CC14: YubiWorm - Turning a Trusted YubiKey into a Propagating Worm

uh, vulnerability research, all that kind of stuff. So, I've been working in the cybersecurity space as well. I work at our sock down at the UofA. And I've been working there for about a year and working in cybersecurity generally for about 3. So, a lot of my focus has been more on that

blue team side and a lot of my research has been trying to be more on that red team side and I'm trying to transition that way. So, I want to go over a little bit of what this talk is and what this talk isn't. So, I want to set our expectations up before we begin.

Um, this talk is a proof-of-concept research. Everything I'm going to show you today is built, fully controlled, tested on my own equipment. Everything that is going to be presented is focused on trust boundaries. It is a talk primarily about the implicit trust that we place in hardware devices and what happens when we violate that trust.

It's going to talk about abusing trust maliciously. It's going to be a real propagation strategy that leverages human behavior. Now, also important, this talk isn't going to be about any vendor flaws. I'm not calling out Yubico or YubiKey for any sort of bugs in their firmware. I'm not showing any firmware exploits. I'm not modifying firmware on the

YubiKey. And there's no zero days that are being dropped here. Everything we're doing is documented, legit, and actual uses of the YubiKey. So, first, let's take a moment to talk about the problem. Hardware-based security, smart cards, biometric readers, chips, all of these are so common these days. And that's fair because hardware-based security is something that you have to

have. And we know that you can't really fish a physical device. It's a little bit hard to send an email to a YubiKey and go, "Hey, what's your password?" So, we trust these hardware devices cuz they grant an extra layer of security. And it provides two of those layers of something that you have to know