Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/8/2011
01:59 PM
50%
50%

Schwartz On Security: Confused By RSA's Clarification?

While RSA has offered to replace some tokens, many customers still don't know how or why their SecurID tokens may pose a security risk.

Could attackers break into your SecurID two-factor authentication system?

Despite the open letter issued this week by RSA chairman Art Coviello, many of the company's customers remain confused about exactly what attackers stole from RSA in March, and what risk that information might pose to their enterprise, even if they're not a defense contractor.

That's because RSA still hasn't fully detailed the SecurID-related data that attackers stole. Many people suspect that attackers captured copies of the seeds, or factory-encoded random keys installed on its hardware tokens. But as noted--not least in a recent story comment--stealing seeds alone isn't enough. Attackers would also have to tie a specific user to a specific token, which is much more difficult, but could theoretically be accomplished.

Is that the threat vector? We don't know, and in fact, it could be much worse. "There might be other trade secrets the attackers made off with which would facilitate other sorts of attacks," says Paul Ducklin, Asia Pacific head of technology for Sophos, in a blog post.

"For example, a cryptanalytical report might show how to clone tokens without any customer-specific data. Or confidential engineering information might suggest how to extract cryptographic secrets from tokens without triggering any tamper-protection, allowing them to be cloned with just brief physical access," he says. "In short, the situation is confused because RSA hasn't attempted to remove our confusion."

Should the security giant also have done more to prevent the advanced attack that breached its systems in the first place? "It doesn't make that much sense to blame RSA Security for what has happened. For sure they made mistakes--but ... the question is: What can and should customers do now?" asks Martin Kuppinger, founder and principal analyst at identity and information security analyst firm KuppingerCole, via email.

Perhaps unsurprisingly, according to the Wall Street Journal, some of RSA's 25,000 business customers are getting the jitters and requesting replacement tokens. But customers in industries not designated by RSA as being at high risk of attack--and to which RSA may not yet have reached out--will have to pay for the new tokens, according to Threatpost.

Security analyst Pete Lindstrom at Spire Security has said that RSA will have difficulty manufacturing enough new tokens to meet the needs of both new customers and replacement requests. As a result, there could be a token bottleneck in upcoming months, especially for companies deemed to not be at increased risk of attack.

No doubt, some SecurID customers will take their two-factor authentication business elsewhere, although this would be an even more expensive option, since most still have contracts with RSA. "Yes, companies will stop using RSA SecurID over time in many cases--not all, but many of them. SecurID is as reliable as a technology with centralized storage of secrets can be; the limits have been demonstrated now," says Kuppinger.

That gets to the bigger picture, as well as lessons to be learned from the RSA breach. For starters, he says, remember that no security mechanism is foolproof. Accordingly, ask in advance what to do if one authentication mechanism should fail. "The answer is versatility," he says.

In other words, don't put all of your authentication mechanisms in one basket, or faith in just two-factor authentication fobs. "Customers shouldn't focus on one specific technology in the future but the flexibility to use, add, combine different technologies for different use cases," says Kuppinger.

To do that, he recommends pursuing a more "versatile authentication" approach, mixing some combination of "soft tokens, out-of-band authentication, hardware token and other mechanisms." Using this approach, organizations could employ more varied and thus more secure authentication policies, for example, by requiring more types of authentication for more high-risk transactions. Furthermore, if one of a company's authentication vendors gets hacked and sensitive, product-related information is stolen, its technology could more easily be suspended or replaced, all while maintaining sufficient levels of security in the interim.

In this new Tech Center report, we profile five database breaches--and extract the lessons to be learned from each. Plus: A rundown of six technologies to reduce your risk. Download it here (registration required).

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12420
PUBLISHED: 2019-12-12
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.
CVE-2019-16774
PUBLISHED: 2019-12-12
In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.
CVE-2018-11805
PUBLISHED: 2019-12-12
In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf ...
CVE-2019-5061
PUBLISHED: 2019-12-12
An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before the required authentication process has completed. This could lead to different denial of service scenarios, either by causing CAM table att...
CVE-2019-5062
PUBLISHED: 2019-12-12
An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial of...