The Yubikey CLI and AWS MFA. Contemplating the assault floor and MFA… | by Teri Radichel | Cloud Safety | Jul, 2022

July 29, 2022

1

Contemplating the assault floor and MFA selections

As I used to be writing what I assumed can be my subsequent put up on creating an AWS KMS Key to guard a secret in secrets and techniques supervisor a couple of different issues popped up that required investigation and clarification. I already wrote about KMS key structure issues:

Earlier than I can create a KMS Key I must create the identities which can be allowed to make use of the important thing, so I can grant them entry in my KMS Key coverage. I used to be going to create an AWS Consumer, however I used to be attempting to recollect why AWS SSO didn’t work for me the final time I attempted this.

That’s once I found an AWS announcement from someday prior on AWS IAM Identification Heart — the successor to AWS SSO. I questioned it one thing new would alter my deliberate structure and consumer selection for execution of batch jobs. It didn’t. I wrote about that in my final put up.

I’m going to be utilizing a standard IAM consumer for the explanations defined in that final weblog put up that rule out AWS SSO customers in AWS Identification Heart. I’m not utilizing a job alone since you affiliate MFA with a job, solely with a Consumer. We’ll must have a consumer provoke the method and require MFA to imagine the function utilized by the batch job. Alternatively I may use GetSessionToken. I’ll discover these choices in a later put up.

Acquiring an MFA Token

To make use of MFA programmatically we should receive a token to go into our course of to start out our jobs. Earlier than I create a consumer and configure MFA, I wished to elucidate why I’m not utilizing a Yubikey for this goal.

First, I seen that this web page on utilizing states the next relating to using U2F safety keys for API entry:

You can not use MFA-protected API entry with U2F safety keys.

Nevertheless, evidently with the most recent variations of Yubikeys, you possibly can programmatically receive a token from a Yubikey as defined right here:

I like Yubikeys. I advisable that the very first thing each startup ought to do is get Yubikeys for the enterprise house owners and their employees:

I additionally advocate them as a phishing-resistant choice for logging into the AWS Console. Nevertheless, I don’t need use the tactic defined within the above weblog put up for the next causes:

I’ve to put in the Yubico CLI on my native laptop computer to try this.
I haven’t but absolutely examined the Yubico CLI to completely perceive its capabilities and the rise in assault floor.
I’m conscious that somebody with entry to the CLI can change my Yubikey passcodes and configuration and wish to discover that additional.

By putting in the Yubico CLI on my laptop computer, an attacker who by some means obtains entry to my laptop computer can use the instructions in that CLI to do no matter that CLI can do. Hopefully the attacker by no means will get entry to my laptop computer however I’d identical to to rule out the any attainable assault paths till I examine it additional.

Assault Floor on a Telephone With Digital MFA

What concerning the assault floor of my cellphone and the power to make use of that to acquire MFA codes? I take advantage of a separate cellphone for my authenticator app on which I don’t use to surf the online or set up untrusted purposes. Hopefully, since I don’t click on or go to hyperlinks on that cellphone my assault floor is decreased.

The one factor an attacker may do can be to attempt to trick me into getting into an MFA token right into a malicious software or web site, however that very same risk exists when utilizing a Yubikey generated token. They might additionally attempt to steal my cellphone or trick somebody into giving up my SIM card. I might discover that fairly shortly and use my entry offered by an admin account and Yubikey to alter settings as wanted. The permissions granted to the consumer with permissions to imagine a job utilized by a batch job shall be restricted to what the batch jobs require.

Potential assault situation with the Yubico CLI in your laptop computer

Let’s say I’ve this software program put in on my laptop computer and by some means an attacker will get entry to run instructions on my laptop computer. One way or the other the malware figures out once I go to a webpage that requires MFA and I’m about to click on a button to permit entry through my Yubikey. One way or the other that malware generates a programmatic request for a code simply earlier than I attempt to use my Yubikey for that web page and intercepts the code. I’m sitting right here considering my key simply didn’t work. I hit the button once more and my request on the web site goes by way of. I by no means knew that the attacker simply obtained considered one of my MFA codes kind my Yubikey.

Is that probably? Perhaps not. However is it attainable? Sure. Might a nation state attacker do one thing that artful with sufficient money and time? What do you suppose? (The reply is sure.)

An excellent easier choice can be to get me to click on on some hyperlink that by some means executes the command on my laptop computer through some type of malware.

I may most likely consider extra eventualities however I’m already offered on conserving it easy and conserving that assault vector off my laptop computer till I absolutely perceive the implications. If I do use it, I’d most likely set up it on a separate administrative gadget, or I’d use totally different Yubikeys for various functions. I already do each these issues.

Diminished Assault Floor

Alternatively, let’s say that Yubico CLI doesn’t exist on my laptop computer and I hardly ever set up something on my laptop computer. I run every part I presumably can within the cloud. Hopefully I might discover if somebody did attempt to set up one thing as a result of I monitor all community connections so there’s no software program on my laptop computer that may facilitate a programmatic token request. On this latter situation, the attacker’s command line makes an attempt to get a token from my Yubikey can be in useless.

After all, I can consider methods attackers may nonetheless attempt to get to a token and so they may attempt to set up malware that has these capabilities, however not less than I’ve made it a bit more durable.

About blindly trusting vendor software program…

I did check out the Yubico software program as soon as to regulate some settings and retailer PGP keys and it ended up locking me out of my very own encrypted paperwork. I will need to have executed one thing fallacious as a result of what occurred to me there so I must check it out a bit extra earlier than I depend on that performance. Ensure you have a backup of your PGP key in a secure place like on a USB drive in a secure if you will strive that out.

I additionally discovered a safety difficulty on some Yubikey software program deployed with Chocolatey on Home windows. If I recall accurately it put in an outdated library that had a recognized CVE, however I can’t keep in mind precisely.

Whatever the vendor, I’m not going to blindly belief any software program till I’ve an opportunity to evaluate it and take a look at it. If I’m unsure a few piece of software program I usually run it in a locked down atmosphere or and on a separate gadget the place it received’t have an effect on important parts of my safety and I can monitor it.

I typically keep away from putting in something on my laptop computer and run every part in a cloud VM to cut back the assault floor on my native machine. I can’t do this with the Yubico CLI since I’ve to push the button on a tool related to a neighborhood pc. I don’t even wish to expose that performance within the cloud if I may push a button on my laptop computer and have it ship the token to the cloud. For now I’ll follow a digital MFA gadget to provoke batch jobs.

Teri Radichel

Should you appreciated this story please clap and observe:

Medium: Teri Radichel or Electronic mail Record: Teri Radichel
Twitter: @teriradichel or @2ndSightLab
Requests providers through LinkedIn: Teri Radichel or IANS Analysis