Perimeter
9/16/2011
05:26 PM
Rob Enderle
Rob Enderle
Commentary
50%
50%

Intel Demonstrates Potential Password-Killers

Intel presented two possible ways it plans to make passwords obsolete

I've never been a fan of passwords. For some time we have known that trivial passwords can be remembered but are easily compromised, and folks who write down complex passwords make them easy to find and copy. In fact, way back in the 1980s while I was working security audits in IBM, we’d regularly argue that passwords were largely an ineffective way to secure anything that was truly sensitive -- and that was long before the Internet.

Well, Intel might have come up with something that is on the cusp of eliminating passwords and making those of us who buy the next generation of PCs and tablets far more secure.

We all carry cell phones, and an increasing number of us carry smartphones, so why don't we use a cell phone as a second factor to validate we are who we say we are? At its recent developer conference, this was actually a compelling demonstration by Intel and could be done with an app on a smartphone, a unique text message generating a one-time key, or even a clickable (on the cell phone) message that validated the person who was logging in also had the cell phone tied with the account.

With that one move, the user's password could be the number one or "password," and it would be far more secure than the cryptic mess we advise users to have today. But Intel didn't stop there: It showcased a BIOS-based technology that would allow a Web page to bypass the buffer and send an image directly to the graphics system on a registered PC. The demonstration entailed the use of a randomized virtual keypad where a PIN number would be entered. Anyone cloning the screen would only see a black box, and while he might see the cursor, he would have no idea what the cursor was pointing at and couldn’t repeat the PIN. This pretty much eliminates buffer attacks as a way to get access to this class of identification information.

Now if the PIN was also single-use and sent to the cell phone, the level of security that could be provided to the user would likely exceed significantly what most high security systems provide today and be consumer-friendly.

We’ve been trying -- largely unsuccessfully -- to kill off passwords for decades. Intel is one of the few firms with enough power to actually make this happen, and the technologies it showcased were compelling. Given how entrenched passwords are, I doubt we’ll see them go away before 2025, but Intel might make them redundant in two years. And that's good enough for me.

Rob Enderle is president and founder of The Enderle Group. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4231
Published: 2015-07-03
The Python interpreter in Cisco NX-OS 6.2(8a) on Nexus 7000 devices allows local users to bypass intended access restrictions and delete an arbitrary VDC's files by leveraging administrative privileges in one VDC, aka Bug ID CSCur08416.

CVE-2015-4232
Published: 2015-07-03
Cisco NX-OS 6.2(10) on Nexus and MDS 9000 devices allows local users to execute arbitrary OS commands by entering crafted tar parameters in the CLI, aka Bug ID CSCus44856.

CVE-2015-4234
Published: 2015-07-03
Cisco NX-OS 6.0(2) and 6.2(2) on Nexus devices has an improper OS configuration, which allows local users to obtain root access via unspecified input to the Python interpreter, aka Bug IDs CSCun02887, CSCur00115, and CSCur00127.

CVE-2015-4237
Published: 2015-07-03
The CLI parser in Cisco NX-OS 4.1(2)E1(1), 6.2(11b), 6.2(12), 7.2(0)ZZ(99.1), 7.2(0)ZZ(99.3), and 9.1(1)SV1(3.1.8) on Nexus devices allows local users to execute arbitrary OS commands via crafted characters in a filename, aka Bug IDs CSCuv08491, CSCuv08443, CSCuv08480, CSCuv08448, CSCuu99291, CSCuv0...

CVE-2015-4239
Published: 2015-07-03
Cisco Adaptive Security Appliance (ASA) Software 9.3(2.243) and 100.13(0.21) allows remote attackers to cause a denial of service (device reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCus84220.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report