YubiWorm - Turning a Trusted YubiKey into a Propagating Worm

The talk examines how a hardware security token, specifically a YubiKey, can become an attack vector. Jordan Lanham presents YubiWorm, a controlled proof of concept built only on documented YubiKey behavior rather than a firmware flaw or vendor vulnerability. The starting point is the trust placed in these devices. They enumerate as USB keyboards, operating systems load generic HID drivers without prompts, and security tools rarely inspect keystrokes, so a stored static password slot can type arbitrary commands.

The middle of the talk walks through the lifecycle. A small monitor watches for USB insertion events and filters on Yubico's vendor ID. When a key appears, a helper uses the official YubiKey Manager tooling to overwrite the second slot with a short keystroke stager. That stager fetches the components and sets up user-level persistence through cron or scheduled tasks. The worm then spreads when the user carries the key to another machine and touches it to authenticate, which allows movement across air gaps without network scanning. The speaker also covers practical limits, such as OS-specific tooling, architecture-matched binaries, fragile keystroke timing and keyboard layout differences.

The closing section focuses on defense. Practical steps include auditing token configurations regularly, disabling unused modes, removing static OTP slots that are not needed, restricting HID device classes, enforcing USB port controls and monitoring for unexpected behavior. The talk argues that similar risks apply to other reprogrammable HID devices such as badge readers, and that hardware trust should be verified rather than assumed.