<story><title>How to weaponize the Yubikey (2019)</title><url>https://www.blackhillsinfosec.com/how-to-weaponize-the-yubikey/</url></story><parent_chain></parent_chain><comment><author>neilv</author><text>&amp;gt; &lt;i&gt;A couple of years ago, I had a YubiKey that was affected by a security vulnerability, and to fix the issue, Yubico sent me a brand new YubiKey for free.&lt;/i&gt;&lt;p&gt;Opening with that, this could&amp;#x27;ve been a story about sending trojan YubiKeys to high-value targets.&lt;p&gt;(For example, trojan might do stealthy exfiltration of stored data via cellular, have cloned hardware IDs&amp;#x2F;secrets to aid other attack, be a sleeper that doesn&amp;#x27;t hack and risk detection until heuristics on stored data suggest high-value opportunity, etc.  Things for which there&amp;#x27;s an advantage to it being in a YubiKey rather than USB Storage.)&lt;p&gt;&amp;quot;Hi, this is totally Yubico writing to you.  Your YubiKey was affected by a security vulnerability.  Please use the enclosed free replacement, which has corrected the problem.  For all your most sensitive security needs.&amp;quot;</text></comment>
<story><title>How to weaponize the Yubikey (2019)</title><url>https://www.blackhillsinfosec.com/how-to-weaponize-the-yubikey/</url></story><parent_chain></parent_chain><comment><author>NoraCodes</author><text>This is a neat concept - especially because, unlike a USB Rubber Ducky that &lt;i&gt;looks&lt;/i&gt; like a Yubikey, you can actually demonstrate that your Yubikey-as-weapon &lt;i&gt;is&lt;/i&gt; a Yubikey. Very devious!</text></comment>