4

After following the instructions here, which suggested I use ykpers or the gui version, I discovered the Mt. Gox Yubikey is protected by a "configuration protection access code."

From the manual:

Protection of the key and configuration data

Given the symmetric nature of the AES encryption algorithm, the security of the Yubikey relies that the AES key is logically and physically protected both in the key and in the server that verifies the OTP.

The configuration data is updated via a configuration API, accessible via the USB interface. To prevent unauthorized update, the configuration can be protected by a 48-bit access code. If used, an exhaustive search of all combinations would typically take some 100,000 years to perform. Furthermore, the Yubikey configuration data is write-only, i.e. configuration data and the key can only be written but not be read. This means that unauthorized update of the configuration is an act of sabotage rather than a security threat.

The configuration data is stored in a non-volatile storage integral to the microcontroller. A potential attack is to physically probe the silicon or analyze the hardware behavior to potentially gain full or partial knowledge of the stored secrets. However, such an attack would require a complete break-up of the Yubikey, involving dissolving the microcontroller chip encapsulation. Furthermore, very advanced equipment is needed to probe the chip internals. Given the effort and costs involved for such an attack, this is not considered a threat given that just a single device will be broken.

Yubikey wrote me:

In case, if you have forgotten the configuration protection code or do not find it in the log file, then you can not reconfigure the YubiKey slot again. This functionality is implemented to strengthen the security.

Also, he wrote:

In the context of the manual, an "unauthorized update of the configuration" would be changing the configuration settings on an unprotected YubiKey. Since you already have an access code in place, you cannot preform such an update.

But it should still be possible to "sabotage" a Mt. Gox Yubikey, no? If not, why? If so, how?

thanks

What is also strange is that when I try to create an account at forum.yubico.com or test my Yubikey at demo.yubico.com, they reject my OTP. Yubico Forum's registration says my OTP can't contain non alphanumeric characters, and it sometimes contains periods. [Update: this ended up being because I was using Dvorak keyboard layout for the Yubikey. I've changed it, and now my OTPs work on these sites.]

UPDATE #2: I found this: https://github.com/nezza/yubicrack But there has to be a quicker way than doing a brute-force search of the code. I really wonder why it is so hard to flash a Yubikey? Is it so that others can't render it effectively "lost" or "stolen"?

1

Mt. Gox locks their Yubikeys with an access code. You cannot reprogram them without the code. If you're willing to wait a few months, you can brute force it.

  • And they wouldn't release the access code because it would render the Yubikey useless with Mt. Gox? Why did they opt to make their Yubikeys exclusive for Mt. Gox? – Geremia Jun 25 '13 at 6:28
  • @Geremia: Doing it this way eliminates a number of potential vulnerabilities. – David Schwartz Jun 25 '13 at 13:19
  • Do you know if Mt. Gox would release or has released the access code, now that they're belly-up? If so, we could reprogram the YubiKeys they sent us with a different access code and use them for other purposes. The YubiKey they sent me is just collecting dust… – Geremia Jul 25 '14 at 16:36
0

As answered in a newer, strongly related question: You can now get the leaked keys from https://bitcointalk.org/index.php?topic=631044.0

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.