Perimeter
9/16/2011
05:26 PM
Rob Enderle
Rob Enderle
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Intel Demonstrates Potential Password-Killers

Intel presented two possible ways it plans to make passwords obsolete

I've never been a fan of passwords. For some time we have known that trivial passwords can be remembered but are easily compromised, and folks who write down complex passwords make them easy to find and copy. In fact, way back in the 1980s while I was working security audits in IBM, we’d regularly argue that passwords were largely an ineffective way to secure anything that was truly sensitive -- and that was long before the Internet.

Well, Intel might have come up with something that is on the cusp of eliminating passwords and making those of us who buy the next generation of PCs and tablets far more secure.

We all carry cell phones, and an increasing number of us carry smartphones, so why don't we use a cell phone as a second factor to validate we are who we say we are? At its recent developer conference, this was actually a compelling demonstration by Intel and could be done with an app on a smartphone, a unique text message generating a one-time key, or even a clickable (on the cell phone) message that validated the person who was logging in also had the cell phone tied with the account.

With that one move, the user's password could be the number one or "password," and it would be far more secure than the cryptic mess we advise users to have today. But Intel didn't stop there: It showcased a BIOS-based technology that would allow a Web page to bypass the buffer and send an image directly to the graphics system on a registered PC. The demonstration entailed the use of a randomized virtual keypad where a PIN number would be entered. Anyone cloning the screen would only see a black box, and while he might see the cursor, he would have no idea what the cursor was pointing at and couldn’t repeat the PIN. This pretty much eliminates buffer attacks as a way to get access to this class of identification information.

Now if the PIN was also single-use and sent to the cell phone, the level of security that could be provided to the user would likely exceed significantly what most high security systems provide today and be consumer-friendly.

We’ve been trying -- largely unsuccessfully -- to kill off passwords for decades. Intel is one of the few firms with enough power to actually make this happen, and the technologies it showcased were compelling. Given how entrenched passwords are, I doubt we’ll see them go away before 2025, but Intel might make them redundant in two years. And that's good enough for me.

Rob Enderle is president and founder of The Enderle Group. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant