Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/8/2011
01:59 PM
50%
50%

Schwartz On Security: Confused By RSA's Clarification?

While RSA has offered to replace some tokens, many customers still don't know how or why their SecurID tokens may pose a security risk.

Could attackers break into your SecurID two-factor authentication system?

Despite the open letter issued this week by RSA chairman Art Coviello, many of the company's customers remain confused about exactly what attackers stole from RSA in March, and what risk that information might pose to their enterprise, even if they're not a defense contractor.

That's because RSA still hasn't fully detailed the SecurID-related data that attackers stole. Many people suspect that attackers captured copies of the seeds, or factory-encoded random keys installed on its hardware tokens. But as noted--not least in a recent story comment--stealing seeds alone isn't enough. Attackers would also have to tie a specific user to a specific token, which is much more difficult, but could theoretically be accomplished.

Is that the threat vector? We don't know, and in fact, it could be much worse. "There might be other trade secrets the attackers made off with which would facilitate other sorts of attacks," says Paul Ducklin, Asia Pacific head of technology for Sophos, in a blog post.

"For example, a cryptanalytical report might show how to clone tokens without any customer-specific data. Or confidential engineering information might suggest how to extract cryptographic secrets from tokens without triggering any tamper-protection, allowing them to be cloned with just brief physical access," he says. "In short, the situation is confused because RSA hasn't attempted to remove our confusion."

Should the security giant also have done more to prevent the advanced attack that breached its systems in the first place? "It doesn't make that much sense to blame RSA Security for what has happened. For sure they made mistakes--but ... the question is: What can and should customers do now?" asks Martin Kuppinger, founder and principal analyst at identity and information security analyst firm KuppingerCole, via email.

Perhaps unsurprisingly, according to the Wall Street Journal, some of RSA's 25,000 business customers are getting the jitters and requesting replacement tokens. But customers in industries not designated by RSA as being at high risk of attack--and to which RSA may not yet have reached out--will have to pay for the new tokens, according to Threatpost.

Security analyst Pete Lindstrom at Spire Security has said that RSA will have difficulty manufacturing enough new tokens to meet the needs of both new customers and replacement requests. As a result, there could be a token bottleneck in upcoming months, especially for companies deemed to not be at increased risk of attack.

No doubt, some SecurID customers will take their two-factor authentication business elsewhere, although this would be an even more expensive option, since most still have contracts with RSA. "Yes, companies will stop using RSA SecurID over time in many cases--not all, but many of them. SecurID is as reliable as a technology with centralized storage of secrets can be; the limits have been demonstrated now," says Kuppinger.

That gets to the bigger picture, as well as lessons to be learned from the RSA breach. For starters, he says, remember that no security mechanism is foolproof. Accordingly, ask in advance what to do if one authentication mechanism should fail. "The answer is versatility," he says.

In other words, don't put all of your authentication mechanisms in one basket, or faith in just two-factor authentication fobs. "Customers shouldn't focus on one specific technology in the future but the flexibility to use, add, combine different technologies for different use cases," says Kuppinger.

To do that, he recommends pursuing a more "versatile authentication" approach, mixing some combination of "soft tokens, out-of-band authentication, hardware token and other mechanisms." Using this approach, organizations could employ more varied and thus more secure authentication policies, for example, by requiring more types of authentication for more high-risk transactions. Furthermore, if one of a company's authentication vendors gets hacked and sensitive, product-related information is stolen, its technology could more easily be suspended or replaced, all while maintaining sufficient levels of security in the interim.

In this new Tech Center report, we profile five database breaches--and extract the lessons to be learned from each. Plus: A rundown of six technologies to reduce your risk. Download it here (registration required).

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 4/10/2020
Zscaler to Buy Cloudneeti
Dark Reading Staff 4/9/2020
Researcher Hijacks iOS, macOS Camera with Three Safari Zero-Days
Kelly Sheridan, Staff Editor, Dark Reading,  4/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Yes, I do have virus protection on my system, now what?
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11669
PUBLISHED: 2020-04-10
An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR, aka CID-53a712bae5dd.
CVE-2020-1801
PUBLISHED: 2020-04-10
There is an improper authentication vulnerability in several smartphones. Certain function interface in the system does not sufficiently validate the caller's identity in certain share scenario, successful exploit could cause information disclosure. Affected product versions include:Mate 30 Pro vers...
CVE-2020-3952
PUBLISHED: 2020-04-10
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
CVE-2020-4362
PUBLISHED: 2020-04-10
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication in an admin request over the SOAP connector. IBM X-Force ID: 178929.
CVE-2020-1802
PUBLISHED: 2020-04-10
There is an insufficient integrity validation vulnerability in several products. The device does not sufficiently validate the integrity of certain file in certain loading processes, successful exploit could allow the attacker to load a crafted file to the device through USB.Affected product version...