{"id":11463,"date":"2025-07-21T12:33:21","date_gmt":"2025-07-21T05:33:21","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=11463"},"modified":"2026-06-25T10:00:01","modified_gmt":"2026-06-25T03:00:01","slug":"its-not-the-vulnerability-its-the-feature-that-opened-up-to-the-attacker","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/en\/2025\/07\/21\/its-not-the-vulnerability-its-the-feature-that-opened-up-to-the-attacker\/","title":{"rendered":"It’s not the vulnerability, it’s the feature that opened up to the attacker."},"content":{"rendered":"

A new attack technique has been discovered, allowing the hacker group PoisonSeed to bypass the protection mechanism of the FIDO security key which is considered the “gold standard” in non-password authentication and anti-phishing today. The speciality of this technique lies not in exploiting the vulnerability in the FIDO protocol but in the way the attacker takes advantage of the legitimate feature: the cross-device sign-in mechanism.<\/b><\/p>\n

\n
\"1753079507535.png\"<\/div>\n

\u200b<\/p>\n<\/div>\n

The nature of the attack<\/h3>\n

The cross-device sign-in feature allows users to authenticate a login on one device (e. g., a desktop computer) using another device (such as a phone containing a FIDO key). This is a convenient method, but opens up a security blind spot in the context of users being unable to directly verify the domain that is requesting authentication.<\/p>\n

The attack sequence is as follows:<\/b><\/p>\n

    \n
  1. The attacker sends a phishing email, luring the user to access a fake login gateway (e. g., Okta forgery).<\/li>\n
  2. The user enters a username and password into the fake page.<\/li>\n
  3. The login information is passed implicitly to the real login page.<\/li>\n
  4. The real login page responds by generating a QR code for inter-device authentication.<\/li>\n
  5. This QR code is passed back to the user on a fake interface.<\/li>\n
  6. When a user scans a QR code with a mobile authentication app, they have inadvertently authenticated a login session created by the attacker, resulting in account access being seized.<\/li>\n<\/ol>\n

    In essence, the user is authenticating a session that is not theirs, but still believes the process is legitimate.<\/p>\n

    \n
    \"1753079519842.png\"<\/div>\n<\/div>\n

    Why is this technique so dangerous?<\/h3>\n

    This is a typical example of downgrade authentication, which is downgrading the authentication process to a form that is easily manipulated, even though the technology is modern and safe.<\/p>\n

    Notable points:<\/b><\/p>\n