potentially serious vulnerability in the Bluetooth-supported
version of Google’s Titan Security
Keys that could not be patched with a software update.
However, users do not need to worry as Google has announced to
offer a free replacement[2]
for the affected Titan Security Key dongles.
In a security advisory published Wednesday, Google said a
“misconfiguration in the Titan Security Keys Bluetooth pairing
protocols” could allow an attacker who is physically close to your
Security Key (~within 30 feet) to communicate with it or the device
to which your key is paired.
Launched by Google in August last year, Titan Security
Key is a tiny low-cost USB device that offers hardware-based
two-factor authentication (2FA) for online accounts with the
highest level of protection against phishing attacks.
Titan Security Key, which sells for $50 in the Google Store,
includes two keys—a USB-A security key with NFC, and a
battery-powered, Micro-USB-equipped Bluetooth/NFC key—for secure
two-factor authentication.
According to Google, the vulnerability only affects the BLE
version of Titan Security Keys that have a “T1” or “T2” sign on the
back of it, and other non-Bluetooth security keys, USB or NFC
supported versions, are safe to use.
Here’s the attack scenarios Google Cloud Product Manager
Christiaan Brand described in a blog
post[4]:
“When you’re trying to sign into an account on your device, you are
normally asked to press the button on your BLE security key to
activate it. An attacker in close physical proximity at that moment
in time can potentially connect their own device to your affected
security key before your own device connects. In this set of
circumstances, the attacker could sign into your account using
their own device if the attacker somehow already obtained your
username and password and could time these events exactly.”
“Before you can use your security key, it must be paired to your
device. Once paired, an attacker in close physical proximity to you
could use their device to masquerade as your affected security key
and connect to your device at the moment you are asked to press the
button on your key. After that, they could attempt to change their
device to appear as a Bluetooth keyboard or mouse and potentially
take actions on your device.”
to Google, as well as Feitian, the company that makes Titan Keys
for Google and also sells the same product (ePass) under its own
brand.
Feitian also made a coordinated disclosure about this vulnerability
the same day as Google and is offering a free replacement program for its users.
Since the issue only affects the Bluetooth Low Energy pairing
protocol and not the cryptographic security of the key itself,
Google recommends affected users to continue using their existing
keys until they get a replacement.
Google also says that the Bluetooth security key is still more
secure than turning it off altogether or relying on other
two-factor authentication methods like SMS or phone call.
However, it would be best if you take some extra measures while
using the security keys, like using them only in a private place
and immediately unpairing them.
References
- ^
Titan Security Keys
(thehackernews.com) - ^
free replacement
(www.google.com) - ^
Titan Security Key
(thehackernews.com) - ^
blog post
(security.googleblog.com) - ^
free replacement
(www.ftsafe.com)
Read more http://feedproxy.google.com/~r/TheHackersNews/~3/aZMCSWEnDVY/google-titan-security-key.html