1

I know that BadUSB (revealed by srlabs.de a number of years ago) works by altering the actually firmware of a particular make of USB device, and as such my trusted systems have their own designated USB devices which are never used elsewhere. I was thinking about buying a YubiKey to use across trusted/non-trusted systems for another factor of authentication, but I was unsure about the claim on their website:

https://www.yubico.com/faq/upgrade-yubikey-firmware/

Yubico is dedicated to providing a long-term two-factor authentication solution, we want your YubiKey to remain useful for the full extent of its lifetime. When we do release new firmware, we ensure the new YubiKey will function the same as older versions, so there is no need to purchase new YubiKeys to ensure compatibility.

Will I be safe from BadUSB using a YubiKey across machines with varying levels of trust?

  • 1
    If you quote the complete entry consisting of two paragraphs, there is no space left for interpretation or speculation. – techraf Aug 26 '16 at 4:08
5

Yubico specifically addressed the problem of BadUSB in their blog post from August 2014 confirming separately capabilities of each of their products:

  • FIDO U2F, YubiKey Standard, YubiHSM are not capable of having their firmware upgraded;
  • YubiKey NEO supports firmware upgrade, but requires the new firmware image to be signed by Yubico;
  • neither of the devices contain memory capable of storing malware code;
  • YubiKey 4 released in November 2015 is not mentioned.

Yubico is aware of the problem and claims to have taken precautions against the attack (in case of devices technically capable of having firmware upgraded).

Unless Yubico breaks their promise by either a flaw or a change in the aforementioned policy, there is no way to alter the firmware in YubiKey without a physical intrusion.

The ultimate decision whether to trust Yubico as a provider is on the user.


Regarding the quoted entry from the Yubico FAQ, it's full content is:

No, It is currently not possible to upgrade YubiKey firmware. To prevent attacks on the YubiKey which might compromise its security, the YubiKey does not permit its firmware to be accessed or altered.

Yubico is dedicated to providing a long-term two-factor authentication solution, we want your YubiKey to remain useful for the full extent of its lifetime. When we do release new firmware, we ensure the new YubiKey will function the same as older versions, so there is no need to purchase new YubiKeys to ensure compatibility.

The first paragraph means YubiKey firmware is non-alterable.

The second paragraph means: when Yubico releases a YubiKey with an updated firmware version, they ensure the compatibility of the supporting software with the old devices (which are not upgradeable).

There is no room for interpretation or speculation.

  • Thanks for the in-depth explanation, like you say the trust is really between the end-user and Yubikey's claims. I also really appreciate the blog post, the company seems on top of their game in the most vulnerable area of USB. – Rice Aug 26 '16 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.