If you just need a key for a desktop or laptop (no NFC), you can get a FIDO U2F key for $6 [amazon.com]. The downside is that LastPass doesn't support these yet (although they're working on it [lastpass.com]). Google already supports them.
I'm 12 years old and what is Yubikey (Score:2)
EOM
Use mine 20+ times a day (Score:4, Informative)
Really addicted to mine. I have my private SSH key on there (via GPG/PGP), so that's never on my working machines. Use the standard OTP on several personally-run sites. Use U2F security for Google apps. Use the TOTP (a.k.a. Google Authenticator/Authy) app. Use the challenge-response mode as a second factor on my KeePass database. Amazing gadget.
The question regarding the teardown is... "so"? Even with full pin access to the A7005 chip, you *STILL* wouldn't have access to my GPG/SSH private key or my TOTP generators within it. That's the point of a secure element. You'd have to dissolve the casing of the A7005 chip and have a decent microscope lab to get those bits of data out of the chip. You would be able to use my U2F/OTP/TOTP-generated-code functionality. But, you could do that just by stealing my Neo and plugging it into a USB slot without any acetone bath involved.
Re: (Score:2)
I work in schools, I'd love to move to key authentication to save all the "kids forgetting their password / stealing their friends password" hassle (physical items are more difficult to lose or "steal" without getting into more trouble!) but the costs are still FUCKING ludicrous for any such solution and two-thirds of that cost is just software and nothing to do with the devices at all. Still struggling to justify this:
The software to put this into AD logins (which is what most businesses use to tie all th
Re: (Score:2)
Show me how that works for Windows login without the exact software mentioned above?
LDAP. Yes. AD login from Windows login screen? No.
CVE-2015-3298 (Score:2)
In case anyone missed it, if you're using one for OpenPGP key use you might be vulnerable to a pin bypass attack [yubico.com]. Details on how to check are on that page.
If you have a vulnerable device, YubiCo will send you a free replacement upon request - just open a ticket [yubico.com] with your serial and order numbers.