TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Black Hills InfoSec

How to Weaponize the Yubikey

BHIS · 2019-05-02 · Read original ↗

ATT&CK techniques detected

7 predictions
T1056.001Keylogging
100%
“be keys that didn ’ t generate any printable output ( e. g. the ctrl key ), i needed a way to capture the raw keypresses generated by the yubikey. for this, i decided to use the linux tool, xinput, and my xinput - keylog - decoder script to decode the output. if you ’ re not fami…”
T1056.001Keylogging
87%
“output by xinput allowed me to get more information in case xinput - keylog - decoder. py failed to decode a keypress in the third terminal window. watch - n 1 tail test - output. 16. tx - bottom terminal : every second, decode the keylog file and display it as human - friendly t…”
T1056.001Keylogging
87%
“codes for “ a ” and “ b ”. you might also notice the apparent blank space between “ a ” and “ b ” in the password field. in the next screenshot, i selected the top terminal and pressed the button on my yubikey. at first glance, it appears that only the “ b ” key was pressed and t…”
T1056.001Keylogging
68%
“field. this resulted in the hexadecimal values 04 through 1d appearing in the scan codes field. i repeated this process for all the other printable keys on my keyboard, as well as the uppercase version of each. i made a note of all the hex values i collected and of the ranges of …”
T1056.001Keylogging
62%
“, it still has access to several other potentially interesting keys, including : - shift ( by using one of the “ shift + no effect ” scan codes ) - function keys ( f1 - f12 ) - menu key ( equivalent of a mouse right - click ) - escape - the shift key in combination with all the i…”
T1056.001Keylogging
53%
“data into the computer just like a regular keyboard, i wanted to find out whether it could be used to press more interesting keys like ctrl, alt, or the windows key in addition to the standard letters, digits, and symbols. to test this, i started up the ypt and selected the stati…”
T1056.001Keylogging
41%
“how to weaponize the yubikey how to weaponize the yubikey a couple of years ago, i had a yubikey that was affected by a security vulnerability, and to fix the issue, yubico sent me a brand new yubikey for free. since i didn ’ t use the old yubikey for authentication after receivi…”

Summary

Michael Allen // A couple of years ago, I had a YubiKey that was affected by a security vulnerability, and to fix the issue, Yubico sent me a brand new […]

The post How to Weaponize the Yubikey appeared first on Black Hills Information Security, Inc..