After following the instructions here, which suggested I use ykpers or the gui version, I discovered the Mt. Gox Yubikey is protected by a "configuration protection access code."
From the manual:
Protection of the key and configuration data
Given the symmetric nature of the AES encryption algorithm, the security of the Yubikey relies that the AES key is logically and physically protected both in the key and in the server that verifies the OTP.
The configuration data is updated via a configuration API, accessible via the USB interface. To prevent unauthorized update, the configuration can be protected by a 48-bit access code. If used, an exhaustive search of all combinations would typically take some 100,000 years to perform. Furthermore, the Yubikey configuration data is write-only, i.e. configuration data and the key can only be written but not be read. This means that unauthorized update of the configuration is an act of sabotage rather than a security threat.
The configuration data is stored in a non-volatile storage integral to the microcontroller. A potential attack is to physically probe the silicon or analyze the hardware behavior to potentially gain full or partial knowledge of the stored secrets. However, such an attack would require a complete break-up of the Yubikey, involving dissolving the microcontroller chip encapsulation. Furthermore, very advanced equipment is needed to probe the chip internals. Given the effort and costs involved for such an attack, this is not considered a threat given that just a single device will be broken.
Yubikey wrote me:
In case, if you have forgotten the configuration protection code or do not find it in the log file, then you can not reconfigure the YubiKey slot again. This functionality is implemented to strengthen the security.
Also, he wrote:
In the context of the manual, an "unauthorized update of the configuration" would be changing the configuration settings on an unprotected YubiKey. Since you already have an access code in place, you cannot preform such an update.
But it should still be possible to "sabotage" a Mt. Gox Yubikey, no? If not, why? If so, how?
thanks
What is also strange is that when I try to create an account at forum.yubico.com or test my Yubikey at demo.yubico.com, they reject my OTP. Yubico Forum's registration says my OTP can't contain non alphanumeric characters, and it sometimes contains periods. [Update: this ended up being because I was using Dvorak keyboard layout for the Yubikey. I've changed it, and now my OTPs work on these sites.]
UPDATE #2: I found this: https://github.com/nezza/yubicrack But there has to be a quicker way than doing a brute-force search of the code. I really wonder why it is so hard to flash a Yubikey? Is it so that others can't render it effectively "lost" or "stolen"?
