Researchers detail a side channel attack, which requires ~$11K worth of equipment and can be used to clone all YubiKeys running firmware prior to version 5.7
Sophisticated attack breaks security assurances of the most popular FIDO key. — The YubiKey 5, the most widely used hardware token …
This is not Yubico’s first key-material issue: the company previously planned to replace certain keys after a flaw reduced cryptographic-key randomness. The new research instead highlights a side-channel path to duplicating affected devices.
First-order effects
Organizations and individuals using YubiKey devices on firmware before 5.7 face a newly documented cloning risk from attackers able to assemble the roughly $11,000 setup, weakening confidence in those tokens as unique authenticators.
Yubico and affected deployments must distinguish vulnerable firmware generations from newer devices when assessing authentication risk and any needed migration or replacement response.
Second-order effects
Security teams that treat hardware keys as a high-assurance control may tighten token inventory, firmware-version tracking, and exception policies; procurement scrutiny will extend to how vendors handle hardware-side-channel disclosures.
Competing FIDO-token suppliers gain a reason to emphasize resistance to hardware extraction and cloning, while customers compare not only protocol support but device lifecycle and remediation practices.
Third-order effects
If such research becomes more reproducible or cheaper, hardware-token security will be judged increasingly on implementation resilience and post-sale updateability, not solely on FIDO protocol compliance.
The episode reinforces a broader limit of physical authentication factors: they can materially raise attack costs without eliminating hardware-level compromise, pushing enterprise security toward layered controls and faster credential replacement paths.
The trend: Authentication is moving from evaluating whether a token supports strong standards to evaluating whether its hardware, firmware lifecycle, and recovery processes sustain those assurances under side-channel attack.
Interesting news about YubiKeys being vulnerable to a cloning attack. — Bad news for people who are targets of more sophisticated schemes where the bad guys are tailing them in real life. — But business as usual for normal people protecting against pedestrian forms of passwor…
Interesting read: YubiKeys are vulnerable to cloning attacks due to a newly discovered side channel. Note though, seems that disassembly is required for the attack, and it seems the attacker also needs your username and password. https://arstechnica.com/...
The only way to prevent this is to maintain physical security of your YubiKeys at all times. YubiKeys are vulnerable to cloning attacks thanks to newly discovered side channel https://arstechnica.com/...
“when an attacker gains brief physical access” protect your neck and your Yubikey “YubiKeys are vulnerable to cloning attacks thanks to newly discovered side channel” https://arstechnica.com/...
‼️ “YubiKeys running firmware prior to v5.7 are vulnerable. Updating firmware on the #YubiKey isn't possible. That leaves all affected YubiKeys permanently vulnerable.” requires physical access and found by researchers, not in “the wild” but still... https://arstechnica.com/... […
YubiKey has a larger security budget than your favorite HWW — hardware security is a never-ending cat and mouse game. Better to put your trust in functionally unsolvable math problems rather than “unhackable” hardware. https://arstechnica.com/...
EUCLEAK is a side-channel vulnerability that requires physical access to a YubiKey 5 Series prior to version 5.7 and (other Infineon based microcontrollers) allowing private key extraction. …