Passkey与无密码认证安全取证深度分析

┌──────────┐         ┌──────────────┐         ┌──────────────┐         ┌──────────────┐
│  Browser  │         │   RP Server  │         │ Client/Auth  │         │ Authenticator│
│  (WebAuthn)│         │  (WebAuthn)  │         │   (CTAP2)    │         │  (HW/SW)     │
└─────┬────┘         └──────┬───────┘         └──────┬───────┘         └──────┬───────┘
      │                      │                        │                        │
      │  navigator.credentials.create(options)         │                        │
      │─────────────────────>│                        │                        │
      │                      │                        │                        │
      │  Challenge + RP ID   │                        │                        │
      │  + User Info         │                        │                        │
      │<─────────────────────│                        │                        │
      │                      │                        │                        │
      │  CTAP2 MakeCredential│                        │                        │
      │  (CBOR)              │                        │                        │
      │──────────────────────────────────────────────>│                        │
      │                      │                        │  User Verification     │
      │                      │                        │  (生物识别/PIN)        │
      │                      │                        │───────────────────────>│
      │                      │                        │                        │
      │                      │                        │  密钥对生成             │
      │                      │                        │  (私钥存储于Auth)      │
      │                      │                        │<───────────────────────│
      │                      │                        │                        │
      │                      │  Attestation Object   │                        │
      │                      │  (authData + attStmt) │                        │
      │                      │<──────────────────────│                        │
      │  Attestation Object  │                        │                        │
      │<─────────────────────│                        │                        │
      │                      │                        │                        │
      │                      │  验证 Attestation      │                        │
      │                      │  存储 Credential ID   │                        │
      │                      │  + Public Key          │                        │
      │  注册成功             │                        │                        │
      │─────────────────────>│                        │                        │

┌──────────┐         ┌──────────────┐         ┌──────────────┐         ┌──────────────┐
│  Browser  │         │   RP Server  │         │ Client/Auth  │         │ Authenticator│
│  (WebAuthn)│         │  (WebAuthn)  │         │   (CTAP2)    │         │  (HW/SW)     │
└─────┬────┘         └──────┬───────┘         └──────┬───────┘         └──────┬───────┘
      │                      │                        │                        │
      │ navigator.credentials.get(options)            │                        │
      │─────────────────────>│                        │                        │
      │                      │                        │                        │
      │  Challenge           │                        │                        │
      │  + allowedCredentials│                        │                        │
      │<─────────────────────│                        │                        │
      │                      │                        │                        │
      │  CTAP2 GetAssertion  │                        │                        │
      │  (CBOR)              │                        │                        │
      │──────────────────────────────────────────────>│                        │
      │                      │                        │  User Verification     │
      │                      │                        │───────────────────────>│
      │                      │                        │                        │
      │                      │                        │  签名 Challenge        │
      │                      │                        │  (使用私钥)            │
      │                      │                        │<───────────────────────│
      │                      │                        │                        │
      │                      │  Assertion             │                        │
      │                      │  (authData + sign)     │                        │
      │                      │<──────────────────────│                        │
      │  Assertion           │                        │                        │
      │<─────────────────────│                        │                        │
      │                      │                        │                        │
      │                      │  验证签名              │                        │
      │                      │  比对 Sign Counter     │                        │
      │  认证成功             │                        │                        │
      │─────────────────────>│                        │                        │

const publicKeyCredentialCreationOptions = {
    challenge: Uint8Array.from(allowedCredentials, c => c),
    rp: {
        name: "Example Relying Party",
        id: "example.com"
    },
    user: {
        id: Uint8Array.from("user-id-bytes", c => c),
        name: "user@example.com",
        displayName: "Example User"
    },
    pubKeyCredParams: [
        { alg: -7, type: "public-key" },
        { alg: -257, type: "public-key" }
    ],
    authenticatorSelection: {
        authenticatorAttachment: "platform",
        userVerification: "required",
        residentKey: "required"
    },
    timeout: 60000,
    attestation: "direct"
};

const publicKeyCredentialRequestOptions = {
    challenge: Uint8Array.from(allowedCredentials, c => c),
    timeout: 60000,
    rpId: "example.com",
    allowCredentials: [
        {
            id: Uint8Array.from("credential-id", c => c),
            type: "public-key",
            transports: ["internal", "ble", "nfc", "usb"]
        }
    ],
    userVerification: "required"
};

fido2-token -L
fido2-token -I /dev/hidraw0
fido2-cred -t create -i /dev/hidraw0 -g -o cred.blob

import struct

def parse_ctap2_usb_hid_frame(raw_data):
    if len(raw_data) < 7:
        return None
    channel_id = struct.unpack(">I", raw_data[0:4])[0]
    cmd_byte = raw_data[4]
    cmd_type = (cmd_byte >> 4) & 0x0F
    init_packet = (cmd_byte & 0x01) == 0
    payload_len = struct.unpack(">H", raw_data[5:7])[0] if init_packet else 0
    payload = raw_data[7:64] if init_packet else raw_data[5:64]
    return {
        "channel_id": f"0x{channel_id:08X}",
        "cmd_type": cmd_type,
        "is_init_packet": init_packet,
        "payload_len": payload_len,
        "payload_hex": payload.hex()
    }

sudo btmon -w ctap2_ble_capture.log
sudo hcidump -w ctap2_hci_capture.log

import cbor2
import json

def decode_ctap2_cbor_response(raw_bytes):
    try:
        decoded = cbor2.loads(raw_bytes)
        status_code = decoded.get(1, "unknown")
        response_data = {}
        if 2 in decoded:
            rp_id_hash = decoded[2].hex()
            response_data["rp_id_hash"] = rp_id_hash
        if 3 in decoded:
            flags = decoded[3]
            response_data["flags"] = {
                "UP": bool(flags & 0x01),
                "UV": bool(flags & 0x04),
                "AT": bool(flags & 0x40),
                "ED": bool(flags & 0x80)
            }
        if 4 in decoded:
            response_data["sign_count"] = decoded[4]
        if 5 in decoded:
            response_data["credential_id"] = decoded[5].hex()
        if 6 in decoded:
            response_data["public_key"] = decoded[6]
        return {"status": status_code, "data": response_data}
    except Exception as e:
        return {"error": str(e)}

log stream --predicate 'subsystem == "com.apple.Accessibility"' --info
log stream --predicate 'process == "securityd"' --info
log stream --predicate 'eventMessage CONTAINS "passkey" OR eventMessage CONTAINS "WebAuthn"' --info
log show --predicate 'subsystem == "com.apple.cryptex"' --last 1h

Get-Tpm | Select-Object TpmPresent, TpmReady, ManufacturerId
Get-CimInstance -Namespace root\cimv2\Security\MicrosoftTpm -ClassName Win32_Tpm | Select-Object *

Get-WinEvent -LogName "Microsoft-Windows-Hello-FIDO/Operational" -MaxEvents 100 |
    Format-Table TimeCreated, Id, Message -Wrap

Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-Hello-FIDO/Operational'
    Id = 300, 301, 302, 400, 401, 402
} -MaxEvents 200

adb logcat -s Fido2Manager:V WebAuthnManager:V BiometricPrompt:V
adb logcat -b events | grep -E "passkey|fido|webauthn"
adb shell dumpsys credential_manager
adb shell settings get secure enabled_accessibility_services

┌──────────┐    BLE    ┌──────────────┐    HTTPS    ┌──────────────┐    BLE    ┌──────────┐
│  Victim   │<-------->|  BLE Relay   |<--Cloud---->|  C2 Server   |<-------->| Attacker  │
│  Device   │  近距离   │  (Nearby)    │   中继链    │  (Remote)    │  远程    │  Device   │
│  (Passkey)│  ~5m     │  Raspberry   │             │  VPS/SaaS    │         │  (Clone)  │
└──────────┘          │  Pi + BLE    │             │              │         └──────────┘
                      │  Adapter     │             │              │
                      └──────────────┘             └──────────────┘

攻击流程:
1. BLE嗅探器检测到附近Passkey设备的BLE广播
2. 攻击者触发RP发起WebAuthn认证请求
3. BLE中继设备拦截CTAP2 GetAssertion请求
4. 通过Cloud中继将请求转发到攻击者设备
5. 攻击者设备在无受害者交互的情况下响应
6. 响应通过中继链返回RP服务器

log stream --predicate 'subsystem == "com.apple.bluetooth" AND eventMessage CONTAINS "CTAP2"' --info

┌──────────────┐
│ iCloud Keychain│
│  Sync Server  │
└──────┬───────┘
       │ E2EE Sync
       ├──────────────┬──────────────┬──────────────┐
       │              │              │              │
  ┌────┴────┐   ┌────┴────┐   ┌────┴────┐   ┌────┴────┐
  │ iPhone   │   │ MacBook  │   │ iPad     │   │ Mac     │
  │ (Primary)│   │ (Synced) │   │ (Synced) │   │ (Synced) │
  │ SE       │   │ SE       │   │ SE       │   │ SE       │
  └─────────┘   └─────────┘   └─────────┘   └─────────┘

security find-generic-password -s "passkey" -a "user@example.com" -l "WebAuthn Credential" -g 2>&1 | head -30
security dump-keychain -d login.keychain-db 2>&1 | grep -i "passkey\|fido\|webauthn"

Get-WinEvent -LogName "Microsoft-Windows-Hello-FIDO/Operational" -MaxEvents 50 |
    Where-Object { $_.Id -in @(300, 301, 400, 401) } |
    Format-List TimeCreated, Id, Message

log show --predicate 'process == "cloudd" AND eventMessage CONTAINS "keychain"' --last 24h | \
    grep -E "device|sync|add|remove" | \
    sort -k1,2

import json
import sys
from datetime import datetime, timedelta
from collections import defaultdict

def analyze_rp_auth_logs(log_file):
    events = []
    with open(log_file) as f:
        for line in f:
            try:
                events.append(json.loads(line.strip()))
            except json.JSONDecodeError:
                continue

    user_events = defaultdict(list)
    for event in events:
        uid = event.get("user_id", "unknown")
        user_events[uid].append(event)

    anomalies = []
    for uid, evts in user_events.items():
        sorted_evts = sorted(evts, key=lambda x: x.get("timestamp", ""))

        for i in range(1, len(sorted_evts)):
            prev = sorted_evts[i - 1]
            curr = sorted_evts[i]
            try:
                t_prev = datetime.fromisoformat(prev["timestamp"].replace("Z", "+00:00"))
                t_curr = datetime.fromisoformat(curr["timestamp"].replace("Z", "+00:00"))
                delta = (t_curr - t_prev).total_seconds()

                if delta < 1.0 and prev.get("credential_id") != curr.get("credential_id"):
                    anomalies.append({
                        "user_id": uid,
                        "type": "RAPID_CREDENTIAL_SWITCH",
                        "detail": f"Credential switch in {delta:.2f}s",
                        "severity": "HIGH",
                        "mitre": "T1557",
                        "events": [prev.get("timestamp"), curr.get("timestamp")]
                    })

                if prev.get("origin", "") != curr.get("origin", ""):
                    anomalies.append({
                        "user_id": uid,
                        "type": "ORIGIN_CHANGE",
                        "detail": f"Origin changed: {prev.get('origin')} -> {curr.get('origin')}",
                        "severity": "HIGH",
                        "mitre": "T1566",
                        "events": [prev.get("timestamp"), curr.get("timestamp")]
                    })

                if curr.get("sign_count", 0) < prev.get("sign_count", 0):
                    anomalies.append({
                        "user_id": uid,
                        "type": "SIGN_COUNT_DECREASE",
                        "detail": f"Count decreased: {prev.get('sign_count')} -> {curr.get('sign_count')}",
                        "severity": "CRITICAL",
                        "mitre": "T1557",
                        "events": [prev.get("timestamp"), curr.get("timestamp")]
                    })

            except (ValueError, KeyError):
                continue

    return anomalies

if __name__ == "__main__":
    target = sys.argv[1] if len(sys.argv) > 1 else "auth_logs.jsonl"
    results = analyze_rp_auth_logs(target)
    print(json.dumps(results, indent=2, ensure_ascii=False))

$logNames = @(
    "Microsoft-Windows-Hello-FIDO/Operational",
    "Microsoft-Windows-WebAuthN/Operational",
    "Security"
)

foreach ($logName in $logNames) {
    try {
        $events = Get-WinEvent -LogName $logName -MaxEvents 500 -ErrorAction SilentlyContinue |
            Where-Object { $_.TimeCreated -gt (Get-Date).AddDays(-7) }
        $events | ForEach-Object {
            [PSCustomObject]@{
                LogName = $logName
                TimeCreated = $_.TimeCreated
                EventId = $_.Id
                LevelDisplayName = $_.LevelDisplayName
                Message = $_.Message.Substring(0, [Math]::Min(200, $_.Message.Length))
            }
        } | Export-Csv -Path "passkey_audit_$logName.csv" -NoTypeInformation
    } catch {
        Write-Warning "Failed to read log: $logName"
    }
}

log show --predicate 'subsystem == "com.apple.passkeyd"' --last 24h --style json
log stream --predicate 'process == "credd" AND eventMessage CONTAINS "keychain sync"' --info
security find-generic-password -s "passkey" -l "WebAuthn" 2>&1

adb logcat -b all | grep -iE "fido|passkey|webauthn|biometric"
adb shell dumpsys credential_manager
adb shell content query --uri content://com.google.android.apps.authkeeper.data.provider --projection event

title: Suspicious Passkey Registration Activity
id: a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects suspicious Passkey registration events outside normal patterns
references:
  - https://attack.mitre.org/techniques/T1199/
author: x7peeps
date: 2026/07/22
tags:
  - attack.credential_access
  - attack.t1199
logsource:
  category: authentication
  product: multi
detection:
  selection_webauthn_create:
    EventId|contains:
      - '300'
      - '301'
  selection_off_hours:
    TimeCreated|re: '.*T(0[0-4]|2[2-3]):[0-5][0-9].*'
  selection_failed_then_success:
    EventId|contains: '302'
  condition: selection_webauthn_create and selection_off_hours
level: high

title: Passkey Sign Count Anomaly Detection
id: b2c3d4e5-f6a7-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects anomalies in FIDO2 signature counter values indicating potential key cloning
references:
  - https://attack.mitre.org/techniques/T1557/
author: x7peeps
date: 2026/07/22
tags:
  - attack.credential_access
  - attack.t1557
logsource:
  category: authentication
  product: multi
detection:
  selection_assertion:
    EventId|contains:
      - '400'
      - '401'
  selection_sign_count_drop:
    SignCount|lt: previous_sign_count
  condition: selection_assertion and selection_sign_count_drop
level: critical

#!/bin/bash
OUTPUT_DIR="passkey_forensics_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTPUT_DIR"

collect_windows_events() {
    local log_names=(
        "Microsoft-Windows-Hello-FIDO/Operational"
        "Microsoft-Windows-WebAuthN/Operational"
        "Microsoft-Windows-WinINet/Operational"
    )
    for log_name in "${log_names[@]}"; do
        local safe_name=$(echo "$log_name" | tr '/' '_')
        powershell.exe -Command "
            Get-WinEvent -LogName '$log_name' -MaxEvents 1000 -ErrorAction SilentlyContinue |
            Where-Object { \$_.TimeCreated -gt (Get-Date).AddDays(-30) } |
            ConvertTo-Json -Depth 3
        " > "$OUTPUT_DIR/windows_${safe_name}.json" 2>/dev/null
    done
}

collect_macos_events() {
    local predicates=(
        'subsystem == "com.apple.fido"'
        'process == "securityd" AND eventMessage CONTAINS "passkey"'
        'subsystem == "com.apple.passkeyd"'
        'process == "credd" AND eventMessage CONTAINS "keychain"'
        'eventMessage CONTAINS "WebAuthn" OR eventMessage CONTAINS "CTAP2"'
    )
    for i in "${!predicates[@]}"; do
        log show --predicate "${predicates[$i]}" --last 30d --style json \
            > "$OUTPUT_DIR/macos_predicate_${i}.json" 2>/dev/null
    done
}

collect_android_events() {
    if command -v adb &>/dev/null; then
        adb logcat -b all -d | grep -iE "fido|passkey|webauthn|biometric|credential" \
            > "$OUTPUT_DIR/android_logcat.txt" 2>/dev/null
        adb shell dumpsys credential_manager \
            > "$OUTPUT_DIR/android_credential_manager.txt" 2>/dev/null
    fi
}

analyze_risk_patterns() {
    echo "=== Passkey Forensics Risk Analysis ==="
    echo "Output directory: $OUTPUT_DIR"
    echo ""
    if [[ "$OSTYPE" == "darwin"* ]]; then
        local webauthn_count=$(grep -c -i "webauthn\|passkey\|fido" "$OUTPUT_DIR"/macos_*.json 2>/dev/null || echo 0)
        echo "macOS WebAuthn/Passkey events found: $webauthn_count"
    elif [[ "$OSTYPE" == "msys" || "$OSTYPE" == "cygwin" ]]; then
        echo "Windows event files collected:"
        ls -la "$OUTPUT_DIR"/windows_*.json 2>/dev/null
    fi
    echo ""
    echo "Review $OUTPUT_DIR/ for detailed forensic data."
}

case "$(uname -s)" in
    Darwin)   collect_macos_events ;;
    Linux)    collect_android_events ;;
    MINGW*|CYGWIN*)  collect_windows_events ;;
esac

analyze_risk_patterns

import json
import sys
import hashlib
from datetime import datetime
from collections import defaultdict
from math import radians, sin, cos, sqrt, atan2

GEOLOC_DB = {
    "US": (37.0902, -95.7129),
    "CN": (35.8617, 104.1954),
    "JP": (36.2048, 138.2529),
    "DE": (51.1657, 10.4515),
    "GB": (55.3781, -3.4360),
}

def haversine(lat1, lon1, lat2, lon2):
    R = 6371
    dlat = radians(lat2 - lat1)
    dlon = radians(lon2 - lon1)
    a = sin(dlat/2)**2 + cos(radians(lat1)) * cos(radians(lat2)) * sin(dlon/2)**2
    return R * 2 * atan2(sqrt(a), sqrt(1-a))

class PasskeyAnomalyDetector:
    def __init__(self):
        self.alerts = []
        self.user_profiles = defaultdict(lambda: {
            "locations": [],
            "credential_ids": set(),
            "authenticator_types": set(),
            "timestamps": [],
            "sign_counts": {},
            "origins": set(),
            "user_agents": set()
        })

    def ingest_event(self, event):
        uid = event.get("user_id", "unknown")
        profile = self.user_profiles[uid]
        ts_str = event.get("timestamp", "")
        if ts_str:
            try:
                ts = datetime.fromisoformat(ts_str.replace("Z", "+00:00"))
                profile["timestamps"].append(ts)
            except ValueError:
                pass
        cred_id = event.get("credential_id", "")
        if cred_id:
            profile["credential_ids"].add(cred_id)
        auth_type = event.get("authenticator_type", "")
        if auth_type:
            profile["authenticator_types"].add(auth_type)
        origin = event.get("origin", "")
        if origin:
            profile["origins"].add(origin)
        ua = event.get("user_agent", "")
        if ua:
            profile["user_agents"].add(ua)
        sign_count = event.get("sign_count", -1)
        if cred_id and sign_count >= 0:
            prev = profile["sign_counts"].get(cred_id, -1)
            if prev >= 0:
                if sign_count < prev:
                    self._alert(uid, "SIGN_COUNT_REVERSE",
                                f"Count {prev} -> {sign_count}", "CRITICAL", "T1557")
                elif sign_count - prev > 100:
                    self._alert(uid, "SIGN_COUNT_JUMP",
                                f"Jump +{sign_count - prev}", "HIGH", "T1557")
            profile["sign_counts"][cred_id] = sign_count
        loc = event.get("geo_country", "")
        if loc:
            profile["locations"].append((ts_str, loc))
        self._check_impossible_travel(uid, profile)
        self._check_multi_origin(uid, profile)

    def _check_impossible_travel(self, uid, profile):
        locs = profile["locations"]
        if len(locs) < 2:
            return
        for i in range(1, len(locs)):
            ts_prev, c_prev = locs[i-1]
            ts_curr, c_curr = locs[i]
            if c_prev == c_curr or c_prev not in GEOLOC_DB or c_curr not in GEOLOC_DB:
                continue
            try:
                t1 = datetime.fromisoformat(ts_prev.replace("Z", "+00:00"))
                t2 = datetime.fromisoformat(ts_curr.replace("Z", "+00:00"))
                hours = abs((t2 - t1).total_seconds()) / 3600
                dist = haversine(*GEOLOC_DB[c_prev], *GEOLOC_DB[c_curr])
                speed = dist / max(hours, 0.01)
                if speed > 900:
                    self._alert(uid, "IMPOSSIBLE_TRAVEL",
                                f"{c_prev}->{c_curr} {dist:.0f}km in {hours:.1f}h ({speed:.0f}km/h)",
                                "CRITICAL", "T1078")
            except (ValueError, KeyError):
                continue

    def _check_multi_origin(self, uid, profile):
        if len(profile["origins"]) > 3:
            self._alert(uid, "MULTI_ORIGIN",
                        f"Multiple origins: {profile['origins']}", "HIGH", "T1566")

    def _alert(self, uid, atype, detail, severity, mitre):
        self.alerts.append({
            "user_id": uid,
            "alert_type": atype,
            "detail": detail,
            "severity": severity,
            "mitre": mitre,
            "timestamp": datetime.utcnow().isoformat() + "Z"
        })

    def generate_report(self):
        return {
            "total_alerts": len(self.alerts),
            "critical": [a for a in self.alerts if a["severity"] == "CRITICAL"],
            "high": [a for a in self.alerts if a["severity"] == "HIGH"],
            "all_alerts": self.alerts
        }

if __name__ == "__main__":
    detector = PasskeyAnomalyDetector()
    logfile = sys.argv[1] if len(sys.argv) > 1 else "rp_auth_logs.jsonl"
    try:
        with open(logfile) as f:
            for line in f:
                try:
                    detector.ingest_event(json.loads(line.strip()))
                except json.JSONDecodeError:
                    continue
    except FileNotFoundError:
        print(json.dumps({"error": f"File not found: {logfile}"}))
        sys.exit(1)
    report = detector.generate_report()
    print(json.dumps(report, indent=2, ensure_ascii=False))

rule FIDO2_Malicious_Authenticator {
    meta:
        description = "Detects indicators of malicious FIDO2 authenticator implementations"
        author = "x7peeps"
        date = "2026-07-22"
        reference = "Passkey Security Forensics"
        mitre_attck = "T1557,T1199"
    strings:
        $ctap_header = { 80 01 ?? 02 ?? 03 }
        $webauthn_api = "navigator.credentials" ascii
        $fido_service = "FIDO" ascii nocase
        $suspicious_origin = "javascript:" ascii
        $relay_marker = "ble-relay" ascii nocase
        $fake_attestation = "attStmt" ascii
        $challenge_reuse = "replay" ascii nocase
    condition:
        ($webauthn_api and $suspicious_origin) or
        ($relay_marker and $fido_service) or
        ($ctap_header and $fake_attestation and $challenge_reuse)
}

rule CTAP2_Credential_Cloning_Indicators {
    meta:
        description = "Detects indicators of CTAP2 credential cloning attempts"
        author = "x7peeps"
        date = "2026-07-22"
        mitre_attck = "T1557,T1550"
    strings:
        $ctap_msg = { 80 10 }
        $ctap_init = { 80 86 }
        $sign_counter_zero = { 00 00 00 00 }
        $get_assertion_cmd = { 80 01 }
        $make_cred_cmd = { 80 01 }
    condition:
        $ctap_msg and $sign_counter_zero and $get_assertion_cmd
}

阶段1: 初始访问
  攻击者发送钓鱼邮件 → 受害者点击链接 → 访问伪造的RP登录页面

阶段2: 会话劫持
  伪造页面加载合法RP的WebAuthn JS库 → 调用navigator.credentials.get()
  浏览器触发CTAP2 GetAssertion → BLE中继设备拦截请求

阶段3: 中继认证
  中继设备通过WebSocket转发到C2服务器 → 攻击者页面显示认证进度
  受害者设备完成用户验证（生物识别） → 私钥签名Challenge
  签名通过中继链返回 → 伪造页面提交到真实RP → 认证成功

阶段4: 后渗透
  攻击者获得受害者会话 → 访问企业内部系统 → 横向移动

阶段1: 漏洞触发
  攻击者控制的RP发送特制的MakeCredential请求
  → rp.id字段超长输入 → CTAP2解析器缓冲区溢出

阶段2: 影响评估
  潜在影响: 认证器crash重启、内存内容泄露、attestation伪造
  实际利用难度: 需要物理接触或恶意RP服务器

阶段3: 检测与响应
  Yubico发布固件更新 → 强制固件降级保护机制
  安全社区审计CTAP2解析器代码 → 发现多个类似问题