0

Let's say I sign into my local pc with a hardware key (eg yubicon). Let's say I further sign into a sensitive server (as root) via ssh using yubicon hardware key as well (ie only way to get into server is though ssh when yubicon key connected).

Now let's say I click on a phishing email that gains admin access to my machine.

  1. when I am 'away' can the threat actor access the server (assuming I logged out)?
  2. when I am 'sitting there using it' can the attacker move into the server and plant access directly to the server so that they no longer are impeded at all by the key.

Thanks.

Improve this question
2
  • Depends, do you require physical touch of the Yubikey to SSH? If so, is it not required for a period of time after using it?
    – multithr3at3d
    Nov 19, 2020 at 22:49
  • @multithr3at3d well I assume that relates to question 1. I assume if the key just has to be plugged in, it will work allow attacker access. But let's say 'yes', or 'you only plug it in at instant of authentication then unplug'. The point is the question "if attacker has root access to your machine, 1. do the keys work as many times as needed while they are plugged in (so attacker could open own secret session). and 2. if not, can attacker secretly piggyback on my one ssh connection.
    – AwokeKnowing
    Nov 20, 2020 at 16:32

1 Answer 1

Reset to default
1

When I am 'away' can the threat actor access the server (assuming I logged out)?

This will largely depend on the setup of your hardware key, assuming it is left inserted. If your key is set to require physical touch every time it is used for authentication, this likely cannot be bypassed, even if your system is compromised. If the device requires a PIN, the attacker likely needs to steal that first. In the case of both features, the device may not require them again for a period of time, at which point you'd likely be exposed.

when I am 'sitting there using it' can the attacker move into the server and plant access directly to the server so that they no longer are impeded at all by the key.

If the attacker has root, they can typically manipulate all files and processes on the system. It is not infeasible that they could backdoor the ssh binary to run extra commands, or attach to it at runtime to inject extra stuff.

It would seem the hardware key is most effective when it is unplugged or requires additional, unforgable physical interaction in order to activate each time a sensitive operation is performed. However, as alluded to above, while a hardware key is a powerful tool as part of a defense in depth strategy, it does not remove the need to focus on securing the rest of the system.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .