|
A little over a year ago I discivered a Yubikey Replay Attack . The YubiKey is a hardware authentication token that looks like a small USB memory stick, but it is actually a keyboard. With the command of an integrated touch button, the device can send a time-variant, secure login code as if it was typed in from a keyboard. And because USB-keyboards are standard on all computers the YubiKey works on all platforms and browsers without the need for client software. I believe the YubiKey is the answer to many password / security problems we have. If you are not using a Yubikey are are not as safe as you could be. And it is easy. Everyone should be using a Yubikey , LastPass and TrueCrypt. I believe in the Trush NoOne (TNO) ideal of information security. However, with a Yubikey you are required to trust Yubico. So, If you can't trust them, you should Trust But Verify (TBV). Here is a simple script to verify Yubico has not slipped. About the only problem with Yubikey is the Replay Attack.
#!/usr/bin/perl
#use strict;
#use Yubico::Auth;
use LWP::Simple;
$id = "1"; # Your Yubikey ID here
$logfile = "./usedkeys";
@otp_list = "";
$x = 0;
open(LOG,">$logfile") || die("Can't open $logfile\n");
do {
$x=$x+1;
print "Press Key? "; # Ask for input
$otp = <STDIN>; # Get input chop $otp; # Chop off newline if ($opt ne "stop") {
$url = "http://api.yubico.com/wsapi/verify?id=". $id ."&otp=". $otp;
$req = get($url); chop $req;
die "Request Error" unless $req;
print LOG $x. " ". $id. " ". $otp. "\n". $req. "\n";
push(@otp_list, $otp);
} } while ($otp ne "stop"); # Redo while wrong input
print LOG "\n>>> Re-pay the keys\n\n";
$x = 0; foreach $reotp(@otp_list) {
$x = $x+1;
$url = "http://api.yubico.com/wsapi/verify?id=". $id ."&otp=". $reotp;
$req = get($url);
chop $req; print LOG $x. " ". $id. " ". $reotp. "\n". $req. "\n";
}
close(LOG);
print @otp_list. "\n"; |
Blog
