Google’s Bluetooth Titan 2FA keys have a weird security vulnerability

Google Titan's Bluetooth Security Key Can Be Used to Hack Paired Devices

Microsoft, the subject of more than a few vulnerability disclosures from Chocolate Factory researchers, alerted Google to the issue, which is down to a misconfiguration in the way the keys handle Bluetooth pairing protocols. The matter doesn't affect the device's primary goal - thwarting phishing attempts - but could allow an attacker within physical proximity when it is used to gain access to it or its paired device.

On Wednesday, Google announced on its security blog that it has found a bug in the Bluetooth Low Energy (BLE) version of its Titan Security Key that exposes users to a potential attack when pairing the device via Bluetooth. Just take extra precautions, such as using your security key away from other people and immediately unpairing it after you sign-in to your Google account. Indeed, Google says that these issues don't affect the primary goal of security keys - defending against remote attackers - and that they don't apply to USB or NFC keys.

Google's Titan Security Keys offer a convenient and secure method for securing devices that relies on two-factor authentication and some advanced Google-grown cryptography. The company warned that if you're using the security key's Bluetooth pairing, you should make sure you're in a private place where a potential attacker couldn't be within 30 feet. After that, they could attempt to change their device to appear as a Bluetooth keyboard or mouse and potentially take actions on your device. To determine if your key is affected, check the back of the key. If it's marked T1 or T2, Google will replace it for free.

"Google's offering includes a Bluetooth (BLE) capable key", YubiCo CEO Stina Ehrensvard wrote last July.

Google is offering free replacements of its Titan Security Keys, used for two-factor authentication, after learning the widgets' Bluetooth connections could be compromised by nearby hackers. Normally, the key should work like this: You hold it close to your PC or smartphone and the key will communicate over Bluetooth to unlock access to your online account. To get a replacement, you should head to google.com/replacemykey.

Next Nintendo Direct is about Super Mario Maker 2
Specifically, the company unveiled Nintendo Switch Game Vouchers, which are now available to all Nintendo Switch Online members. That game looks great, with new ways to make courses, and an actual story mode that would make Karl Marx turn in his grave .

United States pulls staff from Iraq, says Iran gave 'blessing' for tanker attacks
One or more vessels incurred light hull damage, but what caused the damage and who was behind it remains unknown. The State Department has ordered all non-emergency U.S. government employees at the U.S.

Philippines recalls ambassador, consuls in Canada over garbage shipments
A total of 103 container vans containing trash were shipped to Subic and Manila in several batches from 2013 to 2014. Last month, Philippine President Rodrigo Duterte said he would "sail to Canada and dump their garbage there".

This makes it hard for hackers to target a user, since they won't be able to login without the physical key. And after logging into a Google Account, key holders are advised to unpair the key, repeating this process until a replacement model has been obtained. Even more risky is the vulnerability to accounts. If they are not already signed into their Google Account on the iOS device and are locked out, they can use the instructions available HERE to get back into their accounts.

"While Yubico previously initiated development of a [Bluetooth] security key and contributed to the [Bluetooth] U2F standards work, we decided not to launch the product as it does not meet our standards for security, usability and durability".

Users of iOS 12.3 "will not be able to use your affected key to sign into your Google Account, or any other account protected by the key, and you will need to order a replacement key".

Article updated with Google comment regarding Feitian-branded keys.

Related:

Comments

Latest news

CBS All Access Debuts First Look at Star Trek: Picard
Via StarTrek.com , the series has been given the simple, yet effective moniker of Star Trek: Picard . Check out the reveal of the official title and logo below.

SanDisk's First 1 TB microSD Card Now Available
It is capable of delivering 4K Ultra HD recording and playback and offers transfer speeds of up to 90MB. So if you play around with a lot of 4K videos, then you'll love the speed.

Amazon Updates Fire 7 Tablets
Tablets have shrunk in popularity in the past few years but that isnt stopping Amazon from developing its affordable Fire lineup. Front- and rear-facing cameras-Video chat with friends and family with the HD 720p front-facing camera.

The Latest Free Game From The Epic Store Is Available Now
Two other titles will also be given out during the sale, though Epic hasn't announced what they will be. I pre-purchased a game before the start of the Epic Mega Sale and that game hasn't launched yet.

To Prevent Dementia, Try Exercise, Not Vitamin Pills
Carrillo agrees that people should be looking to obtain nutrients through eating whole foods rather than using supplements . The condition affects memory, learning capacity, language ability, comprehension, cognition, judgment, and calculation.

Video shows moment helicopter goes down in Hudson River

Conrad Black, former media mogul, pardoned by Donald Trump
Black had not applied for a pardon from Trump and did not wish to discuss the matter, the magazine Maclean's reported . Critics have accused Mr Trump of using his powers of pardon to address what he believes are political wrongs.

Packers quarterback Rodgers shines in Game of Thrones cameo
Despite his best efforts, Rodgers's character succumbs to the Dragon Queen's wrath and meets a violent, fiery end. In season eight's fifth episode, archers line the walls to protect the kingdom against Daenerys.

Sexton reflects on Champions Cup heartbreak with 'big regret'
The size of some of their players. they're a big, big hard team with lots of quality. "They're good at what they do". The 41-year-old said: "We're obviously very gutted".

Russia, US hope for better relations
Security Council resolution that calls for a Syrian-led political transition with a cease-fire, new constitution and elections. A Kremlin spokesperson rejected the notion that Putin's schedule was an intentional "message" for the USA administration.

Huawei P20 Lite 2019 leak reveals quad-camera setup, punch-hole display
The phone's frame will not be made out of metal, it seems, but plastic, which will also help keep its price tag down. The pre-order page went live a couple of months ago so we're assuming a lot of people have the new Huawei phone.

Donald Trump's lonely dream of Viktor Orban-like power
In Orban's case this could mean that Hungary is going to buy USA weapons worth hundreds of millions or even billions of dollars. Many Republicans have an extremely critical view of Hungary's anti-democratic transformation since 2010, under Orban.

Frank Lampard sings Leeds chant about himself after play-off victory
Frank Lampard celebrated his Derby County side reaching the Championship play-off final by singing a song Leeds United fans chanted at him this season.

Rafael Benitez future depends on crunch talks with Newcastle owner Mike Ashley
Newcastle United manager Rafa Benitez declined to confirm his future at St. I'm always really proud and pleased when I hear the fans singing my name.

Deadliest wildfire in California history sparked by PG&E power lines
Paradise Mayor Jody Jones told The Associated Press she was not surprised that PG&E lines had sparked the blaze. The cause of the second fire was vegetation into electrical distribution lines also owned by PG&E.

Other news