Google is warning users of its Titan Bluetooth security keys about a weakness in the way the keys handle pairing with devices, a bug that an attacker could use to impersonate the key or the victim’s device in some highly specific circumstances.
The vulnerability only affects the Bluetooth Low Energy (BLE) Titan keys, and not the USB keys. The Titan keys are small hardware devices, comparable to a YubiKey or Solo, that are used for two-factor authentication for Google accounts. They’re part of the Advanced Protection Program that Google established a few years ago for people who are at a higher risk of being targeted by attackers and want an extra layer of security. The program provides two security keys: usually one BLE key and one USB-C key. The BLE key is meant for authenticating on mobile devices, and Google recently discovered an issue with the way those keys communicate with users’ devices.
“Due to a misconfiguration in the Titan Security Keys’ Bluetooth pairing protocols, it is possible for an attacker who is physically close to you at the moment you use your security key -- within approximately 30 feet -- to (a) communicate with your security key, or (b) communicate with the device to which your key is paired,” Christiaan Brand, a product manager for Google Cloud, said.
In order to exploit the weakness, an attacker would need to be within about 30 feet of a victim and would need to time his attack to coincide with the moment when the victim is pressing the button on her Titan key as part of the authentication flow. And even in that case, the attacker would also need to have the victim’s credentials already.
“An attacker in close physical proximity at that moment in time can potentially connect their own device to your affected security key before your own device connects. In this set of circumstances, the attacker could sign into your account using their own device if the attacker somehow already obtained your username and password and could time these events exactly,” Brand said.
In another scenario, an attacker could use his own device to impersonate the Titan key and possibly take some malicious actions on the victim’s device.
“Once paired, an attacker in close physical proximity to you could use their device to masquerade as your affected security key and connect to your device at the moment you are asked to press the button on your key. After that, they could attempt to change their device to appear as a Bluetooth keyboard or mouse and potentially take actions on your device,” Brand said.
The vulnerability affects the T1 and T2 versions of the Titan keys, and Google is contacting people who have purchased those keys and providing instructions on how to get a free replacement. In the meantime, Google is recommending that people with affected keys continue to use them, given that the attack scenarios are limited and the keys still offer much better protection than a username and password alone.
“This security issue does not affect the primary purpose of security keys, which is to protect you against phishing by a remote attacker. Security keys remain the strongest available protection against phishing; it is still safer to use a key that has this issue, rather than turning off security key-based two-step verification (2SV) on your Google Account or downgrading to less phishing-resistant methods (e.g. SMS codes or prompts sent to your device),” Brand said.
The weakness doesn’t affect NFC keys.