New Eucleak attack lets threat actors clone YubiKey FIDO keys

Share:

A new “EUCLEAK” flaw found in FIDO devices using the Infineon SLE78 security microcontroller, like Yubico’s YubiKey 5 Series, allows attackers to extract Elliptic Curve Digital Signature Algorithm (ECDSA) secret keys and clone the FIDO device.

NinjaLab’s Thomas Roche, who discovered the flaw and devised the EUCLEAK side-channel attack, notes that the side channel can retrieve an ECDSA secret key using EM acquisitions.

However, the attack requires extended physical access, specialized equipment, and a high level of understanding of electronics and cryptography.

These prerequisites significantly mitigate the risk, limiting it mostly to attacks from highly sophisticated, state-sponsored threat actors against high-value targets. With that said, EUCLEAK is not considered a threat to general users, even to those who use theoretically vulnerable devices.

In 2021, Roche found a side-channel attack that targeted Google Titan security keys, allowing him to extract the ECDSA private key and clone the device.

Yubico responds to EUCLEAK

The flaw impacts YubiKey 5 Series devices running firmware versions older than 5.7.0, which uses Infineon’s flawed cryptographic library.

The models impacted by EUCLEAK are:

  • YubiKey 5 Series versions prior to 5.7
  • YubiKey 5 FIPS Series prior to 5.7
  • YubiKey 5 CSPN Series prior to 5.7
  • YubiKey Bio Series versions prior to 5.7.2
  • Security Key Series all versions prior to 5.7
  • YubiHSM 2 versions prior to 2.4.0
  • YubiHSM 2 FIPS versions prior to 2.4.0

The vendor rated the issue as moderate, assigning a CVSS score of only 4.9, which reflects its low risk.

Also, Yubico notes in its advisory that attackers attempting to recover credentials from impacted keys would require the user PIN or biometric verification for full exploitation, making successful attacks even harder.

YubiKey owners can check the firmware version of the security keys using YubiKey Manager or YubiKey Authenticator.

Unfortunately, if you are using a vulnerable version, there is no way to upgrade the firmware to the latest 5.7.0 (YubiKey) or 2.4.0 (YubiHSM) versions to mitigate this flaw.

The vendor recommends using RSA signing keys instead of elliptic curve (ECC) signing keys and limiting the maximum session duration from the identity provider settings to require more frequent FIDO authentications.

Other impacted products

NinjaLab confirmed that EUCLEAK also impacts Infineon TPMs (SLB96xx), used for secure boot, authentication, and cryptographic operations, and Infineon’s Optiga Trust M security microcontroller, used in IoT devices.

Infineon TPMs are used in the smart enclaves of old (between 2013 and 2018) smartphones and tablets from Samsung and OnePlus, and also some dated (from mid-2010s) laptop models from Lenovo, Acer, Dell, HP, and LG.

The Feitian A22 JavaCard, used in smart cards and authentication systems, is also impacted by using the Infineon SLE78 microcontroller.

ADVERTISING

Other potentially impacted devices include e-passports, cryptocurrency hardware wallets (cold wallets), IoT devices, and any FIDO device that uses Infineon’s SLE78.

Bill Toulas

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
2:44 am, Jan 24, 2025
weather icon 9°C
L: 8° | H: 10°
overcast clouds
Humidity: 91 %
Pressure: 996 mb
Wind: 11 mph SW
Wind Gust: 22 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 100%
Rain Chance: 0%
Visibility: 6 km
Sunrise: 7:49 am
Sunset: 4:35 pm
DailyHourly
Daily ForecastHourly Forecast
Today 9:00 pm
weather icon
8° | 10°°C 1 mm 100% 24 mph 91 % 1002 mb 0 mm/h
Tomorrow 9:00 pm
weather icon
3° | 5°°C 1 mm 100% 11 mph 90 % 1010 mb 0 mm/h
Sun Jan 26 9:00 pm
weather icon
2° | 7°°C 1 mm 100% 15 mph 97 % 1009 mb 0 mm/h
Mon Jan 27 9:00 pm
weather icon
6° | 8°°C 1 mm 100% 12 mph 98 % 991 mb 0 mm/h
Tue Jan 28 9:00 pm
weather icon
5° | 7°°C 1 mm 100% 15 mph 92 % 999 mb 0 mm/h
Today 3:00 am
weather icon
9° | 10°°C 0.83 mm 83% 22 mph 91 % 996 mb 0 mm/h
Today 6:00 am
weather icon
9° | 10°°C 1 mm 100% 24 mph 89 % 995 mb 0 mm/h
Today 9:00 am
weather icon
10° | 11°°C 1 mm 100% 15 mph 85 % 994 mb 0 mm/h
Today 12:00 pm
weather icon
9° | 9°°C 0.8 mm 80% 17 mph 60 % 997 mb 0 mm/h
Today 3:00 pm
weather icon
8° | 8°°C 0 mm 0% 13 mph 50 % 999 mb 0 mm/h
Today 6:00 pm
weather icon
7° | 7°°C 0 mm 0% 9 mph 56 % 1002 mb 0 mm/h
Today 9:00 pm
weather icon
6° | 6°°C 0 mm 0% 5 mph 63 % 1002 mb 0 mm/h
Tomorrow 12:00 am
weather icon
5° | 5°°C 0 mm 0% 4 mph 68 % 1000 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€99,380.79
1.38%
Ethereum(ETH)
€3,177.86
3.00%
XRP(XRP)
€2.96
-1.83%
Tether(USDT)
€0.96
0.05%
Solana(SOL)
€240.44
1.08%
USDC(USDC)
€0.96
-0.01%
Dogecoin(DOGE)
€0.333220
-1.78%
Shiba Inu(SHIB)
€0.000019
-1.03%
Pepe(PEPE)
€0.000014
0.07%
Peanut the Squirrel(PNUT)
€0.333452
-4.27%
Scroll to Top