Category Archives: SecurID

Security firm RSA blames nation state for attack on its servers

RSA has revealed that it believes two groups, working on behalf of a single nation state, hacked into its servers and stole information related to the company’s SecurID two-factor authentication products.

But for some reason it’s declining to say which country..

Share/Save

Hackers hit IMF with ‘sophisticated cyberattack’, reports claim

IMFThe International Monetary Fund (IMF) has suffered a major hack, according to media reports this weekend.

The organisation, already making the headlines following the arrest and resignation of its boss Dominique Strauss-Kahn (whose alleged perpetration of a sexual assault has itself been used as springboard for malware attacks), attempts to oversee financial crises around the world and promote economic development.

According to a New York Times report, senior sources within the IMF confirmed to the newspaper that the organisation had suffered a “very major breach” and was deemed serious enough to cut a computer link between the IMF and its near neighbour in downtown Washington, the World Bank.

A World Bank spokesman is reported by the New York Times to say that the disconnection was taken out of “an abundance of caution” until the nature of the attack on the IMF, was understood. The link was apparently quickly restored, and no attack on the World Bank is said to have occurred.

Coin in World bankBloomberg, meanwhile, claims to have got its hands on a series of internal emails and memos distributed to IMF staff, warning them that computer systems had been compromised by hackers:

"Last week we detected some suspicious file transfers, and the subsequent investigation established that a Fund desktop computer had been compromised and used to access some Fund systems. At this point, we have no reason to believe that any personal information was sought for fraud purposes."

Furthermore, the IMF is said to have told staff on June 8 that it would be replacing their RSA SecurID tokens, used for authentication.

Inevitably, speculation is likely to rise that the attack on the IMF may have been connected to the recent security breach at RSA (which has, in turn, affected the likes of Lockheed Martin and possibly other military contractors) however, an IMF source is said to have told the New York Times that no such link is suspected in this attack.

It seems a single day can’t pass without a well-known institution making the headlines for being the victim of a hacking attack or loss of sensitive data. All organisations need to take the seemingly growing tide of internet attacks as a warning sign, and ensure that they have strong defences in place and that every member of staff has been trained in best practices to reduce the risk.

You can read more about the alleged hack in these New York Times and Bloomberg reports.

FLAMING RETORT – Three words for RSA. Promptness. Clarity. Openness.

What a lot of fuss RSA’s security breach has caused! And what a lot of fear and uncertainty and doubt still surrounds it!

In case you haven’t been following the story, it began in mid-March 2011, when RSA admitted that its security had been breached and that “certain information [was] extracted from RSA’s systems.” Some of that information was specifically related to RSA’s SecurID products; the CEO admitted that “this information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation.”

The CEO, Arthur Coviello, also assured everybody that the company was “very actively communicating this situation to RSA customers.”

I thought this was a good start, even though it raised more questions than it answered.

An admission and an apology go a long way – provided that they are quickly followed by genuinely useful information which explains how the problem arose, what holes it introduced, how those holes can be closed, and what is being done to prevent anything like it from happening again.

But RSA’s version of “very actively communicating” with its customers didn’t go that way. We still don’t really know what happened. We don’t know what holes were opened up because of the attack. And RSA customers still can’t work out for themselves what sort of risk they’re up against. They have to assume the worst.

What we do know is that US engineering giant Lockheed Martin subsequently suffered an attempted breakin. Lockheed stated that the data stolen from RSA was a “contributing factor” to its own attack, and RSA’s Coviello agreed:

[O]n Thursday, June 2, 2011, we were able to confirm that information taken from RSA in March had been used as an element of an attempted broader attack on Lockheed Martin, a major U.S. government defense contractor. Lockheed Martin has stated that this attack was thwarted.

Additionally, as I reported yesterday, RSA is offering to replace SecurID tokens for at least some of its customers.

What’s fanning the flames in the technosphere is this: why would replacing your existing tokens with more of the same from RSA make any difference?

Because RSA has offered to replace tokens, speculation seems to be that the crooks who broke into RSA got away with a database linking tokens to customers in such a way that tokens for each company could be cloned. With that database, an attacker would only need to work out which employee had which token in order to produce the right “secret number” sequence.

That, the theory goes, lets you mount an effective attack. It goes something like this.

To tie a token to a user, use a keylogger to grab one or more of the user’s token codes, along with his username, network password, and token PIN. (The token PIN is essentially a password for the token itself.)

You can’t reuse the token code, of course – that’s why the person you’re attacking chose to use tokens in the first place – but you can use it to match the keylogged user with a token number sequence in your batch of cloned customer tokens.

So you now have a soft-clone of the user’s token. And, thanks to the keylogger, you have their username, password and PIN. Bingo. Remote login.

I don’t accept this speculation as complete.

Even if it was the method used in the Lockheed attack, why would I accept that it’s a sufficient explanation? And even if it were, why would I accept – in the absence of any other information from RSA – that the same thing won’t happen again? Are they now offering to stop retaining data which makes it possible for an intruder into their network to compromise mine? Why would they insist on doing that anyway?

More confusingly, if the only practicable attack requires an attacker to keylog the PIN of a user’s token, why is the entire SecurID product range considered at risk?

RSA sells tokens in which the PIN is entered on the token itself, which is equipped with a tiny keypad. Those PINs can’t be keylogged.

So why isn’t RSA stating that its more upmarket tokens are safe? Users of those devices could immediately relax. Or is RSA unwilling to make those claims because there are other potential attacks against its devices which might be mounted by attackers equipped with the stolen data?

Perhaps this token-to-customer mapping database theory is a red herring? After all, there might be other trade secrets the attackers made off with which would facilitate other sorts of attack.

For example, a cryptanalytical report might show how to clone tokens without any customer-specific data. Or confidential engineering information might suggest how to extract cryptographic secrets from tokens without triggering any tamper-protection, allowing them to be cloned with just brief physical access.

In short, the situation is confused because RSA hasn’t attempted to remove our confusion.

It’s no good having mandatory data breach disclosure laws if all they teach us is to admit we had a breach. We also need to convey information of obvious practical value to all affected parties. I’ll repeat my earlier list again. When disclosing breaches, we need to explain:

* How the problem arose.

* What holes it introduced. (And what it did not.)

* How those holes can be closed.

* What is being done to prevent it from happening again.

Three words. Promptness. Clarity. Openness.

PS: Lockheed Martin makes the world’s most desirable vehicle. Here it is at Avalon airport, near Geelong in Australia. That’s what I call a flying kangaroo!

RSA to replace all SecurID tokens – or perhaps not

SecurID tokenThe internet is abuzz with news that beleaguered security company RSA, which suffered a security intrusion and theft of trade secrets back in March, is offering to replace its customers’ security tokens.

Security tokens are used in two-factor authentication to add additional strength to conventional password-based logins.

The simplest sort of token generates and displays a sequence of pseudo-random numbers, with a new number appearing every minute or so. You enter this ever-changing number as well as, or instead of, your regular password.

The theory behind time-based token authentication is that only your authentication server and the token itself can reproduce the pseudo-random stream. So, if you don’t have possession of the token, you’ll never know the password-of-the-minute.

And if a crook should shoulder-surf or keylog your current token number, it’ll be worthless next time. That should make you much more secure than relying on a password you use over and over again.

But one concern over RSA’s security breach was that some of the trade secrets stolen might allow cybercrooks to work out a token’s pseudo-random number sequence. Of course, this would destroy the very foundations of RSA token security.

RSA didn’t do itself many favours when it first commented on the breach, playing its cards rather close to its chest and not saying much more about the ongoing security of its tokens than:

"we are confident that the information extracted does not enable a successful direct attack on any of our RSA SecurID customers."

F-22 Raptor jet fighterSadly, RSA’s confidence may have been misplaced, with recent attacks on US defence contractors linked with the compromise of RSA token security.

Under this sort of pressure – and perhaps still reluctant to give away too many technical details for fear of making a bad thing worse – RSA has just announced a free replacement plan for users of its tokens.

That’s going to be a big job. But is it going to be quite as big as PC World suggests when it says that RSA “will replace [SecurID] tokens for any customer that asks“?

RSA’s open letter on the subject isn’t quite as clear-cut.

It looks as though RSA will only replace your tokens for free if you are a customer:

"with concentrated user bases typically focused on protecting intellectual property and corporate networks."

Open letter from RSAThose sound rather like weasel-words to me. What is a “concentrated user base”? If you directly protect your own corporate network, are you covered? Or is RSA only offering to cover you indirectly, as the customer-of-a-customer, by helping your reseller?

What if you’re a boutique ISP with a webmail service who has taken the extra step of offering selected users two-factor authentication? Is your user base concentrated enough? Are you protecting intellectual property, or just casual chatter?

And if you do swap out your old tokens, will you be given enough information to satisfy yourself that the new tokens don’t have the same flaws as the old ones?

What do you think? Take part in our poll – and be thankful you’re not working in one of RSA’s call centres or help desks right now!

Strike three: Speculation rises that another US military contractor has been hit by hackers

Military aircraftFox News is reporting that US military contractor Northrop Grumman may have suffered a hacking attack on its networks.

If true, the defense giant will be joining the likes of L-3 Communications and Lockheed Martin who have both been targeted in recent weeks by cyber attacks.

According to Fox News, Northrop Grumman unexpectedly shut down remote access to its network on May 26th, just five days after Lockheed Martin detected that unauthorised persons had infiltrated its systems.

A anonymous source at Northrop Grumman, which is the US’s second-largest defense contractor, told Fox News that the sudden lockdown was a shock to staff:

"We went through a domain name and password reset across the entire organization. This caught even my executive management off guard and caused chaos. I've been here a good amount of time and they've never done anything this way - we always have advanced notice."

SecurID tokenSpeculation is rising that what links the L-3, Lockheed Martin and Northrop Grumman security breaches are RSA’s SecurID tokens – devices used by many organisations worldwide to provide two factor authentication for remote staff.

In March, RSA admitted that it had been hacked, and some of the information stolen was specifically related to their SecurID two-factor authentication products.

RSA, the security division of EMC, hasn’t been forthcoming about the precise details of what was taken when they were hacked – but now that a third military contractor appears to have suffered as a consequence, there will be many firms keen to hear more details of how they should protect themselves.

L-3 defense supplier targeted in RSA SecurID hack attack, report claims

L-3 and RSA SecurID tokenUS military contractor L-3 Communications, whose customers include the US Department of Defense, has been named in a news report as having been targeted in attacks by external hackers.

According to reports, L-3 warned 5,000 employees in April about an attempted hack against the company’s network using forged RSA SecurID tokens.

The claim, by Wired magazine, follows news earlier this week that US military giant Lockheed Martin had been subject to its own hacking attack, with RSA SecurID token security once again in the frame.

An anonymous source told Wired that L-3 “uses SecurID for remote employee access to the unclassified corporate network, but classified networks at the company would not have been at risk in the attack.”

RSA Security, a division of EMC, admitted in March that it had been hacked, and that some of the information stolen was specifically related to RSA’s SecurID two-factor authentication products.

There will obviously be some who will point fingers at China as likely suspects for the probes into the networks of US military suppliers, but until some evidence is made public it’s only going to be speculation.

As RSA has chosen to keep largely schtum about what was taken from them – and we can hardly expect the military contractors to share much detail – your guess is as good as mine right now.

What does seem clear, however, is that stories of hacking into military and government systems has never had a higher profile. Bear that in mind when you read news reports that The Pentagon is working on a Cyber Defense Strategy that could see an internet attack treated as though it were an “act of war”.

Copyright © 2014. Powered by WordPress & Romangie Theme.