CTRAPS: CTAP Impersonation, API Confusion Attacks on FIDO2
Presents CTRAPS, a novel class of API confusion and impersonation attacks targeting the Client to Authenticator Protocol (CTAP) in FIDO2 hardware keys.
Summary
FIDO2 and CTAP Protocol Foundations
FIDO2 and WebAuthn rely on the Client to Authenticator Protocol (CTAP2) to facilitate secure, phishing-resistant public-key authentication between host platforms and hardware security keys over USB, NFC, and BLE.
CTRAPS: API Confusion and State Impersonation
M Casagrande and D Antonioli uncover structural flaws in CTAP protocol state machines and host operating system authenticator abstractions, introducing CTRAPS (Client-To-authenticator-Replay-And-Phishing-Suite).
Bypassing Origin Binding and Attestation
By manipulating API message sequences and exploiting cross-transport confusion between USB and virtual authenticators, adversaries can bypass origin-binding checks and trick users into authorizing unintended credentials.
Securing FIDO2 Implementations
Remediating CTRAPS requires browser vendors and the FIDO Alliance to enforce strict state machine validations, isolate virtual authenticator APIs, and update CTAP specifications.
Related talks
Main Stage·34 min
S Pratap Singh · J Lin · D Seetoh
Demonstrates architectural and implementation weaknesses in commercial passkey syncing and WebAuthn relying party implementations.
IEEE Symposium on Security and Privacy·17 min
Industry experts analyze emerging threats surrounding A Comparative Usability Study of FIDO2 Passwordless Authentication.
OWASP Foundation·44 min
Suby Raman
Suby Raman investigates WebAuthn: Strong Authentication vs Privacy vs Convenience.