Revised Summary

CITRUPS: Client Impersonation and API Confusion Attacks on FIDO2

Researchers Marco and Daniel have identified eight critical design vulnerabilities in the FIDO2 setup protocol, enabling severe attacks that compromise authentication systems across major services including Apple, Microsoft, and Google.

Key Findings

• Protocol Vulnerabilities: The researchers discovered eight critical design flaws in the CTAP (Client to Authenticator Protocol) portion of FIDO2, including lack of authentication, no feedback on API calls, and insufficient user presence checks.

• Attack Categories: They demonstrated 11 distinct attacks:

  • 4 client impersonation attacks: Where an attacker poses as a legitimate client to perform unauthorized actions
  • 7 API confusion man-in-the-middle attacks: Where attackers manipulate API calls to execute unauthorized operations

Real-World Impact

• Authentication Compromise: Attackers can factory reset authenticators, delete user credentials, track users via unique identifiers, and deny service to legitimate users.
• Widespread Vulnerability: The attacks successfully compromised 6 popular authenticators (including Ubico, Google) and 10 major relying parties (Apple, Microsoft, Nvidia, etc.).
• Serious Consequences: Affected users risk complete loss of credentials, unauthorized tracking, and inability to access critical services.

Research Tools and Methods

The team developed and released an open-source toolkit featuring:

• Virtual testbeds for safe vulnerability testing
• Attack clients for Android and Electron platforms
• Tools that work across multiple transport layers (USB, NFC, Bluetooth)

Disclosure and Response

The findings were responsibly disclosed to the FIDO Alliance in November 2023 and to affected vendors including Ubico and Google. While some newer models have received fixes and CVEs, many older authenticators remain vulnerable.

The research underscores the urgent need