Breaching Security Keys without Root: FIDO2 Deception Attacks via Overlays Exploiting Limited Display Authenticators

عن هذا البحث

الملخص

This paper analyzes FIDO2 hardware security keys and introduces FIDOLA, a deception attack that exploits limited-display authenticators and user-space overlays without requiring root privileges. The attack can inject a hidden authentication session for either the same service or a different, potentially more sensitive service, while presenting the user with altered on-screen information that makes the attacker's request appear legitimate. The work analyzes WebAuthn, CTAP2, and operating-system protections, implements a proof-of-concept attack, and evaluates it in a user study. Participants approved roughly 95.55% of cross-service attack attempts involving overlays, revealing a practical weakness in real-world FIDO2 interaction workflows.