CSO Online

The Hacker News

The PoisonSeed hacker group has developed a sophisticated method to bypass FIDO hardware security keys using social engineering tactics, specifically targeting cross-device authentication features. This approach allows attackers to complete authentication sessions without having physical access to the FIDO key itself.
The attack begins with phishing emails directing victims to counterfeit login portals that resemble legitimate enterprise sites such as Okta. Once users input their credentials, these fake sites relay the information to the actual portal and capture QR codes intended for cross-device authentication. By persuading users to scan these QR codes, PoisonSeed effectively gains unauthorized access to the users’ accounts. This turns a normally secure feature into a vulnerability, leveraging real-time relay attacks to intrude on protected sessions.
While the fundamental encryption capabilities of FIDO keys remain intact, the PoisonSeed technique highlights how alternative authentication mechanisms, like cross-device sign-in using QR codes, can be manipulated. Security experts suggest disabling these cross-device sign-in features wherever feasible and reinforcing security measures with additional safeguards such as Bluetooth proximity checks to prevent similar breaches.
This incident underscores the importance of vigilance and robust security practices, as even well-regarded security measures can become susceptible through clever exploitation of their operation processes.

Collections

The PoisonSeed hacker group has developed a method to bypass FIDO hardware security keys by exploiting cross-device authentication features. The attack uses phishing emails to direct victims to fake login portals that capture QR codes for cross-device authentication, allowing attackers to gain unauthorized access without physical access to the FIDO key. Security experts recommend disabling cross-device sign-in features and implementing additional safeguards like Bluetooth proximity checks.

PoisonSeed Hackers Exploit Cross-Device Authentication to Bypass FIDO Keys