Yubikey 5 cloning vulnerability. MFA bypass service busted. Crappy securitycam company fined by the FTC.

Don't be afraid that your Yubikeys are now worthless, they are not. The attack requires physical access, your normal credentials, and a bunch of expertise. But it's interesting to read up on. Unfortunately the vulnerable firmware can't be patched, all current Yubikeys 5 series up to versions 5.7 are and will always be vulnerable.

"By using an oscilloscope to measure the electromagnetic radiation while the token is authenticating itself, the researchers can detect tiny execution time differences that reveal a token’s ephemeral ECDSA key, also known as a nonce. Further analysis allows the researchers to extract the secret ECDSA key that underpins the entire security of the token."

Damn fine research. You can find the paper with the research by Ninjalabs here, and a Hackernews disscussion here.

"The FTC plans to fine the security camera company Verkada $2.95 million over the firm’s poor security practices that led to a hacker breaking into customers’ devices as well as accessing personal data. The company is also accused of spamming potential clients, sending more than 30 million email ads over 3 years." Always good to see a crappy company held liable for being crap.

Apparently there is such a thing as a "bypass 2fa as a service" company, which I never knew until now. They promised to help deliver OTPs for over 30 online services, including Apple Pay, for weekly subscriptions that ranged between £30 and £380.

Nice thread on Hackernews with varying opinions on how to handle passwords in a company setting.

If you're an engineer, it's really worth checking out 1Password's developer tools. It can manage secrets for your infrastructure and CI/CD pipeline, manage SSH keys, and inject tokens into CLI scripts. Play around with it and see how it can fit in your development flow. (Sponsored)