AI
Background: FIDO2 and the CTAP Protocol
FIDO2 uses an authenticator (USB key or smartphone) storing ECDSA key pairs. The client talks to the authenticator via CTAP, an application-layer protocol carried over USB, NFC, or Bluetooth LE. CTAP exposes an API with seven core commands: make credential, get assertion, credential management, client pin, reset, selection, and get info. Each call can require user verification (PIN entry on the client) and user presence (touching the key or NFC proximity). The researchers found that the API design itself has flaws enabling direct client impersonation and man-in-the-middle attacks that are transport-agnostic.
Client Impersonation Attacks
An attacker posing as a legitimate FIDO client sends CTAP commands directly to the authenticator. No client authentication exists in the protocol. The simplest attack sends a reset command. User presence is required but NFC range automatically satisfies it. In a live demo, an Android app factory-reset a Yubico key through a jacket pocket by NFC scanning. All credentials — discoverable and non-discoverable — were destroyed because the master key was deleted. A second attack extracts credential IDs and user identifiers from discoverable credentials when the relying party sets credential protection to off. Apple and Microsoft use that policy. The attacker builds a unique fingerprint and tracks the user on later scans.
API Confusion Man-in-the-Middle
The attacker positions a malicious USB hub or compromised CTAP library between client and authenticator. During the PIN/UV protocol, the MITM forces a user verification token that grants access to all APIs. When the client calls API A (e.g., make credential), the attacker substitutes API B (e.g., reset) on the authenticator. User presence from the legitimate call is reused. The authenticator executes the destructive command, then the attacker returns an “API A okay” message to the client. The researchers tested all 49 API combinations. Seven new MITM attacks result, including silent deletion of discoverable credentials by enumerating and deleting them one by one.
Toolkit and Experimental Results
The open-source CTRAPS toolkit has three modules. A virtual testbed replays raw CTAP packets at the byte level without contacting real relying parties. Four attack clients run over NFC (Android app, Proxmark with 6.5 cm antenna) and USB (Electron app using node-hid). Tests covered six authenticators from Yubico, Feitian, Solo Keys, and Google, plus ten relying parties. All attacks worked on every device except selection-based ones on authenticators lacking that API. The impacts are credential deletion (user cannot log in), user tracking via credential IDs, and denial of service.
Countermeasures and Disclosure
Eight fixes target each vulnerability. Proposals include a trusted client identity mechanism (PKI or attestation), visual LED feedback for API calls, mandatory user interaction for NFC user presence, a separate PIN for destructive APIs, rotating credential and user identifiers, stricter authorization for reset and credential management, and rate limiting for selection. The FIDO Alliance was notified in November 2023 and responded in May 2024. Vendors Yubico, Solo, and Google were contacted. Yubico issued a CVE for a firmware data-leak flaw fixed in newer models but still present in older ones. Apple and Microsoft were also informed about the credential protection off policy.
Notable Quotes
get assertion uh usually requires user verification but if the party set the credential protection policy as off doesn’t require user verification and this is the case for big players like Apple and Microsoft Marco Casagrande · ▶ 21:28
we can track the user because the credential ID is unique Daniele Antonioli · ▶ 23:54
you can connect to the setup client without authentication Marco Casagrande · ▶ 30:30
NFC range gives user presence allowing us to connect without the uh user noticing Marco Casagrande · ▶ 30:46
we have eight counter measures fixing the eight vulnerabilities Marco Casagrande · ▶ 35:35
Key Takeaways
- Eight design vulnerabilities in CTAP 2.2 allow unauthenticated client impersonation.
- Eleven new attacks include factory reset, user tracking, and silent credential deletion.
- The open-source CTRAPS toolkit reproduces all attacks on six popular authenticators.
About the Speaker(s)
Marco Casagrande is a postdoctoral researcher in cybersecurity at the KTH Royal Institute of Technology in Sweden. He specializes in the security of real-world smart devices, including fitness trackers, FIDO authenticators, and electric scooters.
Daniele Antonioli is an Assistant Professor at EURECOM in the software and system security (S3) group. He researches and teaches applied system security and privacy, with an emphasis on wireless communication (Bluetooth, Wi-Fi), embedded systems, mobile systems, and cyber-physical systems.