dsad

<p>Hardware security keys, such as the <a data-component="externalLink" href="https://store.google.com/us/product/titan_security_key" rel="noopener noreferrer" target="_blank">Google Titan</a>, have become a cornerstone of enterprise security, adding a much-needed layer of protection on top of the password. But researchers have now shown that it is possible to clone keys -- given the key, a few hours, and thousands of dollars.</p><p>Researchers from security firm NinjaLab have managed to <a href="https://www.zdnet.com/article/new-side-channel-attack-can-recover-encryption-keys-from-google-titan-security-keys/">make a clone of a Google Titan 2FA security key</a>. The process makes use of a side-channel vulnerability in the NXP A700X chip.</p><p><strong>Must read</strong>: <a href="https://www.zdnet.com/article/best-security-key/"><strong>Best security keys in 2021: Hardware-based two-factor authentication for online protection</strong></a></p><div class="shortcodeGalleryWrapper" data-component="lazyloadImages">

<a class="gallery-title" data-component="imageGalleryModal" href="/pictures/yubikey-5c-nfc-the-worlds-first-security-key-to-feature-dual-usb-c-and-nfc-connections/"><span>YubiKey 5C NFC: The world’s first security...</span></a>

<a class="full-gallery" data-component="imageGalleryModal" data-omniture-track="moduleClick" data-omniture-track-data='{"moduleInfo": "see_full_gallery", "pageType": "article"}' href="/pictures/yubikey-5c-nfc-the-worlds-first-security-key-to-feature-dual-usb-c-and-nfc-connections/">SEE FULL GALLERY</a>

</div>

</a>

</div>

</a>

</div>

</a>

</div>

</a>

</div>

</a>

</div>

</a>

</div>

</a>

</div>

</a>

</div>

</a>

</div>

NEXT <svg class="caret">

</svg>

</a>

</span>

</svg>

</a>

</span>

</div>

<p>I'll let you read up on this, but basically, the process requires having physical access to the key, take hours, involves trashing the casing to get at the chip, thousands of dollars of equipment, custom software, and a lot of know-how.</p><p>Oh, and the attacker also needs the target's account password.</p><p>The idea is that after the cloning process, the original key is put back into a new shell and given back to the rightful owner.</p><p>This will, as you might expect, be worrying for organizations that rely on 2FA keys. That said, the amount of information, along with free time an attacker needs to accomplish this is high. I mean, needing both the key and the password are themselves high hurdles.</p>

</div>

</section>

<p>On top of that, getting at the key involves trashing the casing of the original. This means that the replacement needs to be convincing, and in my experience keys take on a distinctive battering after very little use.</p><div data-shortcode=""></div>

<span class="int">ZDNet Recommends</span>

</h3>

</a>

</div>

The best security keys: Hardware-based two-factor authentication for online protection

</a>

</p>

<p class="dek">While robust passwords go a long way to securing your valuable online accounts, hardware-based two-factor authentication takes that security to the next level.</p>

</p>

</div>

<p>So, what can you do to mitigate this attack?</p><ul><li>Have strong passwords.</li><li>Treat your 2FA keys the same way you'd treat your car or house keys -- keep them with you at all times. </li><li>Make your keys distinctive -- I know someone who puts a spot of glittery nail polish on their key, leaves it to dry, and takes a photo of the unique glittery blob.</li><li>If you believe that your key has been compromised, inform your IT department (or, if that's you, remove the offending key from your accounts).</li><li>Google can detect cloned keys using its FIDO U2F counters feature.</li></ul><p>I expect that this will result in better, more tamper-resistant keys in the future. I use 2FA keys, and I am surprised how little tamper-resistance Google's Titan Bluetooth key has -- the shell snaps off easily to expose the innards.</p><div class="shortcodeGalleryWrapper" data-component="lazyloadImages">

<a class="gallery-title" data-component="imageGalleryModal" href="/pictures/inside-a-google-titan-bluetooth-security-key/"><span>Inside a Google Titan Bluetooth security...</span></a>

<a class="full-gallery" data-component="imageGalleryModal" data-omniture-track="moduleClick" data-omniture-track-data='{"moduleInfo": "see_full_gallery", "pageType": "article"}' href="/pictures/inside-a-google-titan-bluetooth-security-key/">SEE FULL GALLERY</a>

</div>

</a>

</div>

</a>

</div>

</a>

</div>

</a>

</div>

</a>

</div>

</a>

</div>

</a>

</div>

</a>

</div>

</a>

</div>

NEXT <svg class="caret">

</svg>

</a>

</span>

</svg>

</a>

</span>

</div>

<p>Still, the ingenuity of this attack should be applauded. It's a very impressive hack.</p><div data-shortcode=""></div>

<span class="int">Security</span>

</h3>

<ul>

<li>

<a data-omniture-track="moduleClick" data-omniture-track-data='{"moduleInfo": "pinbox", "pageType": "article"}' href="https://www.zdnet.com/article/online-security-101-how-to-protect-your-privacy-from-hackers-spies-and-the-government/">Cyber security 101: Protect your privacy from hackers, spies, and the government</a>

</li>

<li>

<a data-omniture-track="moduleClick" data-omniture-track-data='{"moduleInfo": "pinbox", "pageType": "article"}' href="https://www.zdnet.com/article/the-biggest-hacks-data-breaches-of-2020/">The biggest hacks, data breaches of 2020</a>

</li>

<li>

<a data-omniture-track="moduleClick" data-omniture-track-data='{"moduleInfo": "pinbox", "pageType": "article"}' href="https://www.zdnet.com/article/best-vpn-services-for-2021-safe-and-fast-dont-come-for-free/">The best VPNs for business and home use</a>

</li>

<li>

<a data-omniture-track="moduleClick" data-omniture-track-data='{"moduleInfo": "pinbox", "pageType": "article"}' href="https://www.zdnet.com/article/best-security-key/">The best security keys for two-factor authentication</a>

</li>

<li>

<a data-omniture-track="moduleClick" data-omniture-track-data='{"moduleInfo": "pinbox", "pageType": "article"}' href="https://www.zdnet.com/article/best-security-camera/">The best security cameras for business and home use</a>

</li>

<li>

<a data-component="externalLink" data-omniture-track="moduleClick" data-omniture-track-data='{"moduleInfo": "pinbox", "pageType": "article"}' href="https://www.youtube.com/watch?v=a4DApIHacPI" rel="noopener noreferrer" target="_blank">How hackers are trying to use QR codes as an entry point for cyber attacks (ZDNet YouTube)</a>

</li>

<li>

<a data-component="externalLink" data-omniture-track="moduleClick" data-omniture-track-data='{"moduleInfo": "pinbox", "pageType": "article"}' href="https://www.techrepublic.com/article/how-to-improve-the-security-of-your-public-cloud/?ftag=CMG-01-10aaa1b" rel="noopener noreferrer" target="_blank">How to improve the security of your public cloud (TechRepublic)</a>

</li>

</ul>

</div>

dsad

Report Page