Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security Hardware

Yubikey Neo Teardown and Durability Review 88

Posted by timothy from the do-not-place-in-any-mailbox dept.
An anonymous reader writes: Folks at HexView (disclaimer: I contract for the company) took apart Yubikey Neo and found out that, while the key uses solid hardware to ensure secure identity management, its physical anti-tamper measures and durability could be improved. The tear-down analysis is short, but to the point, and offers some very nice close-ups of the internals. One example of the design shortcomings they've identified: Contrary to Yubico's claims, Yubikey appears to be quite destructable. Do not push on it when you touch the sensor while the key is plugged in to a USB port. The point where it bends the most happens to be the point where USB vias are located and through which NFC antenna loop goes. To make things worse, the injection molding hole right next to the connector makes this area even more susceptible to bending.
This discussion has been archived. No new comments can be posted.

Yubikey Neo Teardown and Durability Review More

Yubikey Neo Teardown and Durability Review

Comments Filter:

  • Okay, what is it? (Score:5, Insightful)

    by TWX ( 665546 ) on Tuesday May 19, 2015 @11:40AM (#49727089)
    The branding, "Yubikey Neo," means nothing to me. Sounds like an Asian version of the main character from The Matrix.

    • "Yubikey?" No, I walkie. She drovie.

    • Exactly. Even on a site for Computer Geeks and Nerds, It is silly to think we know of every new fangled device that is released, and their particular marketing claims of the day.
      Being the poster contracted for the company, it probably means he is engulfed in the sales and marketing of the company and makes him believe that this is a really popular product. While it just covers a small niche.

    • Line 1 from The Fine Article linked in summary: "Yubikey Neo is a $50 authentication token (with bells and whistles) from Yubico."

      • Re:Okay, what is it? (Score:4, Insightful)

        by antiperimetaparalogo ( 4091871 ) on Tuesday May 19, 2015 @12:13PM (#49727467)

        Line 1 from The Fine Article linked in summary: "Yubikey Neo is a $50 authentication token (with bells and whistles) from Yubico."

        And the whole Slashdot summary: "An anonymous reader writes: Folks at HexView (disclaimer: I contract for the company) took apart Yubikey Neo and found out that, while the key uses solid hardware to ensure secure identity management, its physical anti-tamper measures and durability could be improved. The tear-down analysis is short, but to the point, and offers some very nice close-ups of the internals. One example of the design shortcomings they've identified: Contrary to Yubico's claims, Yubikey appears to be quite destructable. Do not push on it when you touch the sensor while the key is plugged in to a USB port. The point where it bends the most happens to be the point where USB vias are located and through which NFC antenna loop goes. To make things worse, the injection molding hole right next to the connector makes this area even more susceptible to bending."

        Now imagine the Slashdot summary with something like the "Line 1 from The Fine Article linked in summary" that explains what the linked article is about...

        • Or even better: Yubikey is an authentication token that acts as a USB keyboard that "types" a long one-time password at the press of a button.

          • Or even better: Yubikey is an authentication token that acts as a USB keyboard that "types" a long one-time password at the press of a button.

            Imagine if someone could write something like this in a Slashdot summary - it would be the end of Slashdot as we know it...

    • A two factor device (Score:5, Informative)

      by Sycraft-fu ( 314770 ) on Tuesday May 19, 2015 @12:29PM (#49727625)

      I know, only because where I work is using them. Idea is it is a general two factor token. Can be programmed by the end user or their org. Also in theory a lot of companies could all use their platform and you have one two factor device for everything but in reality you use it for whatever your company does and nothing else.

      Once programmed it acts like a HID class keyboard. You push the button, it spits out a string of characters, that being the two factor code for your account at the time.

      • Re: (Score:3)

        by TWX ( 665546 )
        Simply adding a hint of what you posted would have made the article summary work a whole lot better.

      • Re: (Score:3)

        by rthille ( 8526 )

        I don't use it for the Yubikey auth stuff, I use it for my PGP/GPG key. My key was generated on the device, and can never leave it (firmware bugs aside), so I feel it's more secure than one where the private bit of the key is on a computer.

        • Re: (Score:2)

          by AmiMoJo ( 196126 )

          The problem with generating the key on the device is that you can't back it up. Well, there is another issue, you don't know how good the RNG is. The cops won't be able to break it but the NSA/GCHQ might.

      • Once programmed it acts like a HID class keyboard. You push the button, it spits out a string of characters, that being the two factor code for your account at the time.

        While this describes the original Yubikey, the Neo goes beyond that and acts as a legit security token / smart card which can perform various encryption functions. The only important thing it doesn't yet do is DH.

    • The Yubikey can serve as a One-Time-Password(OTP), Universal Second Factor (U2F) Authentication, Etc. I primarily use it for the U2F, which is similar to an RSA Token, but it conveniently eliminates token expiration anxiety, and errors frequently caused by chronic butterfingers. I just jam it into a USB port, it gets recognized as a keyboard, I press the little light on the top, and boom!

      The NEO is similar to the standard blue Yubikey, additionally supporting NFC for some protocols. Unfortunately, U2F is

  • Pretty durable in my real-world use. (Score:4, Interesting)

    by hawkeyeMI ( 412577 ) <brock@NOSPaM.brocktice.com> on Tuesday May 19, 2015 @11:56AM (#49727289) Homepage
    I have one that I've carried and abused daily for years, still working, though I think it's getting close to needing a replacement. My biggest problem, because I wear it on a necklace chain, is that it's been getting sweat on the contacts which eventually have gunked up and corroded. I was able to scrape it off with a knife, but that scraped off the gold plating and exposed the copper underneath, which is of course corroding much worse. I've got the private key locked away here somewhere so I can flash one of my spares and be up and running quickly, or I can just add the new key to the places I use it before it croaks. I've had more problems with USB ports getting worn out.

    • Re:Pretty durable in my real-world use. (Score:5, Interesting)

      by pz ( 113803 ) on Tuesday May 19, 2015 @12:06PM (#49727391) Journal

      You might try using a pencil eraser next time instead of a knife. Wiping vigorously with an alcohol-saturated paper towel first (and really, any easily obtainable alcohol, whether vodka, rubbing alcohol, etc.) helps, too.

      • Sound advice, but why not just put a cap on the usb port to cover the sheer "undestructibleness" of the key of crap?

        I'm sure this key-chain security dongle (heavy on the DONG) is as secure as it is indestructible. Like the RSA token is super secure, except from every three-letter asswipe with a badge, a gun, and a laptop running G-nessus

      • Re: (Score:2)

        by mlts ( 1038732 )

        I recommend Deoxit for stuff like this. It not just de-gunks contacts, but leaves a coating of residue to help with further oxidation. I'd also find a way to cover the tip of it as well.

      • Thanks. This is probably the best option. I haven't ever had to deal with this before recently so I just used what I had handy -- my multitool. I also have a few cans of CorrosionX.

  • Not sure what benefit "tampering" would provide. Why would you have to take it apart to extract its secrets, when you can just: steal the person's smartphone/computer and the yubikey, and use them in tandem to authenticate yourself as the user to whatever services they have locked behind it? You can use the Yubikey all by itself, assuming you have exclusive physical access to the device, to make it serve its purpose for you, the attacker.

    Durability concerns are valid, but I keep it in my wallet, and it is w

    • Re: (Score:3)

      by Rich0 ( 548339 )

      Not sure what benefit "tampering" would provide. Why would you have to take it apart to extract its secrets, when you can just: steal the person's smartphone/computer and the yubikey, and use them in tandem to authenticate yourself as the user to whatever services they have locked behind it? You can use the Yubikey all by itself, assuming you have exclusive physical access to the device, to make it serve its purpose for you, the attacker.

      Sure, but you can ONLY use it while it is under your control if the embedded keys cannot be extracted.

      If they can, then you can duplicate the key and return the original, perhaps undetected. That gives you the ability to retain access to whatever was secured.

      There is definitely value in tamper-resistant key vaults.

      • Re: (Score:2)

        by rthille ( 8526 )

        Sure, but if they have to destroy the key to get the secret, and are not just able to non-destructively (side-channel power attacks were published and Yubico added mitigations) get them, then I'd probably notice and use my offline revocation cert to revoke my credentials.

      • Good point; I didn't think of that.

        It's a very, very rare situation where I have to actually surrender control of my key for long enough that a *physical* (mechanical) attack could take place, though. Even at airports, I just have to put my wallet through the X-ray scanner. A highly specialized robot designed explicitly for this purpose might be able to take apart the key, duplicate it and put it back together seamlessly in the few seconds it's under the hood there, but no human could. And it's apparently h

        • Re: (Score:2)

          by rthille ( 8526 )

          I'd love a yubikey neo (nfc) with the form factor of a Nike Fuel Band, but a bit lighter/slimmer. Something I could wear and even shower with, so I'd never worry about my auth token taking a walk. For bonus points make it difficult to unclip (so I'd wake if someone tried to take it off), and have a slide-switch to disable the NFC, so no one could read the auth token at a distance and replay it...

    • Re: (Score:2)

      by mlts ( 1038732 )

      I use a Yubikey Neo mainly for 2FA with Google's services. The main security boost from it for me is that it is a physical object, and the main avenue of attack for my stuff is via remote. Same reason I use Google's Authenticator app as backup on my smartphone.

      Since my Yubikey devices tend to be sessile resiliency isn't that important... but I am definitely not impressed with the durability. My eTokens [1] from SafeNet are far more durable, tamper resistant (once they started one piece epoxy manufacture)

    • Re: (Score:2)

      by TheCarp ( 96830 )

      I don't have one, I have a competitors product the RSA key, which has no USB port at all, you type in the numbers it gives you. Little LCD screen and a buttion. I don't keep mine on any chain, I carry it seperately from anything else.

      However, I have to say, for what it is, I have been quite impressed with its durability, in fact, I would say it sets a standard that few devices I have encountered have met, but most all really should....has it ever been through the wash?

      My wife has unceremoniously washed, and

    • If you're using it with a one time password to add 2 factor auth it doesn't matter if somebody gets the yubikey and/or pc.
      Something you have and something you know... you need both.

      *shrug
      not that many of us could resist a $5 decryption device for very long

  • and Google even supports them for authentication. Unless you are a paying customer and use Google for Work (Google Apps), they don't support that yet. :/

  • Stupid question: how do you use it? (Score:3)

    by bradley13 ( 1118935 ) on Tuesday May 19, 2015 @12:10PM (#49727437) Homepage

    The purpose of the thing is clear enough, but how exactly do you use it? The website implies that it only works with applications that know about it, but that would seem to limit its usefulness a lot. Still, the information on the manufacturer's site is anything but clear.

    • Re: (Score:2)

      by Enry ( 630 )

      I have one of the earlier devices. It generates a OTP that goes along with your normal password. So you plug the device into an SSH port, ssh somewhere, enter your username, then password, then press the button on the Yubikey. It emulates a keyboard and spits out the OTP directly to wherever the keyboard has focus.

      Handy, but I have way too many systems to manage to add this in and have it make sense. I think the newer versions allow you to use NFC so you can put the OTP on a phone or tablet.

      • Re:Stupid question: how do you use it? (Score:4, Funny)

        by wonkey_monkey ( 2592601 ) on Tuesday May 19, 2015 @12:18PM (#49727501) Homepage

        So you plug the device into an SSH port

        Are you from TRON?

        • Re: (Score:2)

          by Enry ( 630 )

          Yes. Sorry, meant USB.

        • Yes, he should definitely plug that sucker right into port 22 on the back of the Windows box in the lab and tell Dave afterwards and be sure and stop by the break room 'cus we have cake for birthdays today!

      • Re: (Score:2)

        by chihowa ( 366380 )

        It also has a CCID compatible secure element, so you can use it to store your SSH keys. Instead of setting up OTP on each server and pressing the button, just add the NEO's key to .ssh/authorized_keys on each host. Much simpler.

        It also acts as a OpenPGP Card and has support in Android for signing/decrypting email.

        • Re: (Score:2)

          by Enry ( 630 )

          Oh nice. I think the one I have didn't support that functionality (or I missed it).

      • Re: (Score:2)

        by rthille ( 8526 )

        You can use it to store your GPG keys and then have GPG act as your SSH agent, so you can require the physical token to ssh to servers.
        I've got my Mac setup so I need my Yubikey for sudo as well.

        At work we use the GPG key on a Yubikey stashed _inside_ a server to sign our software releases. Someone could hack their way onto the server and if they became root could sign software with the key, but they couldn't copy the key to use later.

    • Re:Stupid question: how do you use it? (Score:4, Interesting)

      by qwijibo ( 101731 ) on Tuesday May 19, 2015 @12:20PM (#49727523)
      It's a second factor in two factor authentication (2FA) for applications that support it.

      The one I find to justify it entirely is LastPass. All of the random sites on the internet that need credentials can have automatically generated passwords that are stored encrypted and I never have to remember them. I just have to remember the LastPass password and have the Yubikey setup with my account. The Yubikey integration requires a LastPass Premium subscription.

      Of course, nowadays you can use google authenticator without having a piece of custom hardware or paying for LastPass Premium. But I don't mind supporting good companies with useful products.
    • For the average consumer it isn't that useful (while it is certainly a neat toy that can be used). I see it more at the enterprise level where if you want to VPN into your company's intranet files, they typically want more than just the normal password. That's where this comes in, it verifies it is physically you as well as your knowledge of the login password (The basis behind 2-factor authentication). Many places use an SMS or app like Duo Mobile (what my company uses). This is just another way of doing

    • Re: (Score:1)

      by Anonymous Coward

      It has several possible methods that can be integrated: OAUTH-HOTP, TOTP (with software), static password, FIDO, or their own auth mechanism "Yubikey OTP".

  • Tamper evident (Score:5, Interesting)

    by qwijibo ( 101731 ) on Tuesday May 19, 2015 @12:32PM (#49727655)
    From TFA: For those interested, FIPS140-2 Level 1 means that a device has at least one standard ("approved") security algorithm or function and Level 2 means that physical design is tamper-evident.

    He seems to think little of the product, but it appears to me it meets the requirements just fine. It's obvious that his key was tampered with, and nothing was done to try to extract key data from the device. Basically, he can take one apart, but there's little chance someone's going to take my Yubikey in the middle of the night, duplicate the key data, and put it back without me noticing something is wrong. Sure, the NSA could probably do it, but they can't have the time with listening to everyones grandmas phone calls. =)

  • if you can damage the device so that the user cannot detect the damage by visual inspection, you can perpetrate a denial of service attack because the user will no longer be able to use it to restart the service, they will have no idea it is broken and the service will not be able to be restarted until a replacement key is made.

  • Who is using this? (Score:3)

    by Hrrrg ( 565259 ) on Tuesday May 19, 2015 @12:54PM (#49727865)

    I bought a couple of these keys a few years ago - they are still sitting around in a drawer somewhere. I wasn't too worried about the durability - it seems fine. When I tried it, my issues with were:

    1) Very few websites supported it, and those that did made it a pain to set up. Looking at their website, it is supported by gmail, lastpass, dropbox, evernote. I suppose there is a complete list of supported websites and I'm too lazy to go look for it. Any banks support this?
    2) Using it on Linux required installing additional software
    3) Too expensive - $18 - $50 each. That's fine if I only needed one, but if I have to buy a few in case I lose or break one, then buy a few for the wife and the kid, and then it is only supported by a few websites... Well, not worth it for me.
    4) The website is hard to read - written more for IT people than for the lay person. FIDO? OATH-TOPT? I've got no idea what they are talking about on most of their website. The "For Individuals" page is easy to read, but light on details and as soon as you leave it, you are in deep water. Also, can you get duplicate keys in case you lose one? I could never figure out this question from the website. Some sites like gmail allow you to associate more than one key. If there is a list of supported applications and websites, does it also state whether they allow a backup key? If the Yubico wants me to buy and use this thing, it needs to do the research for me and tell me exactly how and why I would want to use it. Something like this hypothetical example*:

    1) Buy a Yubikey Neo to use wirelessly with your phone. Keep it on your keychain. Use it to access Lastpass on your phone.
    2) Buy a Yubikey Standard for each computer at home and keep it plugged in. Associate it with the same Lastpass account as in #1 - for convenient use on your home computer and as a backup for the one on the keychain.
    3) Associate the home Yubikey's with every family member's Lastpass account so that the whole family could share them.

    *No idea if this scenerio is possible. Anyone? How would you use it with an ipad or iphone? (do the latest ones have NFC yet?)

    • Re: (Score:1)

      by homm2 ( 729109 )

      1) Very few websites supported it

      It's getting better, but this is still a problem. One option is to just set it up for LastPass and maybe Google. I agree that securing your online banking access would be a good idea, but very few bank websites support this.

      3) Too expensive - $18 - $50 each.

      If you just need a key for a desktop or laptop (no NFC), you can get a FIDO U2F key for $6 [amazon.com]. The downside is that LastPass doesn't support these yet (although they're working on it [lastpass.com]). Google already supports them.

      does it

  • Use mine 20+ times a day (Score:4, Informative)

    by Average ( 648 ) on Tuesday May 19, 2015 @03:15PM (#49729261)

    Really addicted to mine. I have my private SSH key on there (via GPG/PGP), so that's never on my working machines. Use the standard OTP on several personally-run sites. Use U2F security for Google apps. Use the TOTP (a.k.a. Google Authenticator/Authy) app. Use the challenge-response mode as a second factor on my KeePass database. Amazing gadget.

    The question regarding the teardown is... "so"? Even with full pin access to the A7005 chip, you *STILL* wouldn't have access to my GPG/SSH private key or my TOTP generators within it. That's the point of a secure element. You'd have to dissolve the casing of the A7005 chip and have a decent microscope lab to get those bits of data out of the chip. You would be able to use my U2F/OTP/TOTP-generated-code functionality. But, you could do that just by stealing my Neo and plugging it into a USB slot without any acetone bath involved.

    • Re: (Score:2)

      by ledow ( 319597 )

      I work in schools, I'd love to move to key authentication to save all the "kids forgetting their password / stealing their friends password" hassle (physical items are more difficult to lose or "steal" without getting into more trouble!) but the costs are still FUCKING ludicrous for any such solution and two-thirds of that cost is just software and nothing to do with the devices at all. Still struggling to justify this:

      The software to put this into AD logins (which is what most businesses use to tie all th

  • In case anyone missed it, if you're using one for OpenPGP key use you might be vulnerable to a pin bypass attack [yubico.com]. Details on how to check are on that page.

    If you have a vulnerable device, YubiCo will send you a free replacement upon request - just open a ticket [yubico.com] with your serial and order numbers.

Slashdot Top Deals

Avoid strange women and temporary variables.

Close